https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=44006
Bug ID: 44006
Summary: Allow staff to enrol in two-factor authentication
using email instead of an authenticator app
Initiative type: ---
Sponsorship ---
status:
Product: Koha
Version: Main
Hardware: All
OS: All
Status: NEW
Severity: normal
Priority: P5 - low
Component: Authentication
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected]
Target Milestone: ---
Currently the only way to enrol in 2FA is to scan a QR code with an
authenticator app. The email fallback (Bug 44005) only helps users who already
enrolled with an app.
Proposed: offer "Email" as an enrolment choice on the 2FA page
(members/two_factor_auth.pl). This reuses the existing TOTP machinery with no
schema change:
- registration generates a secret as it does now, but the QR code and key are
never shown (the pending secret is kept server side in the session)
- a code derived from that secret is emailed to the user's notice email address
- the user enters the code; on success the secret is stored, auth_method is set
to two-factor and the 2FA_ENABLE notice is queued
- at login, the existing "Send the code by email" link delivers the code
Email enrolment is offered only when TwoFactorAuthenticationEmailFallback is
enabled and the patron has a notice email address, since these users can only
log in via the fallback. The preference text should warn that turning it off
will lock out users who enrolled by email (misc/admin/reset_2fa.pl is the
recovery path).
Test plan:
1. Enable TwoFactorAuthentication and TwoFactorAuthenticationEmailFallback.
2. As a staff user with an email address, open the 2FA page and choose Email.
3. Confirm no QR code is shown, and a code arrives by email.
4. Enter the code: 2FA is enabled and the 2FA_ENABLE notice is queued.
5. Log out and in: at the second step use "Send the code by email" and log in
with the code.
6. Disable the fallback preference: the Email choice is no longer offered.
7. A user without an email address is not offered the Email choice.
--
You are receiving this mail because:
You are the assignee for the bug.
You are watching all bug changes.
_______________________________________________
Koha-bugs mailing list -- [email protected]
To unsubscribe send an email to [email protected]
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
