Test

PINs can be enabled in PARS for two factor authentication; the user must login using their SIMS or Active Directory details, then also enter a PIN. The PIN can either be a four digit number received by email and SMS, or a six digit TOTP generated by an authenticator app.

PINs can be disabled for login attempts from given IP address ranges. This allows you to use single factor authentication for logins within the school network and two factor authentication for all other logins.

Note that some configuration must be performed in PARS before it is able to send emails or SMS messages. See the Contacting Parents page for further information about the configuration required.

Enable PINs

The PIN settings for PARS are stored in the web.config file for the PARS site, on the PARS IIS server. The web.config file is found in the PARS installaion folder which is usually located:
C:\inetpub\wwwroot\PARS\web.config

The web.config file is in xml format and can be edited using Notepad or a similar text editor. To enable PINs in PARS, find the setting called "PINS" and change the value to "On" e.g.

<setting name="PINS" serializeAs="String">
      <value>On</value>
</setting>

Disable PINs internally

If you would like to disable PINs for a certain range of IP addresses, find the setting called "PIN_Exclude_IPs". Enter each IP address or range of IP addresses into the value, separated by semi colons.

You can specify a range of IP addresses using a subnet mask. The subnet mask must not be in 'classless' format e.g. 192.169.1.0/24 is not acceptable; you should use 192.169.1.0/255.255.255.0 instead.

The value field in the web.config file must not include line breaks.

Correct

<setting name="PIN_Exclude_IPs" serializeAs="String">
      <value>192.168.0.0/255.255.0.0</value>      
</setting>

Incorrect

<setting name="PIN_Exclude_IPs" serializeAs="String">
      <value>192.168.0.0/16</value>      
</setting>

Incorrect

<setting name="PIN_Exclude_IPs" serializeAs="String">
      <value>192.168.0.0/255.255.0.0
      </value>      
</setting>

You may enter multiple IP address ranges or single IP addresses by separating with a semi colon e.g.

<setting name="PIN_Exclude_IPs" serializeAs="String">
      <value>192.168.0.0/255.255.0.0;172.16.0.0/255.240.0.0</value>      
</setting>

PINs by TOTP

The default method for delivering PINs to users is to send an email and a password containing their temporary PIN. PARS will use the user's mobile telephone number and work email address from SIMS.

The alternative is for users to download an authentication app. Users can request a key from the PARS login page which will be sent to them via email and SIMS. Once they have entered this key into their authentication app, they will be able to generate PINs using the authentication app without the need to receive emails and SMS messages.

To enable PINs in PARS, find the setting called "PINS" and change the value to "On" e.g.

<setting name="PINSBYTOTP" serializeAs="String">
      <value>On</value>
</setting>

Once TOTP PINs have been enabled, users will be able to collect a key for use in their authenticator app. To receive a key the user first needs to attempt to log in to PARS. They will then be prompted to enter a PIN and will also see a cog button. Clicking the cog button will sent a key to the user via email and SMS.

Troubleshooting

If you are experiencing trouble in disabling PINs for internal IP address ranges then enter "*log*" as the first item in the list of excluded IP address ranges e.g.

<setting name="PIN_Exclude_IPs" serializeAs="String">
      <value>*log*;192.168.0.0/255.255.0.0</value>      
</setting>

PARS will then log information in the Application Log of the IIS server on which PARS is installed. These logs will show which IP address was used during a login attempt and whether it matches any of the ranges that have been excluded.