2fa (two-factor authentifcation) in Plone 6 options or plans?

Plone Support
1

Hello,
what is the current status of two-factor authentication (2FA or multi-factor authentication) with Plone 6?

What I have found out so far is

  • two-factor-auth-in-plone-6/14796 in February got referred to https://github.com/collective/collective.googleauthenticator but this is old (plone4 python2 last commit 2018).
  • community.plone.org/t/what-makes-plone-an-enterprise-cms-what-is-missing/14771/2 that 2AF support is missing in February, there is a pointer towards github.com/castlecms/castle.cms for implementation ideas. So maybe github.com/castlecms/castle.cms/pull/365/files is an inspiration
  • There are proposals for the summer of code, Webauth (having a mentor) and OAuth (not having one). Both would offer 2FA possibilities.

As it is mentioned that 2FA is not possible out of the box, what is the currently best method to do it with add-ons?

Did not find an issue somewhere for developing 2FA, is there one already?

2

collective.googleauthenticator has a plone 5.1 branch that has been worked on by community membmers . As the PAS system is mature and stable my guestimate is that it shouldn't be too much work getting this add'on upgraded to Python 3 and ready for Plone 6.

I'm not sure how much this is really tied to Google 2FA on the server, I can use their client apps interchangeably (MS, Google, third party apps)

3

@fredvd thanks for your estimation.

As far as I know Google Authenticator uses the standards TOTP; specified in RFC 6238) or HOTP; specified in RFC 4226) so any application supporting this one of the standrads should work.

4

I did a little work trying to get this to work with Plone 5.2. I did not mange to get anything to install anywhere, ref: Working buildout for collective.googleauthenticator?

I gave up (so I did not get the job)

5

I had it successfully running, but it was 2019 :slight_smile:

Now I do not have that buildout anymore, sorry :confused:

6

Does anyone have a solution, is currently working on or experimenting with 2FA with Plone 6 / Volto?

I read that it was a GSOC point proposed by @zopyx GSoC 2022 brainstorming - #43 by zopyx and later mentioned by @tiberiuichim in another post What makes Plone an enterprise CMS? What is missing?

My interest is more in 2FA based on TOTP/HOTP like Google Authenticator, rather than a physical device like Yubikey.

Thanks

7

Correct. I hope, my student will be able to complete the task

8

Have you checked GitHub - collective/collective.googleauthenticator: Two-step verification for Plone 4 using the Google Authenticator app. ?

BR,

9

thank you @zopyx if you/your student have something already published, I will be happy to take a look at it. And if it pleases / if needed, also do reviews.

@erral I knew about c.googleauthenticator, but I'm looking to something integrated in Volto

10

Nothing to see so far

11

OK, thank you so much. as soon as you have any news, please, let me know.