Make 2FA behave like most web apps

[oparoz]

Maybe it's just the apps I use, but I've rarely seen web apps which ask to combine the OTP password with the local password in order to be authenticated. It's not very convenient, since the passwords are time based and we still have to type the local password after having typed the OTP one.

I suggest opnsense uses a 2-step authentication.

1. Enter the local login+password
2. Type in the OTP code

[AdSchellevis]

@oparoz sorry, this is not going to happen, the authentication system is used across all components and most of them don't have other options then user/pass combinations.
The pin+pass combination is used in other vpn access systems as well.

[oparoz]

Yeah, corporate VPN is the only place where I've seen this. Make sense since you want to use that for other components.