[Feature Request] 2FA Implementation

[cb3inco]

Describe the feature you'd like
Implementation of 2FA time based tokens.

Describe the benefits this feature would bring to BookStack users
The benefit would be that I would feel confident allowing BookStack face the public internet if 2FA could be turned on and enforced. This would allow the user direct access without having to turn on a VPN to get inside our network. I realize this might not be the use case for a lot of folks, but for those who are documenting sensitive systems this would be a huge win.

[vincentmakes]

This feature would be great

[Shagon94]

Would love to have this feature, duo has a free plan, I've used duo and its great. The only thing that could be a downside to users would be if this too is behind a paywall like the Oauth feature, security should not be placed behind a paywall.

[ssddanbrown]

The only thing that could be a downside to users would be if this too is behind a paywall like the Oauth feature, security should not be placed behind a paywall.

@Shagon94 Sorry, I may be getting confused since I'm not familiar with Duo, but is the mention of a paywall in reference to Duo or in reference to BookStack?

I'd prefer to stay away from anything vendor specific for this tbh, and go for something fairly open and common such as TOTP.

[Shagon94]

Apologies, I just found the documentation page for Oauth - https://www.bookstackapp.com/docs/admin/third-party-auth/

that being said MFA / 2FA would be great as well, TOTP would also be a great addition.

Regarding duo - duo is a 2FA provider, they have an app as well, it works like any other 2FA compatible app, the reason why I mentioned them was because they have a free plan so people might prefer having a push that they can just accept over entering the key from the OTP.

Even if we exclude duo from this 2FA is a great addition to the security, any implementation would be great.

[ssddanbrown]

Just putting this here as a reminder to myself to potentially dig into a webauthn implementation:
https://hacks.mozilla.org/2018/01/using-hardware-token-based-2fa-with-the-webauthn-api/

[ssddanbrown]

Copy of my message from the closed (In favor of this issue) original issue:

Just to flesh this out a little further, What kind of controls would you want for 2FA? For example, would you want to force 2FA on all users? Let users decide? User-level control by admins? Something else?

Not looking for extra ideas, just want to know what you'd specifically want for your environment(s).

I'm assuming, for new users and for newly-admin-enabled-2fa users, we'd force a "Setup 2FA" step upon login?

We we need to implement a backup system? Or would an admin CLI command suffice to disable 2FA for system/specfiic-account suffice in scenarios where access is lost.

[Cave-Johnson]

As an admin I'd like the option to force enabling 2FA for all users, enable just for Administrators or leave it up to user preference (enabled but not enforced)

I'm assuming, for new users and for newly-admin-enabled-2fa users, we'd force a "Setup 2FA" step upon login?

This would be the method as far as I can tell.

We we need to implement a backup system? Or would an admin CLI command suffice to disable 2FA for system/specfiic-account suffice in scenarios where access is lost.

A backup system would be needed in some form. I think your idea of a CLI command would suffice for small instances. Where that would add more of an overhead is in large deployments. Thats where the option of backup codes (ie 10 codes you download and keep safe when 2FA is configured) would come in handy with the CLI as the ultimate fallback.

[dvdl16]

What kind of controls would you want for 2FA? For example, would you want to force 2FA on all users? Let users decide? User-level control by admins? Something else?

Even just enabling/enforcing it based on Role can also be sufficient

I'm assuming, for new users and for newly-admin-enabled-2fa users, we'd force a "Setup 2FA" step upon login?

Sounds good!

We we need to implement a backup system? Or would an admin CLI command suffice to disable 2FA for system/specfiic-account suffice in scenarios where access is lost.

The CLI command is a good idea