Passkeys / FIDO2 support and optional MFA enforcement would be a great addition

[MarcoSpittka]

Hi, thanks for the great work on EVtivity! MFA with TOTP, email and SMS is already a big help. Passkeys (WebAuthn) and FIDO2 security keys would be a welcome addition, both as a login option and as a second factor.

It would also be nice to have:

• An admin setting to enable or disable each MFA method
• An admin setting to require MFA, for all users or per role, with an enrollment step at the next login

Thanks for considering it!

[evtivity-admin]

Hi Marco, thank you, and thanks for the kind words. Passkeys and FIDO2 keys, as a login option and as a second factor, plus admin settings to turn each MFA method on or off and to require MFA for everyone or per role with enrollment at the next login, are all good additions. We've noted them as ideas for a future release.

We're in a run of hardening releases right now, so new features are moving slower than usual. Pull requests are still very welcome, including for parts of this, such as the per-method switches or the enforcement setting. The contributing guide covers the setup and checks. If you'd like to take one on, a short note here first about the approach would help us review it quickly.

[evtivity-admin]

Hi Marco, this is now in v0.1.48-beta.2 and ready for testing. What shipped:

• Required MFA, an optional setting that is off by default. An admin can require MFA for every operator or for chosen roles, and separately for drivers. Only when it is on do users without MFA set it up at their next sign-in.
• Switching an MFA method off now applies at sign-in too, not only to new setups.
• Recovery codes: ten single-use codes per account, shown once, with download and regenerate.
• Passkeys and physical security keys (FIDO2), as a second factor and optionally as a passwordless sign-in, for operators in the CSMS and for drivers in the portal.
• Security notices: an email when a factor is added or removed, MFA is turned on or off, recovery codes are used or regenerated, or the phone or email changes.

Setup and settings are described in the docs: Multi-Factor Authentication and Passkeys and Security Keys. Note that passkeys need HTTPS (or localhost). The release notes list the breaking API changes.

Feedback from your testing is welcome here.

[evtivity-admin]

Hi Marco, required MFA, recovery codes, passkeys and FIDO2 security keys are now in the stable release v0.1.48, as described above. One change to note: while an account has a second factor, turning MFA off or removing a factor needs that factor or a recovery code, not the password alone. Thanks again for the suggestion.

[evtivity-admin]

This can be closed now as the feature has been released.