Implement 2-factor authentication

[poi33]

Current implementation plan: User flow:

• First login send a "verify" email with a link (same as reset password).
• The link in the email goes to a page as a QR code (2FA secret).
• On the token page link to login page
• After the user logs in, requests an addition code (2FA code) to enter the site.

Code implementation:

• First login, (request login, no session), sends the verify email with link.
• When visiting the page. Save the authtoken to userprofile.
• Then when a user logsin: The user credentials are checked with a login (request only, no session).
• Save a timestamp on the user profile, they can now enter the 2FA code to login. Limit the login to 5 min after inital user + password.
• If user enters the 2FA code & validates, create a full session.

[poi33]

Revised implementation:

User flow:

• Login user + passwrod
• Promptet to enter a code received from email
• open email copy code
• paste code into second prompt
• User is logged in

Code implementation:

• Valid User login:
  • Generates a token and timestamp on the user
  • Send an email to the user containing the code
• User enters the code received on email
• Login user into the system

[poi33]

Need to reopen or create new issue when https://github.com/enonic/xp/issues/8987 is done