2-Factor authentication

[TheSlimvReal]

2-Faktor authentication (2FA) should be available in the application

• Organizations can decide whether they want to use 2FA
• 2FA with email and/or app works
• Configurable time period after which the second factor is required

overview of login user stories / test cases (GoogleDoc)

[TheSlimvReal]

Possible approach:

1. Instance is marked with OTP required (potentially through config.json).
2. When creating a user, CONFIGURE_OTP is put into the requiredActions of the user.
3. When a user clicks on the registration mail, OTP setup will also be part of the registration process in Keycloak.
4. Aam Digital is extended with a login step for entering the OTP, potentially in same form as username and password.
5. By sending username, password and OTP to keycloak, a token can be requested (example).
6. If everything is correct the user is logged in.

Open questions/issues:

• How is the offline login affected? OTP check does not work offline.
• It is not possible to find out whether the username and password OR the OTP were incorrect. All three things have to be valid in order to get a successful response.

[sleidig]

We have discussed the technical approach for 2FA again and came to the conclusion to re-work the login logic in the client/app in order to use Keycloak "natively", i.e. forward users to the Keycloak login page and on the app only use the token issued. This requires re-thinking how we handle offline authentication, however.

[sleidig]

Updated summary of all login scenarios / test cases: https://docs.google.com/document/d/1VBx_Zsk0d7KdfcXyUhf77a-nWHArHvsKmST3Ss0jr_k/edit

redesigning the overall login process will also probably resolve #935

[aam-digital-ci]

🎉 This issue has been resolved in version 3.27.0-master.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

[aam-digital-ci]

🎉 This issue has been resolved in version 3.27.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