Security Levels
Which security levels are available?
Passkey is part of a three-level security concept in OpenOlat:
Level 1 - Password: login with password only
Level 2 - Passkey: login with passkey only
Level 3 - Password & Passkey (2FA): login with password and passkey (2-factor authentication)
In addition, the administration can activate the One Time Code. Users without a stored passkey then confirm their login with a confirmation code sent by e-mail.
Security levels set by administrators
For some roles a higher security level makes sense, e.g. for user managers or administrators. In OpenOlat, a minimum required security level can therefore be set separately for each role. Administrators set the level per role in the system administration under:
Administration > Login > Password and authentication > Tab "Authentication"
With the button "Set all roles at level…" one level is applied to all roles at once.
Change of a security level
With the option "Increase security level independently", administrators can allow users to set their security level themselves.
The change is made with the button "Change security level" under:
Personal Menu > Password
If a passkey is required for upgrading, users can generate the passkey themselves, also under Personal Menu > Password.
If users are allowed to change their security level themselves, upgrading and downgrading are possible in principle. Whether a downgrade is possible, however, depends on the default set by the administrators.
The minimum level is set by administrators. If, for example, level 2 is specified for the role of user manager, a user manager cannot downgrade to level 1 (password only), but can only choose between level 2 (passkey only) and level 3 (2-factor authentication).