How to setup
Multi-Factor CAS authentication account
1.1st Edition
26/1/2022

Multi-Factor Authentication CAS
In addition to the Nagoya University ID and password, authentication for Multi-Factor Authentication CAS
requires an "Authentication Code" which is a 6-digit number that changes at 30 second intervals (see below
figure).

The Authentication Code is presented on an Authentication Application - which has an

Authentication Seed

registered - or a hardware token. The hardware token requires additional expenses to purchase, so werecommend you to use the Authentication Application as far as possible.

Registering a new Authentication Seed to an Authentication Application
The following are registration procedures for common Authentication Applications.
・Authentication Seed Registration to Google Authenticator・Authentication Seed Registration to Microsoft Authenticator・Authentication Seed Registration to WinAuth (Windows App)・Authentication Seed Registration to Step Two (macOS App)1 / 33

Contents
Authentication Seed Registration to GoogleAuthenticator .................................................. 3
Authentication Seed Registration to Microsoft Authenticator.............................................. 9Authentication Seed Registration to WinAuth (Windows App) .......................................... 14
Authentication Seed Registration to Step Two (macOS App) ............................................. 23
Trial Run of Multi-Factor Authentication CAS ................................................................... 29
Application to Use Hardware Token for Multi- Factor Authentication CAS ..................... 32

2 / 33

Authentication Seed Registration to Google Authenticator
Google Authenticator Setup
Install Google Authenticator onto your smartphone from Google Play (Android) or the App Store (Apple).

Login to the Authentication Seed Management webpage and Authentication Seedgeneration
When you connect to the Multi-Factor Authentication CAS Authentication Seed Management webpage, thesystem requires authentication with your Nagoya University ID and password, so please input them toauthenticate.
To distribute Authentication Seeds safely, access to the Authentication Seed Management webpage is only
allowed from the Nagoya University's network on campus excluding special case.

3 / 33

If you click the "Create a new" button, a new Authentication Seed will be generated.
You cannot display a previously used Authentication Seed. Similar to other password reset procedures, you
can only generate and register a new Authentication Seed.

he generated Authentication Seed will be displayed as both an "Authentication Seed" (consisting ofalphanumeric characters) and a "QR code".

4 / 33

The Authentication Seed will not be registered to the CAS server until you click the "Register" button on
the Authentication Seed Management webpage. After you register the Authentication Seed to the
Authentication Application, please remember to click the "Register" button to register the Authentication
Seed to the CAS server.
Even if you mistakenly generate a new Authentication Seed, the previous Authentication Seed
will remain as long as you do not click the "Register" button. Be sure to close the Multi-Factor
Authentication CAS Authentication Seed Management webpage without clicking the "Register"
button.

Procedure to register an Authentication Seed to Google Authenticator
For first-time users of Google Authenticator
When you start Google Authenticator, you will see the following screen. Tap "Get started" to proceed.

5 / 33

Next, a screen to select a method to register your Authentication Seed will appear. Select "Scan a QR code".
You will receive a notification on your smartphone, "Authenticator requires permission to use your camera".
Allow it.

For people already using Google Authenticator
After starting Google Authenticator, tap the "+" mark on the lower right-hand corner of the screen and start theregistration of a new Authentication Seed.
Next, a screen to select a method to register your Authentication Seed will appear. Select "Scan a QR code".

6 / 33

Authentication Seed registration with a QR code
If you choose "Scan a QR code" with a smartphone that has a built-in camera, a QR code scan screen willappear. Scan the QR code displayed on the Authentication Seed Management webpage.
The Authentication Seed will be registered as "NU (Central_Authentication_Service)".

Confirm that the 6-digit number displayed in the "Confirmation of Authentication Code" field on
the Authentication Seed Management webpage is the same as the one shown on Google
Authenticator.
If they are not the same, the time on your smartphone may be greatly out of sync.
After confirming that the 6-digit number displayed in the "Confirmation of Authentication Code" field is the sameas the one shown on Google Authenticator, please remember to click the "Register" button on the Multi-Factor
Authentication CAS Authentication Seed Management webpage and register your Authentication Seed to the
CAS server.

7 / 33

Authentication Seed registration by manually inputting the Authentication Seed
(Setup Key)If you select "Enter a setup key" when registering a new Authentication Seed, the following Setup Key(Authentication Seed) registration screen will be shown.

・Set an "Account name" that you can remember.
・Do not use an account name that is easily identifiable as being connected to your Nagoya
University ID. Select "Time based" for "Key Type".
・Input your "Authentication Seed" in the "Key" field.
・The authentication is not case sensitive, so you may input alphabetic characters in lower caseletters if you wish.
・It may be difficult to distinguish between characters like "0" (zero) and "O" and "1" (one) and"I", but feel free to input them as you like since those characters are handled as the same.

