MFA update (#2612)

* WIP MFA update

* fix links

* update web interfaces instructions

* typo

---------

Co-authored-by: Juha Nyholm <[email protected]>

Author: rkronberg

csc-overrides/assets/snippets/mfa-update.md

@@ -2,6 +2,5 @@
     Since 22 April 2025, the web interfaces of Puhti and Mahti require
     multi-factor authentication (MFA).
 
-    1. [Test whether **Haka MFA** is already enabled for you](/accounts/mfa.md#mfa-instructions-for-users-logging-in-with-haka-credentials).
-          * If your home organization has enabled MFA for Haka login, you do not need to activate MFA separately for CSC services. It is highly preferred that you use the Haka MFA of your home organization if possible.
-    2. [If Haka MFA is not enabled or if your home organization does not offer Haka, activate **CSC MFA** following these instructions](/accounts/mfa.md#how-to-activate-mfa).
+    1. If your home organization has enabled MFA for Haka login, you do not need to activate MFA separately for CSC services. It is highly preferred that you use the Haka MFA of your home organization if possible.
+    2. If Haka MFA is not enabled or if your home organization does not offer Haka, [activate **CSC MFA** following these instructions](/accounts/mfa.md#how-to-activate-csc-mfa).

docs/accounts/how-to-create-new-user-account.md

@@ -5,8 +5,7 @@ search:
 
 # How to create new CSC user account
 
-There are two different types of CSC user accounts: ordinary accounts for general use (which you can get with or
-without Haka or Virtu) and machine-to-machine robot accounts for managing services.
+There are two different types of CSC user accounts: ordinary accounts for general use (which you can get with or without Haka or Virtu) and machine-to-machine robot accounts for managing services.
 
 !!! Note
 
@@ -20,17 +19,16 @@ without Haka or Virtu) and machine-to-machine robot accounts for managing servic
     If you are trying to access the [LUMI web interface](https://www.lumi.csc.fi) or [LUMI-O](https://www.auth.lumidata.eu),
     please see the [LUMI documentation](https://docs.lumi-supercomputer.eu/firststeps/accessLUMI/) on how to get an account.
 
-If your home organization is a member of the Haka or Virtu federation, you
-can create an account yourself.
+If your home organization is a member of the Haka or Virtu federation, you can create an account yourself. For registration, you will need a mobile device that has an authentication app for setting up the multi-factor authentication
 
 1. Go to [MyCSC](http://my.csc.fi).
-1. Click _Log in_ or _Getting started_.
-1. Click _Virtu_ or _Haka_ depending on which federation your home
-organization is a member of.
+1. Click _Create account_
+1. Click _Virtu_ or _Haka_ depending on which federation your home organization is a member of.
 1. Select your home organization and log in to their identity service.
 1. Fill in your information on the _Sign up_ page.
 1. You will receive an email message containing a link to MyCSC where you can set your CSC account password.
-1. You will receive your CSC user account information via email.
+1. If you are signing up with _Virtu_ you will be prompted to [set up your CSC MFA](../accounts/mfa.md#step-2-scan-qr-code) after setting your CSC accounts password. If you are signing up with _Haka_, you might already have a working MFA login integrated with your Haka login, and you will be asked to sign in with the Haka MFA. If your home organisation doesn't provide Haka MFA, you will be guided to set up CSC MFA.
+1. You will receive a confirmation via email after successfully registering your CSC user account.
 
 ## Getting an account without Haka or Virtu
 

docs/accounts/images/small/mfa-enter-verification-code.png

@@ -12,35 +12,23 @@ CSC’s MFA uses a time-based one-time passcode (TOTP) system, which works with
 
 If your home organization has enabled multi-factor authentication for Haka login, you do not need to activate it separately for CSC services. **It is recommended to use your home organization’s Haka authentication if available.**
 
-Otherwise, you must activate MFA once to access CSC research services.
+Otherwise, you must [enable CSC provided multi-factor authentication (CSC MFA)](#how-to-activate-csc-mfa) to access CSC services for research.
 
 CSC is gradually rolling out MFA across all of our services. Currently, the following CSC services utilize multi-factor authentication:
 
 * **SD Connect**  
 * **SD Desktop**  
 * **Puhti web interface**
 * **Mahti web interface**
-* Coming soon:
-    * **MyCSC**
+* **MyCSC**
 
 ## MFA Instructions for users logging in with Haka credentials
 
-Your home organization may already offer multi-factor authentication during the Haka login process (Haka MFA). We recommend using your home organization's multi-factor authentication, if available. Note that when logging in with CSC user name and password in the web interface, the MyCSC MFA will always be used. Both home organization MFA and the MyCSC MFA can be set up at the same time.
-
-Please first check if you already have functioning Haka MFA. To check:
-
-1. Visit the 'Profile' section of the [MyCSC portal](https://my.csc.fi/)
-2. Use the 'Test your Multi-Factor Authentication capabilities' function on the right-hand side by pressing 'Test'. **Remember to log in with Haka during the test**.
-
-### Possible outcomes
-
-* Haka MFA is working. In that case no further action is required from you.
-* Haka MFA is **not** working, and you receive an error message indicating that you need to activate Haka MFA following your home organization's instructions. CSC doesn't handle issues related to Haka MFA, for this matter, please contact your **home organization**.
-* Haka MFA is not working, and you receive a message stating that Haka MFA is not enabled in your organization. In that case you should activate CSC multi-factor authentication (CSC MFA). [See instructions below](#how-to-activate-mfa).
+Your home organization may already offer multi-factor authentication during the Haka login process (Haka MFA). We recommend using your home organization's multi-factor authentication, if available. Note that when logging in with CSC user name and password in the web interface, CSC MFA will always be used. Both home organization MFA and CSC MFA can be set up at the same time.
 
