Two-Factor Authentication (2FA) - Forest Documentation

Overview

Two-Factor Authentication (2FA) adds an additional security layer beyond username and password. Users must provide a second factor - typically a time-based one-time password (TOTP) from an authenticator app - to access Forest.

Recommended for All Users: 2FA significantly reduces the risk of unauthorized access, even if passwords are compromised.

Supported 2FA methods

Authenticator apps (recommended)

Time-based One-Time Password (TOTP) apps generate 6-digit codes that change every 30 seconds:

Google Authenticator

Free app for iOS and Android

Microsoft Authenticator

Supports backup and cloud sync

Authy

Multi-device support with encrypted backups

1Password

Password manager with built-in TOTP

Bitwarden

Open-source with TOTP support

LastPass Authenticator

One-tap push notifications

Backup codes

Recovery codes to use if you lose access to your authenticator app:

Generated during 2FA setup
One-time use only
Store securely (password manager or printed copy)
Can regenerate if needed

Save Your Backup Codes: Without backup codes or access to your authenticator, you’ll be locked out if your device is lost.

Enabling 2FA (for users)

Setup process

Access Account Settings

Click your profile picture > Account Settings > Security

Enable Two-Factor Authentication

Click Enable 2FA button

Scan QR Code

Open your authenticator app
Tap “Add account” or ”+” button
Scan the QR code displayed in Forest

Or enter the setup key manually if you can’t scan

Verify Setup

Enter the 6-digit code from your authenticator app to confirm it’s working correctly

Save Backup Codes

Download or copy your backup codes
Store them securely (password manager recommended)
Check the box to confirm you’ve saved them

2FA Enabled

You’ll now be prompted for a code each time you log in

Manual setup key

If you can’t scan the QR code, use the manual setup key:

Setup Key: JBSWY3DPEHPK3PXP
Account: your-email@example.com
Type: Time-based

Using 2FA to log in

Enter Credentials

Enter your email and password as usual

Enter 2FA Code

Open your authenticator app and enter the current 6-digit code

Remember Device (Optional)

Check “Trust this device for 30 days” to skip 2FA on this device

Access Granted

You’re logged in to Forest

Using backup codes

If you don’t have access to your authenticator app:

Click 'Use Backup Code'

On the 2FA prompt, click the link to use a backup code

Enter Backup Code

Enter one of your saved backup codes (case-insensitive)

Code is Consumed

Each backup code can only be used once. Generate new ones if running low.

Trusted devices

Mark devices as trusted to skip 2FA for 30 days:

Use Case: Your primary work computer
Security: A secure cookie identifies the device
Removal: Go to Account Settings > Security > Trusted Devices to revoke

Public Computers: Never mark public or shared computers as trusted.

Enforcing 2FA (for admins)

Administrators can require 2FA for all users or specific roles.

Project-wide enforcement

Require 2FA for everyone:

Navigate to Security Settings

Go to Project Settings > Security > Authentication

Enable 2FA Requirement

Toggle Require Two-Factor Authentication to ON

Set Grace Period

Choose how long users have to enable 2FA:

24 hours (urgent)
7 days (recommended)
30 days (gradual rollout)

Notify Users

Forest automatically emails users about the requirement

Monitor Compliance

Track which users have enabled 2FA in Project Settings > Teams > Users

Role-based enforcement

Require 2FA only for specific roles:

// Example: Require 2FA for Admins and Editors
{
  "roles": {
    "admin": {
      "require2FA": true
    },
    "editor": {
      "require2FA": true
    },
    "viewer": {
      "require2FA": false  // Optional for viewers
    }
  }
}

Configuration:

Go to Project Settings > Roles
Edit each role
Check Require 2FA for this role

Exceptions

Allow specific users to bypass 2FA requirement:

Use Case: Emergency access accounts, service accounts, external contractors
Configuration: Edit user profile > Security > Exempt from 2FA requirement

Best Practice: Minimize exceptions. If a user truly needs access, they should enable 2FA.

Managing 2FA

Regenerating backup codes

If you’ve used all your backup codes or lost them:

Access Security Settings

Go to Account Settings > Security

Regenerate Codes

Click Regenerate Backup Codes

Enter 2FA Code

Verify with current authenticator code

Save New Codes

Old codes are invalidated. Save the new ones securely.