Confirm that the 6-digit number displayed in the "Confirmation of Authentication Code" field on the screen is thesame as the one shown on Google Authenticator.

If they are not the same, the time on your device may be greatly out of sync.
After confirming that the 6-digit number displayed in the "Confirmation of Authentication Code" field is the sameas the one shown on Google Authenticator, please remember to click the "Register" button on the Multi-Factor
Authentication CAS Authentication Seed Management webpage and register your Authentication Seed to the
CAS server.

Trial Run of Multi-Factor Authentication CAS
We have prepared a Multi-Factor Authentication CAS Trial webpage to carry out a trial run of the Multi-Factor
Authentication CAS. Following the instructions on the Trial Run of Multi-Factor Authentication CAS webpage.

8 / 33

Authentication Seed Registration to Microsoft Authenticator
Microsoft Authenticator Setup
Install Microsoft Authenticator onto your smartphone from Google Play (Android) or the App Store (Apple).

Login to the Authentication Seed Management webpage and Authentication Seedgeneration
When you connect to the Multi-Factor Authentication CAS Authentication Seed Management webpage,,the system requires authentication with your Nagoya University ID and password, so please input them toauthenticate.
To distribute Authentication Seeds safely, access to the Authentication Seed Management webpage is only
allowed from the Nagoya University's network on campus excluding special case.

9 / 33

If you click the "Create a new" button, a new Authentication Seed will be generated.
You cannot display a previously used Authentication Seed. Similar to other password reset
procedures, you can only generate and register a new Authentication Seed.

he generated Authentication Seed will be displayed as both an "Authentication Seed" (consisting ofalphanumeric characters) and a "QR code".

10 / 33

The Authentication Seed will not be registered to the CAS server until you click the "Register" button on the
Authentication Seed Management webpage. After you register the Authentication Seed to the Authentication
Application, please remember to click the "Register" button to register the Authentication Seed to the CAS
server.

Even if you mistakenly generate a new Authentication Seed, the previous Authentication Seed
will remain as long as you do not click the "Register" button. Be sure to close the Multi-Factor
Authentication CAS Authentication Seed Management webpage without clicking the "Register"
button.

Procedures to register an Authentication Seed to Microsoft Authenticator
For first-time users of Microsoft Authenticator
When you open Microsoft Authenticator, it will ask for your permission to collect your data. As there is noother choice, tap "Agree" and proceed. (We highly recommend that you stop this data collection
afterwards by disabling "Data for Usage Status (For improving app functionality…)" from the log menu in
the App Configurations.)
Microsoft Authenticator will ask you to sign in to your Microsoft Account. Choose "Scan QR code". It is up
to you whether you sign in or not.
Microsoft Authenticator will proceed to the QR code scan screen.
You will receive the notification "Authenticator requires permission to use your camera" on yoursmartphone. Allow it.

11 / 33

For people already using Microsoft Authenticator
After starting Microsoft Authenticator, tap the "+" mark on the upper right -hand corner, and register a
new Authentication Seed.

Microsoft Authenticator will ask you to choose the service which will use multi-factor authentication.
Choose "Other (Google, Facebook, etc.)".

Authentication Seed registration with a QR code
Scan the QR code displayed on the Authentication Seed management webpage through QR code scan screen.
The Authentication Seed will be registered as "NU (Central_Authentication_Service)"

Confirm that the 6-digit number displayed in the "Confirmation of Authentication Code" field on
the management webpage is the same as the one shown on Microsoft Authenticator.
If they are not the same, the time on your device may be greatly out of sync.
After confirming that the 6-digit number displayed in the "Confirmation of Authentication Code" field is the sameas the one shown on Microsoft Authenticator, please remember to click the "Register" button on the Multi-Factor
Authentication CAS Authentication Seed Management webpage and register your Authentication Seed to the CAS
server.

12 / 33

Authentication Seed registration by manually inputting the Authentication Seed
(Code)On the camera screen to scan the QR code, choose "or enter code manually".

The following Code (Authentication Seed) input screen will be shown.

・Set an "Account name" that you can remember.
・Do not use an account name that is easily identifiable as being connected to your Nagoya
University ID. Input your "Authentication Seed" in the "Secret key" field.
・The authentication is not case sensitive, so you may input alphabetic characters in lower caseletters if you wish. "0" (zero) and "1" (one) are not included in the codes. Please be sure to input
the alphabetical "O" and "I".

