Merge pull request #46 from DefGuard/mobile-client

mobile client documentation

Author: jakub-tldr

.gitbook/assets/defguard-mobile-connect-mfa.png

@@ -15,11 +15,10 @@ Join closed beta for [iOS](https://defguard.net/download) or [Android](https://d
 ### Connecting made effortless 
 1. Download app from [App Store](https://defguard.net/download) or [Google Play](https://defguard.net/download)
 2. Open app
-3. To add instance [scan QR](#add-instance-by-qr-code) or [use manual configuartion](#add-instance-manually)
+3. To add instance [scan QR](#add-instance-by-qr-code) or [use manual configuration](#add-instance-manually)
 4. [Connect](#connecting-to-location-without-mfa) with single click
 
 
-
 ### Quick guide
 - [How to add an instance?](#adding-new-instance)
 - [How to connect to location without MFA?](#connecting-to-location-without-mfa)
@@ -57,28 +56,74 @@ Your phone will need to add new VPN configuration, when you see the request, ple
 
 ### Connecting to location (without MFA)
 
-1. Choose desired instance from list
-2. Select location by clicking "Connect" next to it
+1. Choose the desired instance from list
+2. Select the location by clicking "Connect" next to it
 3. Choose if you want to route your traffic with:
-   * Predefined traffic (Faster for general browsing)
-   * All traffic (Full encryption and privacy)
+   * Predefined traffic
+   * All traffic
 4. Press "Connect"
 
 ### Connecting to location (with MFA)
 
+{% hint style="warning" %}
+Please check [this](#authenticating-with-openid) section for information about how the OpenID authentication method works. 
+{% endhint %}
+
 1. Choose desired instance from list
 2. Select location by clicking "Connect" next to it
 3. Choose if you want to route your traffic with:
-   * Predefined traffic (Faster for general browsing)
-   * All traffic (Full encryption and privacy)
+   * Predefined traffic
+   * All traffic
 4. Choose MFA method which is configured in your account
    * Email
-   * Authenticator App
-5. Authenticate and connect.
+   * [Authenticator App](#authenticating-with-authenticator-app-totp)
+5. Authenticate and connect
+
+
+{% hint style="info" %}
+The first time you connect, app will ask whether you want to route **predefined traffic** or **all traffic**. 
+
+- **Predefined traffic** is optimized for general browsing and will route only specific traffic through VPN.
+- **All traffic** provides full encryption and privacy for all your device traffic.
+
+You can select **"Remember my choice"** if you don't want to be asked again. 
+
+
+If you want to change this setting later:
+1. Go to **Instances** in the app menu.
+2. Press **Connect** button next to location name and wait until popup shows.
+3. Click **Select Traffic Routing**, choose option and confirm with **Save** button.
+
+{% endhint %}
+
+<figure><img src="../.gitbook/assets/defguard-mobile-connect-traffic.png"width="50%"><figcaption></figcaption></figure>
+
+{% hint style="info" %}
+When connecting with MFA for the first time, you will have the option to select **"Remember my choice"**. Select this option if you want to always use this method for this location.
+
+To change your preferred MFA method later:
+1. Go to **Instances** in the app menu.
+2. Press **Connect** button next to location name and wait until popup shows.
+3. Click **Select MFA Method**, choose option and confirm with **Save** button.
 
-{% hint style="warning" %}
-If your instance has configured external OpenID authentication, it will be used as primary method for MFA
 {% endhint %}
+<figure><img src="../.gitbook/assets/defguard-mobile-connect-mfa.png"width="50%"><figcaption></figcaption></figure>
+
+### Authenticating with OpenID
+Upon connecting location with **external** MFA requirement we should see this information
+<figure><img src="../.gitbook/assets/defguard-mobile-openid-banner.png"width="50%"><figcaption></figcaption></figure>
+
+After clicking "Authenticate with OpenID", we should be redirected to login page. After successfully logging in, you should see something like this:
+<figure><img src="../.gitbook/assets/defguard-mobile-openid-success.png"width="50%"><figcaption></figcaption></figure>
+After this step please go back to the Defguard app and check your connection.
+
+### Authenticating with Authenticator App (TOTP)
+
+When connecting to a location that requires **internal** MFA, you should see this screen.
+<figure><img src="../.gitbook/assets/defguard-mobile-totp-screen.png"width="50%"><figcaption></figcaption></figure>
+
+Enter code from **your Authenticator App** and click "Verify". After this step your VPN connection will be established.
+
 
 ### How can I obtain QR Code, URL and token?