https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=44006
--- Comment #1 from Martin Renvoize (ashimema) <[email protected]> --- Created attachment 210565 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=210565&action=edit Bug 44006: Allow staff to enrol in two-factor authentication using email Until now the only way to enrol in 2FA was to scan a QR code with an authenticator app. This adds an "Use email instead of an app" option to the enrolment screen, both on the patron 2FA page and on the forced setup screen shown at login when 2FA is enforced. No schema change: this reuses the existing TOTP machinery. - POST /api/v1/auth/two-factor/registration/email generates a secret, keeps it server side in the session (it is never sent to the browser) and emails a code derived from it to the patron. - POST /api/v1/auth/two-factor/registration/email/verification checks the code, then stores the secret, enables 2FA and queues the 2FA_ENABLE notice, as the app flow does. - At login the existing "Send the code by email" link delivers the code. The option is only offered when TwoFactorAuthenticationEmailFallback is enabled and the patron has a notice email address. Users enrolled by email can only log in via that fallback, so the preference description now warns that turning it off locks them out until 2FA is reset. To test: 1. Apply the patch, restart_all, and apply the Bug 44005 patch first. 2. Set TwoFactorAuthentication to Enable and TwoFactorAuthenticationEmailFallback to Allow. 3. As a staff user with an email address, go to the 2FA page, click Enable two-factor authentication, then "Use email instead of an app". 4. Confirm the QR code and key are hidden and a code is emailed. 5. Enter the code: 2FA is enabled and the 2FA_ENABLE notice is queued. 6. Log out and in: use "Send the code by email" and log in with it. 7. Set TwoFactorAuthenticationEmailFallback to Don't allow: the email option is no longer offered, and the endpoints return 403. 8. A staff user without an email address is not offered the option. 9. Set TwoFactorAuthentication to Enforce and log in as a user without 2FA: the setup screen offers the same email option. 10. prove t/db_dependent/api/v1/two_factor_auth.t Co-Authored-By: Claude Sonnet 5.5 <[email protected]> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
