-
Notifications
You must be signed in to change notification settings - Fork 4
Two Factor Authentication
Time-based one-time codes (TOTP) for console sign-in, compatible with any standard authenticator app. Off by default.
My Account → Two-Factor Authentication, or the entry in the profile menu at the top right.
- Scan the QR code with your authenticator app, or type the key by hand.
- Enter a code from the app to confirm. Enrollment is not complete until a code verifies — this stops an account being locked out by a mis-scanned key.
- Save the ten recovery codes shown afterwards.
Ten single-use codes, generated at enrollment. Each works once, in place of an authenticator code, and is consumed when used.
Regenerate them from the same screen; regenerating invalidates all previous ones. The console warns you when few remain.
Keep them somewhere other than the device holding the authenticator app. If you lose both, an administrator has to reset your second factor.
Settings → Security. Two switches:
- Require two-factor authentication for all users
- Require two-factor authentication for administrators — superseded when the all-users switch is on
A signed-in user who has not enrolled is redirected to the setup screen and cannot use the console until they do. Only that screen and logout stay reachable.
Turning enforcement on does not sign anyone out. It takes effect on each user's next request.
A user who has lost their authenticator and their recovery codes needs an administrator: Users → edit the user → Reset 2FA. That clears the secret, the flags and every recovery code, and the action is written to the console audit log. The user enrolls again from scratch.
If nobody who can perform that reset can sign in either:
php artisan cortendesk:2fa-reset <username>
On Docker:
docker exec -it <container> php artisan cortendesk:2fa-reset <username>
That disables 2FA for the named user so they can sign in with their password.
The second factor is asked for after the password is accepted, so it protects against a stolen or guessed password. It is not a substitute for one.
Repeated wrong codes are rate limited and raise a Console brute force entry in the alarm log — someone grinding second factors already holds a working password, which is worth knowing about.
A code cannot be replayed: once a code from a given 30-second step has been accepted, that step and any earlier one are refused.
Single sign-on. SSO sessions are exempt, including from enforcement — the identity provider authenticated the user and applies its own policy.
Emailed sign-in codes. A user with 2FA enrolled is never also asked for an emailed code. The authenticator app always wins, so a sign-in raises at most one challenge.
Password reset. Resetting a password does not clear 2FA. The second factor is still required at the next sign-in — a reset returns the password only.