search

sgiehl / piwik-plugin-GoogleAuthenticator

Adds Google Authenticator Two Factor Auth to Piwik
9 stars 3 forks source link

Provide a possibility to bypass two factor auth #12

Open sgiehl opened 8 years ago

sgiehl commented 8 years ago

In the case that someone looses his possibility to generate tokens (e.g. lost his phone) there should be a possibility to bypass the two factor auth in order to be still able to login to piwik.

The possibility provided by other services is to generate a list of one time tokens.

A possibility suggest by a user would be to bypass two factor auth for specific IPs (which won't work for dynamic IPs)

Draky50110 commented 7 years ago

Subscribing to one time token, as it is mainly used by Google or other company to bypass in case of...

mannp commented 7 years ago

I would also like to know the answer to this please and am not fully clear of your response Draky, could you expand a little please?

Draky50110 commented 7 years ago

Other big websites like Google let us use bypass codes.

mannp commented 7 years ago

Agreed they do, so do nextcloud and others, but this plugin doesn't support it does it.

sgiehl commented 7 years ago

I would love to be able to add support for this, but I'm currently not able handle this. Pull Requests are welcome :)

mannp commented 7 years ago

Just trying to understand any potential lockout scenarios. Are we able to disable the plugin locally and re-login to recover the account?

If we edit the configs that is.

Thanks

sgiehl commented 7 years ago

Sure. You can disable the plugin to disable it for all accounts. Or you can remove the settings for a specific account from the database to disable it for a specific account: piwik_option table; option_name is GoogleAuthenticator.username

mannp commented 7 years ago

Perfect thanks and does disabling it leave the original username and pass in tact, merely removing the additional 2fa step.

So we can login as usual?

sgiehl commented 7 years ago

exactly. it only disables the 2Fa step.

mannp commented 7 years ago

That works for me, thanks :) and thanks for your work.

jookk commented 7 years ago

how to do it exactly, please... I am locked out, looked to tables, but cant find it pwk

sgiehl commented 7 years ago

@jookk Try DELETE FROM piwik_option WHERE option_name = 'GoogleAuthenticator.username' LIMIT 1;, where you need to replace username with your own users login. Afterwards you need to set up 2FA for that user again

jookk commented 6 years ago

so, I tried and... pwk

sgiehl commented 6 years ago

then it shouldn't be active for your user. what exactly is your problem when logging in?

jookk commented 6 years ago

Yes, it was active and I used it successfuly. Recently changed phone and TfA is gone. BUT, i found ./console plugins list and deactivate... So, I simply deactivated Google Auth plugin and logged in. :)