https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=44005
Bug ID: 44005
Summary: Add a system preference to enable or disable the email
fallback for two-factor authentication
Initiative type: ---
Sponsorship ---
status:
Product: Koha
Version: Main
Hardware: All
OS: All
Status: NEW
Severity: normal
Priority: P5 - low
Component: Authentication
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected]
Target Milestone: ---
When two-factor authentication (2FA) is enabled for the staff interface, the
second-step login screen always offers a "Send the code by email" link, which
emails a TOTP code derived from the user's authenticator secret (POST
/api/v1/auth/otp/token_delivery).
There is currently no way for a library to turn this off. Email delivery makes
the second factor only as strong as the user's mailbox, so some libraries will
want to require the authenticator app only.
Proposed: a new system preference, TwoFactorAuthenticationEmailFallback (YesNo,
default Yes so existing behaviour is preserved on upgrade), next to
TwoFactorAuthentication in Staff interface > Authentication.
When off:
- the "Send the code by email" link is not shown on the second-step login
screen
- the REST route /api/v1/auth/otp/token_delivery refuses the request (the check
must be server side, not only in the template)
Test plan:
1. Enable TwoFactorAuthentication and enrol a staff user with an authenticator
app.
2. With TwoFactorAuthenticationEmailFallback set to Yes, log out and in: the
"Send the code by email" link is shown and works.
3. Set it to No, log out and in: the link is not shown.
4. While at the second step, POST to /api/v1/auth/otp/token_delivery: it is
refused and no email is queued.
--
You are receiving this mail because:
You are the assignee for the bug.
You are watching all bug changes.
_______________________________________________
Koha-bugs mailing list -- [email protected]
To unsubscribe send an email to [email protected]
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
