search

pglombardo / PasswordPusher

🔐 Securely share sensitive information with automatic expiration & deletion after a set number of views or duration. Track who, what and when with full audit logs.
https://docs.pwpush.com
Apache License 2.0
1.82k stars 331 forks source link

FR: Add 2FA #696

Open SecureCPU opened 1 year ago

SecureCPU commented 1 year ago

Wanted to know if you would be able to add 2FA - multi-factor authentication to the users.

The user accounts do hold sensitive information even temporarily and it would be a huge benefit to have 2FA to secure the accounts.

We would love to use this for our company and clients, but are restricted to only use programs that have 2FA authentication.

If you can add this it would be amazing. Thank you!

P.S. I really appreciate the work and the product! Thank You!

github-actions[bot] commented 1 year ago

Hello @SecureCPU, thanks for contributing to the Password Pusher community! We will respond as soon as possible.

pglombardo commented 1 year ago

Hi @SecureCPU - it's definitely in the plans but no ETA as of yet.

If we were to add LDAP or OpenID connect support , that would require 2FA from those systems (if configured) correct?

There is some research I still need to do.

jubnl commented 1 year ago

That would be a really great addition !

jubnl commented 1 year ago

Instead of implementing 2FA or LDAP auth directly, would it be possible to integrate something like FireBase or AppWrite (the advantage of AppWrite is that we can host it ourselves) that would take care of the authentication? This could really speed up the development process and use all the authentication methods provided by these backends as a service.

pglombardo commented 1 year ago

AppWrite is a good find. I'll take a look at that.

Viajaz commented 1 year ago

How many need to operate PasswordPusher in a completely standalone mode without an external Identity Provider?

Kofl commented 1 month ago

One vote for OpenID connect support, its the most flexible solution and with an OpenID provider like Authentik, Keycloak or the commercial one like Google or MS every use case can be covered and has not to be implemented by PasswordPusher as the ID provider handles it.