13 / 33

Confirm that the 6-digit number displayed in the "Confirmation of Authentication Code" field on the
management webpage is the same as the one shown on Microsoft Authenticator.

If they are not the same, the time on your device may be greatly out of sync.
After confirming that the 6-digit number displayed in the "Confirmation of Authentication Code" field is the sameas the one shown on Microsoft Authenticator, please remember to click the "Register" button on the Multi-Factor
Authentication CAS Authentication Seed Management webpage and register your Authentication Seed to the
CAS server.

Trial Run of Multi-Factor Authentication CAS
We have prepared a Multi-Factor Authentication CAS Trial webpage to carry out a trial run of the Multi-Factor
Authentication CAS. Following the instructions on the Trial Run of Multi-Factor Authentication CAS webpage.

14 / 33

Authentication Seed Registration to WinAuth (Windows App)
Downloading WinAuth
Go to the WinAuth download page and download the latest version, WinAuth

3.5.1.

The downloaded file is in a compressed ZIP format, so decompress the file and extract

WinAuth.exe.

WinAuth requires .NET Framework 4.5. Please download and install it from the Microsoft website if necessary.

15 / 33

Login to Authentication Seed management web page and seed generation
When you connected to Authentication Seed management web page for Multi-Factor Authentication CAS, thesystem requires you an authentication with Nagoya University ID and password. You have to input them toauthenticate.

If you push "Newly generation" button, Authentication Seed is newly generated.

You cannot see the Authentication Seed in past time again. As similar to generic password reset
procedure, we only allow newly generation of Authentication Seed.

16 / 33

A generated Authentication Seed are presented as both "Authentication Seed (notated with alphabets andnumbers)" and "QR code".

The Authentication Seed will not registered to CAS server until you push "Register" button. After you register
Authentication Seed to Authentication Application, push "Register" button to register Authentication Seed to CAS
server.

If you wrongly generated new Authentication Seed, the Authentication Seed in past time are still
existing if you do not push "Register" button. Close Authentication Seed management web page
without pushing "Register" button.

17 / 33

Authentication Seed registration to WinAuth
You will be asked to register an Authentication Seed the first time you start

WinAuth.

Click “Add" and proceed with the Authentication Seed registration.
Those who are already using WinAuth can also proceed with the Authentication Seed registrationby choosing “Add" from a different screen.

You will see a selection screen that asks you to choose the service which will use multi-factor authentication, but as
Nagoya University CAS is not included in the options, please choose “Authenticator" at the top of thelist.

Input a service name (Name field), Authentication Seed value (1.), and Authentication Seed generation method(2.). For the service name (Name field), you can input any name you want to register for.

However, please avoid inputting your Nagoya University ID as it is used for generating
Authentication Seed value.
For the Authentication Seed value (1.), please input your “Authentication Seed" displayed on theMulti-Factor Authentication CAS Authentication Seed Management webpage.
For the Authentication Seed generation method (2.), please choose“Time-based".
If you click “Verify Authenticator" (3.), the 6-digit number will be generated based on the Authentication Seedvalue and displayed in (4.).

18 / 33

Confirm that the 6-digit number displayed in the “Confirmation of Authentication Code" field on the Multi-Factor
Authentication CAS Authentication Seed Management webpage is the same as the one shown on WinAuth.

If they are the same, click on “OK".
they are not the same, the time on your device may be greatly out of sync.

19 / 33

The next step is to set the protection settings for

WinAuth.

・In the "Protect with my own Password" field, you can set a password that will be required to open
WinAuth.
・Set your password by inputting it in the "Password" field and confirm your password by inputting
it again in the "Verify" field. Make sure to input the different password from the one used for your
Nagoya University ID.
・By enabling "Encrypt to only be useable on this computer" and "And only by the current user on
this computer", you can prevent people with malicious intent from copying the password and using
it on other computers.

20 / 33

Use of WinAuth

Double click to open WinAuth.exe. If you have set a password, you will be prompted to enter it.
The 6-digit number required for each service's multi-factor authentication will be displayed.

Note that it will only be displayed if you click on the refresh mark on the right-hand side of eachservice name.

After confirming that the 6-digit number displayed in the "Confirmation of Authentication Code" field is the same as
the one shown on WinAuth, please remember to click the "Register" button on the Multi-Factor Authentication
CAS Authentication Seed Management webpage and register your Authentication Seed to the CAS server.

21 / 33

Q&A about WinAuth
Q: I forgot the password set for WinAuth.
A: Delete the files in the following location. However, please note that doing so will also reset all settings for
WinAuth, including the Authentication Seed.
C:\Users(Your_User_Name)\AppData\Roaming\WinAuth\winauth.xmlbr>

Trial Run of Multi-Factor Authentication CAS
We have prepared a Multi-Factor Authentication CAS Trial webpage to carry out a trial run of the Multi-Factor
Authentication CAS. Following the instructions on the Trial Run of Multi-Factor Authentication CAS webpage.

