Add optional TOTP-based two-factor authentication #5

New issue

Open

opened 2026-07-01 01:00:51 +00:00 by manlycucumber · 0 comments

manlycucumber commented

2026-07-01 01:00:51 +00:00

(Migrated from github.com)

Problem

Operators handling tenant keys and rebuilds should be able to harden their accounts with a second factor. 2FA must be optional and self-service.

Acceptance criteria

An operator can enroll a TOTP authenticator via QR code and confirm with a valid code before 2FA is activated
When 2FA is enabled, login requires a valid TOTP code after the password step
Recovery codes are generated once at enrollment and each can be used at most once
2FA can be disabled by the operator after re-authenticating

Notes

Use a public-domain / freely-licensed TOTP implementation; record provenance.

## Problem Operators handling tenant keys and rebuilds should be able to harden their accounts with a second factor. 2FA must be optional and self-service. ## Acceptance criteria - [ ] An operator can enroll a TOTP authenticator via QR code and confirm with a valid code before 2FA is activated - [ ] When 2FA is enabled, login requires a valid TOTP code after the password step - [ ] Recovery codes are generated once at enrollment and each can be used at most once - [ ] 2FA can be disabled by the operator after re-authenticating ## Notes Use a public-domain / freely-licensed TOTP implementation; record provenance.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Directorium/Site#5

No description provided.

Rows
Columns