Skip to content

Sécurité: Mise en place du 2FA pour l'accès des comptes staff [GEN-2154] - #5706

Merged
tonial merged 8 commits into
masterfrom
alaurent/otp-2
Mar 13, 2025
Merged

Sécurité: Mise en place du 2FA pour l'accès des comptes staff [GEN-2154]#5706
tonial merged 8 commits into
masterfrom
alaurent/otp-2

Conversation

@tonial

@tonial tonial commented Feb 28, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤔 Pourquoi ?

Cette PR utilise django-otp pour gérer la partie technique.
J'ai une autre version non terminée réalisée avec pyotp (#5708)

Avantages Pyotp :
La lib est plus simple (forcément : elle ne s'interface pas avec Django, ne propose pas ses modèles,etc).
On peut stocker la clé secrete sur le User ce qui simplifie la detection de si un utilisateur a activé ou non OTP.

avantages Django-otp :

  • le 2FA par email si on pense étendre le 2FA à d'autres utilisateurs
  • le throttling
  • multiples appareils enregistrés
  • le middleware pour vérifier si l'utilisateur a bien saisi son code OTP

Je pense donc que django-otp est mieux, je n'ai donc pas fini la PR Pyotp.

🍰 Comment ?

Décrivez en quelques mots la solution retenue et mise en oeuvre, les difficultés ou problèmes rencontrés. Attirez l'attention sur les décisions d'architecture ou de conception importantes.

🚨 À vérifier

  • Mettre à jour le CHANGELOG_breaking_changes.md ?
  • Ajouter l'étiquette « Bug » ?

🏝️ Comment tester ?

Les instructions pour reproduire le problème, les profils de test, le parcours spécifique à utiliser, etc. Si vous disposez d'une recette jetable, mettre l'URL pour tester dans cette partie.

💻 Captures d'écran

image

image

@tonial tonial added 1-recette-jetable [Payé à l’heure] Crée une recette jetable sur CC modifié Modifié dans le changelog. labels Feb 28, 2025
@tonial tonial self-assigned this Feb 28, 2025
@github-actions

github-actions Bot commented Feb 28, 2025

Copy link
Copy Markdown

🥁 La recette jetable est prête ! 👉 Je veux tester cette PR !

@tonial
tonial force-pushed the alaurent/otp-2 branch 2 times, most recently from 2302197 to dc93125 Compare March 1, 2025 07:30
@tonial tonial mentioned this pull request Mar 4, 2025
Closed
2 tasks
@tonial
tonial force-pushed the alaurent/otp-2 branch 2 times, most recently from 793dd0b to add7508 Compare March 5, 2025 05:54
leo-naeka
leo-naeka reviewed Mar 6, 2025
View reviewed changes

@leo-naeka leo-naeka left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Grosse préférence également pour django-otp vs. pyotp.

Peut-être moins de latitude by design, mais la lib reste extensible/surchargeable, est bien maintenue et pas mal de boulot est déjà fait.

J'ai levé quelques points en attendant la version finale :)

