Feature/totp default admin

jack1902 commented 4 years ago

to: cc: @subspacecommunity/subspace-maintainers related to: resolves: #104

Background

Wanted to secure the default user of subspace with TOTP. Now it is possible to turn on TOTP for the default user by visiting /settings and scanning the QR code with your phone (or putting the secret key into something else)

Changes

Configure TOTP via /settings
Reset TOTP via /settings (only visible if TOTP is already configured)
Can only be done by an Admin (This means both SAML Signed in Admin and the default Admin)

Pics

Initial Setup of MFA

Reset MFA (will then result in the above page)

Sign in page for default admin account if TOTP has been saved

Testing

Ran this locally multiple times on my Droplet in Digital Ocean (i'm using rsync to sync changes to my box and then running docker-compose up --build -d whenever changes are made to go files. For changes related static files i simply specify --debug in the build step for go-bindata and mount web/ into the running container. go-bindata then reads these files live on each request :D)

sonarcloud[bot] commented 4 years ago

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities (and 0 Security Hotspots to review)
0 Code Smells

No Coverage information
0.0% Duplication

jack1902 commented 4 years ago

That force-push was to cause SonarCloud to re-trigger. i have disabled the warning about i vs em as using em causes the icons from Semantic-UI to disappear and i don't know what the workaround is

maduggan commented 3 years ago

I don't see this option when I go to settings, is there a flag or some way to enable this? I'd love to use it on my admin account.

subspacecommunity / subspace