{"action":"created","issue":{"url":"https://api.github.com/repos/dimagi/commcare-hq/issues/19289","repository_url":"https://api.github.com/repos/dimagi/commcare-hq","labels_url":"https://api.github.com/repos/dimagi/commcare-hq/issues/19289/labels{/name}","comments_url":"https://api.github.com/repos/dimagi/commcare-hq/issues/19289/comments","events_url":"https://api.github.com/repos/dimagi/commcare-hq/issues/19289/events","html_url":"https://github.com/dimagi/commcare-hq/pull/19289","id":292843249,"number":19289,"title":"Remove 2fa requirement for mobile users","user":{"login":"proteusvacuum","id":146896,"avatar_url":"https://avatars1.githubusercontent.com/u/146896?v=4","gravatar_id":"","url":"https://api.github.com/users/proteusvacuum","html_url":"https://github.com/proteusvacuum","followers_url":"https://api.github.com/users/proteusvacuum/followers","following_url":"https://api.github.com/users/proteusvacuum/following{/other_user}","gists_url":"https://api.github.com/users/proteusvacuum/gists{/gist_id}","starred_url":"https://api.github.com/users/proteusvacuum/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/proteusvacuum/subscriptions","organizations_url":"https://api.github.com/users/proteusvacuum/orgs","repos_url":"https://api.github.com/users/proteusvacuum/repos","events_url":"https://api.github.com/users/proteusvacuum/events{/privacy}","received_events_url":"https://api.github.com/users/proteusvacuum/received_events","type":"User","site_admin":false},"labels":[{"id":79032211,"url":"https://api.github.com/repos/dimagi/commcare-hq/labels/Open%20for%20review:%20hold%20off%20on%20merge","name":"Open for review: hold off on merge","color":"5319e7","default":false},{"id":724787015,"url":"https://api.github.com/repos/dimagi/commcare-hq/labels/product/invisible","name":"product/invisible","color":"cfd2d6","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":13,"created_at":"2018-01-30T16:15:27Z","updated_at":"2018-02-08T15:13:09Z","closed_at":null,"author_association":"OWNER","pull_request":{"url":"https://api.github.com/repos/dimagi/commcare-hq/pulls/19289","html_url":"https://github.com/dimagi/commcare-hq/pull/19289","diff_url":"https://github.com/dimagi/commcare-hq/pull/19289.diff","patch_url":"https://github.com/dimagi/commcare-hq/pull/19289.patch"},"body":"We currently have a security option that says `All web users on this project will be required to enable two factor authentication`. However, turning on this toggle required _all_ users (including mobile workers) to have 2FA enabled. We don't have a mechanism for mobile workers to enter a 2fa code from the phone, so this essentially prevents them from being able to do anything on HQ. \r\n\r\nI tested turning on this option and\r\n- Loading a page as a web user: this gave me the \"you require 2fa\" page\r\n- Loading the same page logged in as a mobile worker: this let me load the page.\r\n\r\nI think this is a little funny, although I'm assuming the intention was that web users can potentially have more power (despite mobile workers having the ability to do everything web users do if they have the right role...).\r\n\r\nI think this might need a little more thought, as this just seems wrong to me, but I think was the original intention of this option.\r\n\r\nhttps://manage.dimagi.com/default.asp?269293#1451924\r\n"},"comment":{"url":"https://api.github.com/repos/dimagi/commcare-hq/issues/comments/364141915","html_url":"https://github.com/dimagi/commcare-hq/pull/19289#issuecomment-364141915","issue_url":"https://api.github.com/repos/dimagi/commcare-hq/issues/19289","id":364141915,"user":{"login":"proteusvacuum","id":146896,"avatar_url":"https://avatars1.githubusercontent.com/u/146896?v=4","gravatar_id":"","url":"https://api.github.com/users/proteusvacuum","html_url":"https://github.com/proteusvacuum","followers_url":"https://api.github.com/users/proteusvacuum/followers","following_url":"https://api.github.com/users/proteusvacuum/following{/other_user}","gists_url":"https://api.github.com/users/proteusvacuum/gists{/gist_id}","starred_url":"https://api.github.com/users/proteusvacuum/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/proteusvacuum/subscriptions","organizations_url":"https://api.github.com/users/proteusvacuum/orgs","repos_url":"https://api.github.com/users/proteusvacuum/repos","events_url":"https://api.github.com/users/proteusvacuum/events{/privacy}","received_events_url":"https://api.github.com/users/proteusvacuum/received_events","type":"User","site_admin":false},"created_at":"2018-02-08T15:13:09Z","updated_at":"2018-02-08T15:13:09Z","author_association":"OWNER","body":"@czue yeah, currently if you use \"API key\" auth, it bypasses the requirement for 2FA. I haven't been part of the greater 2FA discussions, so I'm not sure if this was already thought about, but is the theory behind having the API key as the \"password\" for api endpoints that you need to be able to log in to HQ to obtain the key first (i.e. need the 2 factors first)? "}}
{"actor":{"display_login":"proteusvacuum"}}