Comment thread itou/www/itou_staff_views/views.py Outdated
Comment thread itou/www/itou_staff_views/views.py Outdated
Comment thread itou/admin/views.py Outdated
@tonial
tonial changed the base branch from master to alaurent/staff_login March 6, 2025 12:39
@tonial
tonial force-pushed the alaurent/otp-2 branch 2 times, most recently from cf9f52f to b4c72c1 Compare March 6, 2025 12:41
@tonial
tonial force-pushed the alaurent/staff_login branch from aba5536 to cf40b8f Compare March 7, 2025 05:55
celine-m-s
celine-m-s reviewed Mar 7, 2025
View reviewed changes
Comment thread itou/templates/itou_staff_views/otp_confirm.html Outdated
@tonial
tonial force-pushed the alaurent/staff_login branch from cf40b8f to e7671f2 Compare March 7, 2025 10:01
@tonial tonial removed the 1-recette-jetable [Payé à l’heure] Crée une recette jetable sur CC label Mar 7, 2025
@tonial
tonial marked this pull request as ready for review March 7, 2025 10:03
celine-m-s
celine-m-s reviewed Mar 7, 2025
View reviewed changes
Comment thread itou/templates/itou_staff_views/otp_confirm.html Outdated
celine-m-s
celine-m-s reviewed Mar 7, 2025
View reviewed changes
Comment thread itou/templates/itou_staff_views/otp_confirm.html Outdated
celine-m-s
celine-m-s reviewed Mar 7, 2025
View reviewed changes
Comment thread itou/templates/itou_staff_views/otp_confirm.html Outdated
celine-m-s
celine-m-s reviewed Mar 7, 2025
View reviewed changes
Comment thread itou/templates/itou_staff_views/otp_setup.html Outdated
@tonial tonial added the 1-recette-jetable [Payé à l’heure] Crée une recette jetable sur CC label Mar 7, 2025
@github-actions

github-actions Bot commented Mar 7, 2025

Copy link
Copy Markdown

🥁 La recette jetable est prête ! 👉 Je veux tester cette PR !

Base automatically changed from alaurent/staff_login to master March 7, 2025 10:21
celine-m-s
celine-m-s reviewed Mar 7, 2025
View reviewed changes
Comment thread tests/www/itou_staff_views/tests.py Outdated
xavfernandez
xavfernandez reviewed Mar 11, 2025
View reviewed changes
Comment thread itou/www/login/urls.py Outdated
@tonial
tonial force-pushed the alaurent/otp-2 branch 2 times, most recently from bc77c21 to 9cb16e2 Compare March 11, 2025 11:20
github-advanced-security[bot]
github-advanced-security AI found potential problems Mar 11, 2025
View reviewed changes
Comment thread itou/www/itou_staff_views/views.py Fixed
@tonial

tonial commented Mar 11, 2025

Copy link
Copy Markdown
Contributor Author

@francoisfreitag j'ai ajouté la suppression d'appareils dans le dernier commit

vincentporte
vincentporte approved these changes Mar 11, 2025
View reviewed changes

@vincentporte vincentporte left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

congrats

@ikarius ikarius mentioned this pull request Mar 11, 2025
Open
@tonial
tonial force-pushed the alaurent/otp-2 branch 4 times, most recently from 77515b8 to c7959a1 Compare March 12, 2025 05:01
xavfernandez
xavfernandez reviewed Mar 12, 2025
View reviewed changes
Comment thread itou/www/itou_staff_views/views.py Outdated
Comment thread itou/www/itou_staff_views/views.py Outdated
xavfernandez
xavfernandez approved these changes Mar 12, 2025
View reviewed changes
Comment thread itou/templates/itou_staff_views/otp_devices.html Outdated
Comment thread itou/templates/itou_staff_views/otp_devices.html Outdated
Comment thread itou/templates/itou_staff_views/otp_devices.html Outdated
xavfernandez
xavfernandez reviewed Mar 12, 2025
View reviewed changes
Comment thread config/settings/base.py Outdated
@tonial
tonial added this pull request to the merge queue Mar 13, 2025
Merged via the queue into master with commit 32b6a45 Mar 13, 2025
@tonial
tonial deleted the alaurent/otp-2 branch March 13, 2025 05:48
@tonial tonial mentioned this pull request May 13, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@leo-naeka leo-naeka leo-naeka approved these changes
@xavfernandez xavfernandez xavfernandez approved these changes
@francoisfreitag francoisfreitag francoisfreitag approved these changes
+2 more reviewers
@celine-m-s celine-m-s celine-m-s approved these changes
@vincentporte vincentporte vincentporte approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@tonial tonial

Labels

1-recette-jetable [Payé à l’heure] Crée une recette jetable sur CC modifié Modifié dans le changelog.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@tonial @celine-m-s @leo-naeka @xavfernandez @francoisfreitag @vincentporte @github-advanced-security