{"action":"created","issue":{"url":"https://api.github.com/repos/ltb-project/self-service-password/issues/27","repository_url":"https://api.github.com/repos/ltb-project/self-service-password","labels_url":"https://api.github.com/repos/ltb-project/self-service-password/issues/27/labels{/name}","comments_url":"https://api.github.com/repos/ltb-project/self-service-password/issues/27/comments","events_url":"https://api.github.com/repos/ltb-project/self-service-password/issues/27/events","html_url":"https://github.com/ltb-project/self-service-password/issues/27","id":179312299,"number":27,"title":"request: TOTP (2FA)","user":{"login":"r2evans","id":5815808,"avatar_url":"https://avatars.githubusercontent.com/u/5815808?v=3","gravatar_id":"","url":"https://api.github.com/users/r2evans","html_url":"https://github.com/r2evans","followers_url":"https://api.github.com/users/r2evans/followers","following_url":"https://api.github.com/users/r2evans/following{/other_user}","gists_url":"https://api.github.com/users/r2evans/gists{/gist_id}","starred_url":"https://api.github.com/users/r2evans/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/r2evans/subscriptions","organizations_url":"https://api.github.com/users/r2evans/orgs","repos_url":"https://api.github.com/users/r2evans/repos","events_url":"https://api.github.com/users/r2evans/events{/privacy}","received_events_url":"https://api.github.com/users/r2evans/received_events","type":"User","site_admin":false},"labels":[{"id":425746657,"url":"https://api.github.com/repos/ltb-project/self-service-password/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/ltb-project/self-service-password/milestones/2","html_url":"https://github.com/ltb-project/self-service-password/milestones/Future","labels_url":"https://api.github.com/repos/ltb-project/self-service-password/milestones/2/labels","id":2030996,"number":2,"title":"Future","description":"Not planned yet","creator":{"login":"coudot","id":883396,"avatar_url":"https://avatars.githubusercontent.com/u/883396?v=3","gravatar_id":"","url":"https://api.github.com/users/coudot","html_url":"https://github.com/coudot","followers_url":"https://api.github.com/users/coudot/followers","following_url":"https://api.github.com/users/coudot/following{/other_user}","gists_url":"https://api.github.com/users/coudot/gists{/gist_id}","starred_url":"https://api.github.com/users/coudot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coudot/subscriptions","organizations_url":"https://api.github.com/users/coudot/orgs","repos_url":"https://api.github.com/users/coudot/repos","events_url":"https://api.github.com/users/coudot/events{/privacy}","received_events_url":"https://api.github.com/users/coudot/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":0,"state":"open","created_at":"2016-09-27T08:04:21Z","updated_at":"2016-10-04T15:51:48Z","due_on":null,"closed_at":null},"comments":11,"created_at":"2016-09-26T19:10:28Z","updated_at":"2016-11-22T09:54:13Z","closed_at":null,"body":"I had initially suggested this in http://tools.ltb-project.org/issues/818. For reference:\n\n> Provide 2FA (TFA) as an option for verification of the user. There are some 2FA PHP modules (https://github.com/RobThree/TwoFactorAuth, https://github.com/PHPGangsta/GoogleAuthenticator) that provide sufficient access to implement it.\n\n(It appears that the second link hasn't been touched in a couple of years, perhaps RobThree's would be preferred?)\n\nI recognize it is not necessarily a top priority for all (or perhaps many, even), so I was considering how hard it would be to implement. Some questions I had:\n- How to store the shared secret?\n  - Can it be stored within an unmodified LDAP structure? Requiring a change to the schema will many (if not most).\n  - Ditto for Active Directory? (I believe AD is for the most part LDAP-compatible, but this question begs MS's AD or Samba4's AD.)\n  - If neither of the above, I'm not fond of having yet another storage mechanism, whether it be on a SQL server somewhere or in a local-only SQLite database.\n- If it can be stored within LDAP, is it a mechanism that other applications might be able to use? For instance, apps like owncloud, nextcloud, and gitlab have various levels of 2FA support, but I believe they are storing it internally/proprietarily. I think it would be good to be able to use the same shared-secret across multiple clients. (Then, of course, I'd need to convince those apps to get the shared-secret and use it ...)\n- Again, if it can be stored within the LDAP structure, is it \"safe enough\" to store it there? Are there security considerations I'm not considering?\n\nThe current method of using SMS as a reset mechanism is useful but this sort of 2FA is [no longer recommended](https://www.schneier.com/blog/archives/2016/08/nist_is_no_long.html). I'm inferring that this should also apply to email-based OOB reset links, for similar reasons.\n\nThoughts?\n"},"comment":{"url":"https://api.github.com/repos/ltb-project/self-service-password/issues/comments/262195783","html_url":"https://github.com/ltb-project/self-service-password/issues/27#issuecomment-262195783","issue_url":"https://api.github.com/repos/ltb-project/self-service-password/issues/27","id":262195783,"user":{"login":"coudot","id":883396,"avatar_url":"https://avatars.githubusercontent.com/u/883396?v=3","gravatar_id":"","url":"https://api.github.com/users/coudot","html_url":"https://github.com/coudot","followers_url":"https://api.github.com/users/coudot/followers","following_url":"https://api.github.com/users/coudot/following{/other_user}","gists_url":"https://api.github.com/users/coudot/gists{/gist_id}","starred_url":"https://api.github.com/users/coudot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coudot/subscriptions","organizations_url":"https://api.github.com/users/coudot/orgs","repos_url":"https://api.github.com/users/coudot/repos","events_url":"https://api.github.com/users/coudot/events{/privacy}","received_events_url":"https://api.github.com/users/coudot/received_events","type":"User","site_admin":false},"created_at":"2016-11-22T09:54:13Z","updated_at":"2016-11-22T09:54:13Z","body":"@r2evans extending the schema is not mandatory. See the reset by questions feature, I coded it so we can use any objectClass/attribute to store/read the answer. You should not force someone to extend the schema, as you don't know which kind of LDAP directory he is running (OpenLDAP, AD, etc.)"}}
{"actor":{"display_login":"coudot"}}