Move to staged login form

[rullzer]

The current login flow of Nextcloud is just a single form.

This is great and all. But it becomes a bit meh when using more advanced authentication. It just doesn't flow right.

For example 2FA.

This is always another click. Github and google follow this flow nicer I think. By directly probing you for your 'prefered' 2fa method.
I know this is something slightly different. But maybe for a followup we could look at the way we do 2fa. Take the notification method here. That could just always fire.

The login flow becomes even less nice if you wanna use webauthn
You have to press login with device. And then do your thing.

There are of course quite some design decisions and discussions. But like I said I feel the way that google/github/other big bag tech do it is something people are used to and would fit nicer. So more like an authentication flow.

1. Enter your usename/email
2. Check if we can use webauthn
   a. if we can. Show button "authenticate with device" (or whatever) ( use https://www.twilio.com/blog/detect-browser-support-webauthn for example, together with info about the user if they have webauthn enabled)
   b. If we can't or user pressed "no use password" show password field
3. If authentication works directly show the 2fa choices
   a. as mentined above maybe remember the "prefered" way to always use that?

This would feel more modern and smooth IMO.

CC: @ChristophWurst as we talked about this a bit, @jancborchardt as always

P.s. I won't be able to drive this but wanted to get this out there

[jancborchardt]

Sounds good to me! We just need to make sure the password management of the browser (or 3rdparty) still works.

(This is the case with Google etc so I assume it's not an issue, but just in case. :)

[sunjam]

@jans23 should be of interest to you!

[jans23]

I guess this is intended already but just to make sure: If WebAuthn with PIN could be used successfully (in step 2) there is not need to ask for another factor (in step 3). (I assume 2FA is sufficient and 3FA is not desired.)