22 / 33

Authentication Seed Registration to Step Two (macOS App)
Downloading Step Two
Go to the Step Two page of Mac App Store and download the latest version.

Login to the Authentication Seed Management webpage and Authentication Seedgeneration

When you connect to the Multi-Factor Authentication CAS Authentication Seed Management webpage,,the system requires authentication with your Nagoya University ID and password, so please input them toauthenticate.
To distribute Authentication Seeds safely, access to the Authentication Seed Management webpage is only
allowed from the Nagoya University's network on campus excluding special case.

23 / 33

If you click the "Create a new" button, a new Authentication Seed will be generated.

You cannot display a previously used Authentication Seed. Similar to other password reset
procedures, you can only generate and register a new Authentication Seed.

he generated Authentication Seed will be displayed as both an "Authentication Seed" (consisting ofalphanumeric characters) and a "QR code".

24 / 33

The Authentication Seed will not be registered to the CAS server until you click the "Register" button on the
Authentication Seed Management webpage. After you register the Authentication Seed to the Authentication
Application, please remember to click the "Register" button to register the Authentication Seed to the CAS
server.

Even if you mistakenly generate a new Authentication Seed, the previous Authentication Seed
will remain as long as you do not click the "Register" button. Be sure to close the Multi-Factor
Authentication CAS Authentication Seed Management webpage without clicking the "Register"
buttonAuthentication Seed registration to Step Two (with QR code)
You will be asked to register an Authentication Seed the first time you start Step Two.

Click “+ Button" and proceed with the Authentication Seed registration.
Those who are already using Step Two can also proceed with the Authentication Seed
registration by choosing “+ Button".

After you push "+ Button", Step Two asks you to Authentication Seed registration method. Choose "Scan
Two-Step QR Code".

25 / 33

A window for QR code scan rises. Put the window to QR code on the web browser.

The Authentication Seed is registered to Step Two and Step Two displays Service Name and Authentication
Code pair.
Confirm that the 6-digit number displayed in the "Confirmation of Authentication Code" field on the Multi-Factor
Authentication CAS Authentication Seed Management webpage is the same as the one shown on Step Two.
If they are not the same, the time on your device may be greatly out of sync.

26 / 33

Authentication Seed Registration with alphameric Authentication Seed
If your environment cannot accpt QR code with some reason, you can choose Authentication Seed registration
with alphameric Authentication Seed.
Chose "Set Up Account Manually" at Authentication Seed registration selection.

・Input Authentication Code to "Secret Key" item.
・Input proper (identifiable) "Account Name" and "Email Address or Username" with yourself.
Note that we recommend you to avoid your Nagoya University ID and mail address of Nagoya
University Mail Service directly to avoid vulnerability of peeping.
・Confirm Authentication Code on Step Two and Authentication Code on the web page are
identical.
・If they are not the same, the time on your device may be greatly out of sync.

Trial Run of Multi-Factor Authentication CAS
We have prepared a Multi-Factor Authentication CAS Trial webpage to carry out a trial run of the Multi-Factor
Authentication CAS. Following the instructions on the Trial Run of Multi-Factor Authentication CAS webpage.

27 / 33

Question and Answer for Multi-Factor Authentication CAS
Q: May I register Authentication Seed to multiple devices?
A: Yes. For convenience, you can register Authentication Seed to multiple devices (e.g. both smartphone and PC)
if you can guarantee security.
Q: I obtained a new smartphone. However, I forgot to do the migration procedures for the Authentication
Application on my smartphone.
A: As shown in the Authentication Seed Registration to the Authentication Application webpage, you have tocreate a new Authentication Seed by accessing the Multi-Factor Authentication CAS Authentication Seed
Registration webpage from within the University.
The previous Authentication Seed becomes invalid after registering a new Authentication Seed..
Q: May I use the cloud backup feature on the Authentication Application on my smartphone?
A: If you are using a reliable Authentication Application, you can use the cloud backup feature.
Q: I lost my smartphone, and want to register an Authentication Seed to my new smartphone.
A: As shown in the Authentication Seed Registration to the Authentication Application webpage, you have tocreate a new Authentication Seed by accessing the Multi-Factor Authentication CAS Authentication Seed
Registration webpage from within the

University.

