2FA in V14 Thread
# package-developmentw
Warren Buckley
07/05/2024, 1:02 PMQuestion: The 2FA tutorial is great for V14 (honestly surprised to see it in the docs, so kudos to all there)
Couple of thoughts feedback 🧵
Warren Buckley
07/05/2024, 1:03 PM* The extensions table/insights would have been good to list out the
MFA Login ProviderWarren Buckley
07/05/2024, 1:05 PMWould be good for discoverabilty & DX if the MFA Login Provider was listed in the Extension Insights along with any other extension types regardless if they have anything registered for them.
Means I could have stumbled across it, discovered the extension point and looked to docs, google or take a stab at implementing one myself etc..
Warren Buckley
07/05/2024, 1:08 PMThe other thing is that this is so generic boilerplate code from the tutorial that surely this just makes sense to be part of the core or to be a small package from HQ so that people can simply just choose to install it, as the only real configuration needed is to give it a nice name for QR code scanned in by an authenticator app.
Thoughts @Jacob Overgaard @Ronald Barendse (Mr Packages & DXP)
w
Warren Buckley
07/05/2024, 3:38 PMYep sure can
Warren Buckley
07/05/2024, 3:38 PMIf HQ has no plans, I will basically turn the tutorial into a package
https://docs.umbraco.com/umbraco-cms/reference/security/two-factor-authentication#two-factor-authentication-for-users
w
Warren Buckley
07/05/2024, 3:47 PMYeh of course and still docs site is fiddly to know if the article has been updated for V14 and using the search. So its a bit of a gamble atm
j
Jacob Overgaard
07/08/2024, 7:09 AMAgree, could have been a package. But then again, not all providers use QR codes, and not all providers require an input field on the login screen.
We managed to clean up quite a bit from V13 actually, as you had to install even more (angularjs) views to configure everything. Now we ship default components for the QR code setup and buttons.
w
Warren Buckley
07/08/2024, 8:48 AMYep I saw - but with the provided tutorial its a QR code and would be fine for most IMO. Only if you have specific requirements with a 2FA provider and if you use a different login provider such as Azure AD/Entra or others then the 2FA is done inside their systems.
So I doubt many will ship other 2FA customisations IMO, but curious to know/see if there is though.
j
Jacob Overgaard
07/08/2024, 9:05 AMYeah, but how you configure 2fa on Github or azure or whatever belongs to the "external login provider" feature, which could certainly also make good use of a package
Jacob Overgaard
07/08/2024, 9:05 AMmaybe you have enough for two packages here 🙂
Jacob Overgaard
07/08/2024, 9:06 AMAnyway, would be interesting to see an MFA implementation that actually uses something else than a code field, for example an app or a link in an email or, or, or...
w
Warren Buckley
07/08/2024, 1:22 PMBut you do the 2FA on GitHub's or Azure servers not back on the CMS
/umbracoj
Jacob Overgaard
07/08/2024, 3:39 PMUmbraco also has 2FA built-in without needing external login. In that case, you do it directly on the login screen.
Jacob Overgaard
07/08/2024, 3:41 PM...but that kind of 2FA doesn't need to be a 4-6 digit code. That's why the view is configurable because we don't know what your provider supports, for example Google Authenticator will always be a 6-digit code, but you may have something in-house that requires clicking a link or something else.
w
Warren Buckley
07/11/2024, 1:49 PMSaid package for anyone else reading thread
https://marketplace.umbraco.com/package/umbraco.community.user2fa
5 Views