 ## Users logging in with Virtu credentials, CSC login or Lifescience login
 
-Activate CSC's multi-factor authentication (CSC MFA) in MyCSC. [See instructions below](#how-to-activate-mfa).
+Activate CSC MFA in MyCSC. [See instructions below](#how-to-activate-csc-mfa).
 
 ## What you need before setting up CSC MFA
 
@@ -49,11 +37,11 @@ Before enabling MFA, make sure you have:
 * A CSC user account and password. If you don’t have an account yet, register through the MyCSC customer portal. [Read the instructions here](how-to-create-new-user-account.md).
 * A mobile device that is compatible with an authentication app (essentially any modern smartphone).
 
-## How to activate MFA
+## How to activate CSC MFA
 
-### Step 1: Install authentication app
+### Prerequisite: Install authentication app
 
-To use MFA, install **an authentication app** on your mobile phone. **If you already have an authentication app on your phone, [skip to step 2](#step-2-log-in-to-mycsc).**
+To use CSC MFA, install **an authentication app** on your mobile phone. **If you already have an authentication app on your phone, [skip to step 1](#step-1-log-in-to-the-csc-mfa-activation-page-in-mycsc).**
 
 Some commonly used apps include:
 
@@ -63,35 +51,27 @@ Some commonly used apps include:
 
 Follow the installation instructions provided by your chosen app.
 
-### Step 2: Log in to MyCSC
-
-Log in to the [**MyCSC**](https://my.csc.fi/) website with your username and password, and click the **Profile** icon in the top right corner of the page. A dropdown menu will open, allowing you to select **Profile** (highlighted in the image below).
+### Step 1: Log in to the CSC MFA activation page in MyCSC
 
-![Profile view in MyCSC](images/small/mfa-profile-banner.png 'Profile view banner')
+Open the [**CSC MFA activation page**](https://my.csc.fi/mfa-activation-login) in your web browser and log in using your preferred login method (Haka, Virtu or CSC login).
 
-If you have forgotten your CSC user account password, [**here's how you can change it**](../accounts/how-to-change-password.md).
+If you are using CSC login and have forgotten your CSC user account password, [**here's how you can change it**](../accounts/how-to-change-password.md).
 
-### Step 3: Start the activation of multi-factor authentication
-
-In the **Profile** section, click **Enable** in the Multi-Factor Authentication banner.
-
-![enable MFA banner](images/small/mfa-enable-mfa-banner.png 'Multi-factor authentication banner')
-
-### Step 4: Scan QR code
+### Step 2: Scan QR code
 
 Scan the QR code displayed on the screen using your authentication app.
 
-![read QR code](images/small/mfa-scan-qr-code.png 'Read the QR.code')
+![scan QR code](images/small/mfa-scan-qr-code.png 'Scan the QR code')
 
-### Step 5: Enter verification code
+### Step 3: Enter verification code
 
-After scanning the QR code, press **Continue**.  Complete the task that your authentication app requires. Once the task is completed, **your MFA setup is complete.**
-
-![type in 6-digit code](images/small/mfa-enter-verification-code.png 'Type in 6-digit code')
+Complete the task that your authentication app requires. Once the task is completed, **fill in the verification code from your authentication app** in the input field on the CSC MFA activation page and click the **Enable Multi-Factor Auhtentication** button.
 
 ![authentication app screen](images/small/haka-one-time-code.jpeg 'The 6-digit code on your phone')
 
-### Step 6: Finish
+![fill in 6-digit code](images/small/mfa-enter-verification-code.png 'Fill in 6-digit code')
+
+### Step 4: Finish
 
 Your CSC account is now secured with multi-factor authentication!
 

docs/accounts/images/small/mfa-scan-qr-code.png

@@ -2,12 +2,8 @@
 
 --8<-- "mfa-update.md"
 
-1. Ensure that you have a CSC account and have enabled multi-factor
-   authentication (MFA):
-    1. Haka users:
-       [Check if Haka MFA is already enabled by your organization](../../accounts/mfa.md#mfa-instructions-for-users-logging-in-with-haka-credentials).
-    2. If Haka MFA is not enabled, or you do not have Haka credentials:
-       [Activate CSC MFA](../../accounts/mfa.md#how-to-activate-mfa).
+1. Ensure that you have a CSC account:
+    * [Instructions for creating a new CSC user account](../../accounts/how-to-create-new-user-account.md).
 2. Using a web browser, go to [www.puhti.csc.fi](https://www.puhti.csc.fi) or
    [www.mahti.csc.fi](https://www.mahti.csc.fi).
 3. On the landing page, click on "Log in" and select an appropriate

docs/accounts/mfa.md

@@ -15,4 +15,4 @@ To solve the problem:
 2. If the previous step does not work, please delete the CSC MFA secret from
    your phone and start from the very beginning, including scanning the QR
    code (i.e. reset MFA completely).
-    1. [See instructions](../../accounts/mfa.md#how-to-activate-mfa).
+    1. [See instructions](../../accounts/mfa.md#how-to-activate-csc-mfa).

docs/computing/webinterface/connecting.md

@@ -48,7 +48,7 @@ required to
 organization. [Please use the test page in MyCSC](https://my.csc.fi/test-mfa)
 (select **Haka MFA**). It is highly preferred to use the Haka MFA of your home organization, if possible.
 If Haka MFA is not enabled or if your home organization does not offer Haka,
-[please activate **CSC MFA** following these instructions](../../accounts/mfa.md#how-to-activate-mfa).
+[please activate **CSC MFA** following these instructions](../../accounts/mfa.md#how-to-activate-csc-mfa).
 
 **Motivation:** With this change we are improving the security of our
 computing, data, and cloud services.