1 files changed, 32 insertions, 43 deletions

diff --git a/doc/book-enea-edge-getting-started/doc/security.xml b/doc/book-enea-edge-getting-started/doc/security.xml
index 0812a2f..c98014a 100644
--- a/doc/book-enea-edge-getting-started/doc/security.xml
+++ b/doc/book-enea-edge-getting-started/doc/security.xml
@@ -16,9 +16,9 @@
 
     <note>
       <para>Configuring MFA will only be possible using the Web interface, and
-      not the REST API. Users with MFA enabled will not be able to log
-      in through the REST API. If attempted, a <literal>401</literal> HTTP
-      code will be returned, with the <literal>EMS-Error</literal> header
+      not the REST API. Users with MFA enabled will not be able to log in
+      through the REST API. If attempted, a <literal>401</literal> HTTP code
+      will be returned, with the <literal>EMS-Error</literal> header
       containing the <literal>EMS_UserMFAEnabled</literal> error.</para>
     </note>
 
@@ -26,23 +26,19 @@
       <title>Configuring User MFA</title>
 
       <para>The administrator must enable MFA authentication for the desired
-      new user by:</para>
+      new user:</para>
 
       <orderedlist>
         <listitem>
-          <para>Accessing the <emphasis role="bold">Security</emphasis>
-          tab.</para>
-        </listitem>
-
-        <listitem>
-          <para>Accessing the <emphasis role="bold">Configuration</emphasis>
+          <para>Access the <emphasis role="bold">Security</emphasis> tab and
+          choose the <emphasis role="bold">Configuration</emphasis>
           menu.</para>
         </listitem>
 
         <listitem>
-          <para>Selecting the <emphasis role="bold">Add</emphasis> option,
-          entering the details for the new user and then enabling the
-          <emphasis role="bold">Enable MFA Login</emphasis> checkbox.</para>
+          <para>Select the <emphasis role="bold">Add</emphasis> option, enter
+          the details for the new user and enable the <emphasis
+          role="bold">Enable MFA Login</emphasis> checkbox.</para>
         </listitem>
       </orderedlist>
 
@@ -53,30 +49,27 @@
       be asked to configure a new shared secret. For more details on how to
       configure a new shared secret, please see the following section.</para>
 
-      <note>
-        <para>All MFA information for enabled users will be preserved upon
-        upgrading the Enea Edge Management application.</para>
-      </note>
+      <para>All MFA information for enabled users will be preserved upon
+      upgrading or restoring the Enea Edge Management application.</para>
     </section>
 
     <section id="security_authentication">
       <title>Security Authentication</title>
 
-      <para>Before the user logs in, there is no secret set in the Enea Edge
-      Management database. Initially, the user will enter his credentials as
-      in a normal, local authentication. He will then be redirected to a
-      second page that presents the secret as a QR code, that he must scan
-      using the Google Authenticator application. The secret is also presented
-      in clear text ready for copying and manual entry, in case scanning the
-      QR code does not work.</para>
+      <para>The user will enter his credentials (username and password) as in
+      a typical local authentication. He will then be redirected to a second
+      page that presents the secret as a QR code, that he must scan using the
+      Google Authenticator application. The secret is also presented in clear
+      text ready for copying and manual entry, in case scanning the QR code
+      does not work.</para>
 
       <figure>
         <title>Initial setup for Multi-Factor login</title>
 
         <mediaobject>
           <imageobject>
-            <imagedata align="center" scale="60"
-                       fileref="images/mfa_first_time_setup.png" />
+            <imagedata align="center"
+                       fileref="images/mfa_first_time_setup.png" scale="60" />
           </imageobject>
         </mediaobject>
       </figure>
@@ -89,34 +82,30 @@
       correct, authentication is successful. The six digit token is available
       for a maximum of 30 seconds.</para>
 
-      <para>Once the initial login succeeds and the secret is saved in the
-      database, subsequent logins will still be done using a two-step method.
-      The user will provide first his classic credentials, and then, on the
-      second page he will enter the token as generated by Google
-      Authenticator, this time, however, the secret will no longer be
-      displayed.</para>
+      <para>Subsequent logins will still be done using a two-step method. The
+      user will provide first his credentials, and on the second page the
+      token as generated by Google Authenticator.</para>
 
       <figure>
         <title>Second login</title>
 
         <mediaobject>
           <imageobject>
-            <imagedata align="center" scale="80"
-                       fileref="images/mfa_login.png" />
+            <imagedata align="center" fileref="images/mfa_login.png"
+                       scale="80" />
           </imageobject>
         </mediaobject>
       </figure>
 
       <note>
-        <para>If the shared secret is ever lost, it can always be regenerated,
-        but only upon request to the administrator. It is done by accessing
-        the <emphasis role="bold">Security</emphasis> tab, selecting the
-        <emphasis role="bold">Configuration</emphasis> menu and choosing the
-        user, and on the right-hand side panel unchecking the <emphasis
-        role="bold">Enable MFA Login</emphasis> checkbox. Then pressing the
-        <emphasis role="bold">Apply</emphasis> button, checking it again, and
-        clicking <emphasis role="bold">Apply</emphasis> one final time. When
-        the MFA Login is disabled, the secret is also erased from the
+        <para>If the shared secret is lost, it can be regenerated by the
+        administrator by disabling and re-enabling the MFA Login for the selected
+        user. For more information, please see <olink targetdoc="book_enea_edge_getting_started"
+    targetptr="config_mfa">Configuring User MFA in the <ns:include
+    href="../../s_docbuild/olinkdb/pardoc-names.xml"
+    xmlns:ns="http://www.w3.org/2001/XInclude"
+    xpointer="element(book_enea_edge_getting_started/1)" /></olink> Manual. When the
+        MFA Login is disabled, the secret is also erased from the
         database.</para>
       </note>
     </section>