Resetting your own 2FA

If you need to switch authenticator apps or devices:

Disable 2FA

Go to Account Settings > Security > Disable 2FA

Verify Identity

Enter your current 2FA code or a backup code

Re-enable 2FA

Follow the setup process again with your new device/app

Admin: resetting user’s 2FA

If a user loses access to their authenticator and backup codes:

Security Risk: Only reset 2FA after verifying the user’s identity through alternate means (video call, ID verification, etc.).

Verify User Identity

Confirm the user’s identity (don’t rely solely on email, which could be compromised)

Navigate to User Management

Go to Project Settings > Teams > Users

Find User

Search for the user who needs 2FA reset

Reset 2FA

Click user menu (…) > Reset Two-Factor Authentication

Confirm Action

Confirm the reset. User must set up 2FA again at next login (if required).

Log the Action

This action is automatically logged in audit logs for security tracking

2FA + SSO

How they work together

2FA and SSO can be used simultaneously for defense in depth:

IdP-Based 2FA (Recommended)
Forest 2FA + SSO
SSO Only (No Forest 2FA)

MFA enforced at identity provider

User authenticates with IdP (e.g., Okta, Azure AD)
IdP requires MFA (push notification, TOTP, etc.)
Forest trusts the IdP’s authentication

Advantages:

Centralized MFA management
One MFA prompt for all applications
Better user experience

Configuration: Enable MFA in your IdP settings

Recommended configuration

For SSO Users

Enforce MFA at the IdP levelDisable Forest 2FA for SSO users to avoid double-prompting

For Password Users

Require Forest 2FAThese users don’t benefit from IdP security

Troubleshooting

Code not working

Time Sync Issues

Problem: Authenticator app time is out of syncSymptoms: Code is always rejected, even when entered correctlySolution:

Check your phone’s time settings
Enable automatic time/date
Try the next code (they change every 30 seconds)

For Google Authenticator:

Go to Settings > Time correction for codes > Sync now

Wrong Code Entered

Problem: Entering an old or incorrect codeSolution:

Wait for the code to refresh in your app
Ensure you’re using the correct account (if you have multiple)
Check for typos (0 vs O, 1 vs l)

Authenticator App Deleted

Problem: Removed app or factory reset phone without backing upSolution:

Use a backup code if you have one
Contact your admin for 2FA reset
Admin must verify your identity before resetting

Can’t scan QR code

Solutions:

Use Manual Entry: Copy the setup key and enter it manually in your authenticator app
Try Different Device: Use a tablet or another phone to scan
Check Camera Permissions: Ensure authenticator app has camera access
Screenshot: Take a screenshot (secure it afterwards) and scan from photos

Lost backup codes

If you still have authenticator access:

Log in with your authenticator code
Regenerate new backup codes
Save them securely

If you don’t have authenticator or backup codes:

Contact your administrator
Admin will verify your identity
Admin can reset your 2FA
Set up 2FA again immediately

Can’t log in after 2FA enforcement

Problem: 2FA was enforced but user hasn’t set it up Solution:

Users receive grace period to enable 2FA
During grace period, they’re prompted to set up 2FA
After grace period, they must set up 2FA before accessing

Admin Override:

Admin can temporarily exempt user from 2FA requirement
User can then log in and set up 2FA properly

​Overview

​Supported 2FA methods

​Authenticator apps (recommended)

Google Authenticator

Microsoft Authenticator

Authy

1Password

Bitwarden

LastPass Authenticator

​Backup codes

​Enabling 2FA (for users)

​Setup process

​Manual setup key

​Using 2FA to log in

​Login flow

​Using backup codes

​Trusted devices

​Enforcing 2FA (for admins)

​Project-wide enforcement

​Role-based enforcement

​Exceptions

​Managing 2FA

​Regenerating backup codes

​Resetting your own 2FA

​Admin: resetting user’s 2FA

​2FA + SSO

​How they work together

​Recommended configuration

For SSO Users

For Password Users

​Troubleshooting

​Code not working

​Can’t scan QR code

​Lost backup codes

​Can’t log in after 2FA enforcement

Overview

Supported 2FA methods

Authenticator apps (recommended)

Backup codes

Enabling 2FA (for users)

Setup process

Manual setup key

Using 2FA to log in

Login flow

Using backup codes

Trusted devices

Enforcing 2FA (for admins)

Project-wide enforcement

Role-based enforcement

Exceptions

Managing 2FA

Regenerating backup codes

Resetting your own 2FA

Admin: resetting user’s 2FA

2FA + SSO

How they work together

Recommended configuration

Troubleshooting

Code not working

Can’t scan QR code

Lost backup codes

Can’t log in after 2FA enforcement