https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=44005
--- Comment #2 from David Nind <[email protected]> --- Created attachment 210806 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=210806&action=edit Bug 44005: Add a system preference to enable or disable the email fallback for 2FA When two-factor authentication is enabled, the second-step login screen always offers a "Send the code by email" link. Email delivery makes the second factor only as strong as the user's mailbox, so some libraries will want to require the authenticator app only. This adds the TwoFactorAuthenticationEmailFallback system preference (YesNo, default Yes to preserve existing behaviour). When off, the link is not shown and POST /api/v1/auth/otp/token_delivery returns 403 (email_fallback_disabled), so the restriction does not rely on the template alone. To test: 1. Apply the patch, run updatedatabase.pl and restart_all. 2. Enable TwoFactorAuthentication and enrol a staff user with an authenticator app. 3. With TwoFactorAuthenticationEmailFallback set to Allow, log out and in: the "Send the code by email" link is shown and works. 4. Set it to "Don't allow", log out and in: the link is not shown. 5. At the second step, POST to /api/v1/auth/otp/token_delivery: it is refused with 403 and no email is queued. 6. prove t/db_dependent/api/v1/two_factor_auth.t Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Signed-off-by: David Nind <[email protected]> -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