The previous Authentication Seed becomes invalid after registering a new Authentication Seed..
Q: I lost my hardware token, so I want to disable it as soon as possible.
A: Please go to the IT Help Desk with your staff/student ID card and submit a request to disable your hardware
token.
Q: I want to register a new hardware token.
A: Follow the procedures for Registration of Hardware Token, and register the new hardware token. Note thatafter registration is complete, the previous hardware token will be
Q: I want to know more about the Multi-Factor

disabled.

Authentication.

A: We have a webpage dedicated to Tips regarding Multi-Factor Authentication.

28 / 33

Trial Run of Multi-Factor Authentication CAS
We have prepared a Multi-Factor Authentication CAS Trial webpage to carry out a trial run of the Multi-Factor
Authentication

CAS.

Trial Run Procedures

When you access the Multi-Factor Authentication CAS Authentication Trial webpage, the CAS system requires
you to input your Nagoya University ID and password.
If the CAS system has already memorized your Nagoya University ID and password, the CAS system will start at
the second step that asks to input an Authentication Code (6-digit number).

29 / 33

After you enter a valid Nagoya University ID and password, the CAS system will ask you to input an
Authentication Code (6-digit number) as the second factor.

Input the Authentication Code presented on the Authentication Application or hardware token.
The CAS system will also accept the Authentication Codes from the previous or subsequentinterval, so you can proceed with authentication even if the Authentication Code changes during
the authentication process.

If authentication using the Authorization Code is successful, the webpage indicating successful authentication willappear.

This concludes the trial run, so you may close the webpage.
If the authentication was unsuccessful, the webpage indicating an unsuccessful authentication will appear. Input
the Authentication Code presented on the Authentication Application or hardware token again.

See "If you are having trouble with authentication" below if you are having repeatedunsuccessful attempts.

30 / 33

If you are having trouble with authentication

The clock of the device you are running the Authentication Application on is incorrect.
-> Change the clock on your device to the correct time. You have registered the wrong Authentication Seed.
-> Start over from the Authentication Seed registration.

The clock of the hardware token is greatly out of sync.
-> Apply for hardware token use again and let us know about your issue when registering.

31 / 33

Application to Use Hardware Token for Multi- Factor Authentication CAS
If you wish to use a hardware token, you will need to purchase a hardware token using departmental budgets
etc., in addition to registering the hardware token to the Multi-Factor Authentication CAS.

Obtaining a hardware token
The hardware tokens that can be used for the Multi-Factor Authentication CAS are those that are “OATH-TOTP
standard with 30 second update intervals that output 6-digit authentication codes”.
The manufacturer of the hardware token does not matter if these specifications are met.

In order to register a hardware token to the Multi-Factor Authentication CAS, the Authentication Seed that is preencoded into the hardware token is required. Be sure that the “BASE32 Encoded Authentication Seed” thatcomes alongside your hardware token from the hardware token vendor is kept secure and in a safe place.

Hardware tokens that have been used are as follows. If you have any concerns regarding purchases, pleasecontact the Multi-Factor Authentication CAS Project (multiauth@icts.). (: nagoya-u.ac.jp)

Feitian Japan One-Time Password (TOP) Token

Registering the Authentication Seed of your hardware token to Multi-Factor
Authentication CAS
Fill out the Hardware Token Application Form below and submit it to the IT Help Desk on the first floor of theInformation Technology Center. Please also bring your Staff/Student ID card so that we can verify your identity.
Once Authentication Seed registration is complete, we will send an e-mail to your contact e-mail address to
notify you of the Seed registration completion.

Hardware Token Application Form on Forms (application of Authentication Seed)
If you cannot use Forms (e.g. you do not have right to use Office 365), please fill following Word version
Hardware Token Application Form and bring it to the IT Help Desk on the first floor of the Information
Technology Center with your Staff/Student ID card so that we can verify your identity.

Word version Hardware Token Application Form (For person who cannot use Forms)

32 / 33

Multi-factor authentication using hardware tokens
The 6-digit number displayed when you press the button on your hardware token will be the second factor(Authentication Code) in the authentication process. Specific procedures for authentication are indicated on the[Multi-Factor Authentication CAS Trial webpage] (./mfa_cas_authentication_test.html) .

Q&A about hardware token applications

Q: I lost my hardware token, so I want to disable it as soon as possible.
A: Please go to the IT Help Desk with your Staff/Student ID card and submit a request to disable
your hardware token.

Q: I want to register a new hardware token.
A: Follow the instructions indicated on this webpage and register the new hardware token. Note that after
registration is complete, the previous hardware token will be disabled.

Q: I lost my hardware token, but I have to urgent matter.
A: We have few hardware tokens to lend. Please take contact to IT Help Desk.

33 / 33