two-factor authentication

[ghost]

I don't know if this is hard, or even possible, but it would be a nice feature to implement two-factor authentication.
I've been using google-authenticator app (https://code.google.com/p/google-authenticator/) for allmost anything now, and I find it easy and quick.
From what i've read, PAM authentication is more like a module run on server level, so no idea if this could be pulled of from PHP.

[razyr]

If Two-factor authentication is going to be added as a future feature, consider using a hard token such as Yubikey as an option.

[DeepDiver1975]

@LukasReschke THX

[Grimeton]

I'm also looking into this to implement the DuoSecurity stuff.

What I'm actually not really aware of is if there is some kind of interface that one could use to implement it. It would have to take place AFTER the main logon and BEFORE the user is marked as authenticated.

AFAIK this isn't possible because the authentication is handled by Owncloud on its own or by some kind of plugin, like the user_ldap app. And when it's handled the user is always marked as logged in. So to not reinvent the wheel or make it necessary to implement a two factor auth inside each and every available auth plugin again and again it would be necessary to create some kind of interface inside Owncloud to make it possible.

I guess the easiest way would be to have some kind of array that is worked by Owncloud and if one of the auth options in the array returns false, logon is denied. Similar to how PAM works.

Does something like this exist already?

Another problem that comes up would be the OwnCloud sync client. Each and every time the client syncs, one would have to authorize that in 2 factor. So we need a workaround for this. One could be to filter based on the http headers and figure out if it's the sync client and then bypass 2 factor. But that would make it pretty easy for crackers todo the same.

So something like a hash/token/whatever would be needed that the client uses to authenticate and sync. Maybe it would be necessary to register the client/machine to OwnCloud and create some kind of management UI that allows to manage the connected clients by user and by admin.

KR,

G.

[LukasReschke]

Closed in favour of #12102