Looker provides two-factor authentication (2FA) as an additional layer of security to protect data that is accessible through Looker. With 2FA enabled, every user who logs in must authenticate with a one-time code generated by their mobile device. There is no option to enable 2FA for a subset of users.
The Two-Factor Authentication page in the Authentication section of the Admin menu lets you enable and configure 2FA.
Starting in Looker 26.22, 2FA is enabled by default for all new and existing Looker (original) instances that use email and password authentication and that did not opt out during the advance opt-out window. Administrators retain full control to manage or disable 2FA under Admin > Authentication > Two-Factor.
Using two-factor authentication
Following is the high-level workflow for setting up and using 2FA. The time synchronization requirements, which are required for correct operation of 2FA, are described later in this document.
Administrator enables 2FA in Looker's admin settings (or 2FA is enabled by default starting in Looker 26.22).
Individual users install Google Authenticator (iPhone app or Android app) on their mobile devices or any compatible third-party TOTP authenticator app.
At first login, a user will be presented with a picture of a QR code and a manual text code on their computer screen. The user can either scan the QR code with their authenticator app or enter the manual text code in their app.
After completing this step, the user will be able to generate authentication keys for Looker.
On subsequent logins to Looker, the user will need to enter an authentication key after submitting their username and password.
If a user enables the This is a trusted computer option, the key authenticates the login browser for a 30-day window. During this window, the user can log in with username and password alone. Every 30 days, Looker requires each user to re-authenticate the browser with their authenticator app.
Time synchronization requirements
An Authenticator app produces time-based tokens, which require time synchronization between the Looker server and each mobile device in order for the tokens to work. If the Looker server and a mobile device are not synchronized, this can cause the mobile device user to be unable to authenticate with 2FA. To synchronize time sources, do at least one of the following:
Set mobile devices for automatic time synchronization with the network.
For customer-hosted Looker deployments, ensure that NTP is running and configured on the server. If the server is provisioned on AWS, you might need to explicitly allow NTP in the AWS Network ACL.
A Looker admin can set the maximum allowed time-drift in the Looker Admin panel, which defines how much of a difference is permitted between the server and mobile devices. If a mobile device's time setting is off by more than the allowed drift, authentication keys won't work. The default is 90 seconds.
Resetting two-factor authentication
If a user needs to have their 2FA reset (for example, if they have a new mobile device):
In the Users page in the Admin section of Looker, click Edit on the right-hand side of the user's row to edit the user's account information.
In the Two-Factor Secret section, click Reset to cause Looker to prompt the user to rescan a QR code or to enter the manual text code with an authenticator app the next time they attempt to log in to the Looker instance.
Considerations
While configuring two-factor authentication, keep the following considerations in mind:
Two-factor authentication applies only to Looker (original). It doesn't apply to Looker (Google Cloud core), which relies on Google Cloud IAM or external identity providers for multi-factor authentication.
Two-factor authentication doesn't affect Looker API use.
Two-factor authentication doesn't affect authentication through external systems such as LDAP, SAML, Google OAuth, or OpenID Connect. 2FA does affect any alternate login credentials that are used with these systems.