Support for MFA (multi-factor authentication)

Uninett / nav

Network Administration Visualized

GNU General Public License v3.0

179 stars 37 forks source link

Open ingeborgoh opened 3 years ago

ingeborgoh commented 3 years ago

Due to recent events the need to better secure the access to NAV has come up.

We would like to be able to demand Multi Factor Authentication before users are allowed to log in.

lunkwill42 commented 2 years ago

Comments from nav-ref:

Potentially, support for TOTP - Time-based One-time Password would cover this.
Maybe "MFA must be used" should be read from LDAP and not apply to local user database
Potentially, the whole MFA issue could be side-stepped by using REMOTE_USER and enabling MFA in Feide

hmpf commented 10 months ago

hmpf commented 9 months ago

The docs for setting up REMOTE_USER with either oidc (#2708) or saml (#2740) has been checked and improved, that'll give us MFA for free.