Two-Factor Authentication <em>(as known as 2FA)</em> is a kind (subset) of <ahref="https://en.wikipedia.org/wiki/Multi-factor_authentication"class="urlextern"title="https://en.wikipedia.org/wiki/Multi-factor_authentication"rel="nofollow">multi-factor authentication</a>. It is a method to confirm a user's claimed identity by using a combination of two different factors between:
<liclass="level1"><divclass="li"><ahref="totp2f.html"class="wikilink1"title="documentation:2.0:totp2f">TOTP</a><em>(to use with <ahref="https://freeotp.github.io/"class="urlextern"title="https://freeotp.github.io/"rel="nofollow">FreeOTP</a>, <ahref="https://en.wikipedia.org/wiki/Google_Authenticator"class="urlextern"title="https://en.wikipedia.org/wiki/Google_Authenticator"rel="nofollow">Google-Authenticator</a>,…)</em></div>
<liclass="level1"><divclass="li"><ahref="utotp2f.html"class="wikilink1"title="documentation:2.0:utotp2f">U2F-or-TOTP</a><em>(enable both U2F and TOTP)</em></div>
<liclass="level1"><divclass="li"><ahref="yubikey2f.html"class="wikilink1"title="documentation:2.0:yubikey2f">Yubikey tokens</a><em> provide by Yubico</em></div>
<liclass="level1"><divclass="li"><ahref="mail2f.html"class="wikilink1"title="documentation:2.0:mail2f">E-Mail 2F</a><em>(Send a code to an email address)</em></div>
The E-Mail, External and REST 2F modules <ahref="sfextra.html"class="wikilink1"title="documentation:2.0:sfextra">may be declared multiple times</a> with different sets of parameters.
<divclass="notetip">If you want to force a 2F registration on first login, you can use 'Require 2FA'. You can also use a rule to force 2FA registration only for some users.
</div><divclass="notetip">You can display a message if an expired second factor has been removed by enabling 'Display a message if an expired SF is removed' option or setting a rule.
If you don't want to use self-registration features for U2F, TOTP and so on, you can set tokens by yourself <em>(in your LDAP server for example)</em> and map it to <code>_2fDevices</code> attribute. <code>_2fDevices</code> is a JSON array that contains token descriptions :
To develop a new 2FA plugin, read <code>Lemonldap::NG::Portal::Main::SecondFactor (3pm)</code> manpage. Your 2F module must be a Perl class named <code>Lemonldap::NG::Portal::2F::<em><custom_name></em></code>. To enable it, set <code>available2F</code> key in your <code>lemonldap-ng.ini</code> file :
