dex
dex copied to clipboard
dexidp
Two-Factor authentication (TOTP)
Overview
This pull request implements two-factor authentication (2FA) in Dex. The 2FA data is securely stored within the OfflineSessions object, enhancing security for connectors that lack built-in 2FA support, such as LDAP and local connectors. Upon first login, users will save their 2FA settings using a QR code, after which they will use the saved 2FA for subsequent logins. Below is an example configuration for enabling 2FA:
# Configuration for the two-factor authentication
twoFactorAuthn:
issuer: "dex"
connectors:
- mock
What this PR does / why we need it
Enhancing Dex with 2FA adds an additional layer of security, making unauthorized access significantly more difficult. This is particularly valuable for connectors like LDAP and local connectors that do not inherently support 2FA. By implementing 2FA, we align Dex with industry best practices for identity management, meet higher security compliance requirements, and ensure better protection for user data, thereby building greater trust with our users.
Special notes for your reviewer
I'm not a maintainer nor a reviewer so I'm not sure this is the best place to ask this, but would it be possible to display the "textual" code below the QR code?
This is useful when you can't scan the QR code, for example when your TOTP application is directly on your computer.
(Edit: typo)
Do we know if we are going to see this merge in the near future ? This would be a great feature to see deployed. As more and more security requirement ask for 2FA on auth provider.
@sambonbonne good addition, thanks! @lanord I am willing to merge it this year after figuring out some API nuances.
Nice feature to have indeed.
Have you considered supporting slapo-otp(5) when you started the project?
Hi, is TOTP still planned for this year? My team would like to use this amazing feature with local connectors. :pray:
A small update: I've taken a look at the PR and noticed that totp.Generate is always called with an empty secret option and generally it is good to have it randomized, but for simpler use cases (e.g. in-memory storage), it might be worth supporting a static secret in order to keep offlineSessions.TOTP idempotent between restarts. Kind of similar to how static passwords are already handled in Dex.
