How-to: Authenticate a user with two-factor authentication

[jgrandja]

Publish a guide on How-to: Authenticate a user with two-factor authentication

Related gh-499

[HarunSMetin]

@jgrandja Hello. I would like to work on this issue. But This is my first time contributing to an open-source project. Therefore, I need some guidance. Could you please give me more information about this issue?

[jgrandja]

Thanks for your interest @HarunSMetin.

We're still early in writing the reference documentation and have a few things we need to iron out as far as the format goes. Our plan is to release the initial version in 0.3.0 and then will likely open things up to external contributions at that point.

[schepuri-bisc]

Hello, we are looking into supporting two-factor authentication; this guide would be of great help. Any ideas when this would be available? Thanks

[sjohnr]

Hi @schepuri-bisc, I'm glad you have interest in this topic. I do too. However, it's not at the top of the list at the moment, as it's not currently the most up-voted.

I built a sample some time ago that I will eventually use to build this how-to guide. Take a look at this branch. It is based on the mfa sample in spring-security-samples, and I added a nice UI to demonstrate some additional concepts. Hope it helps!

[schepuri-bisc]

@sjohnr This is great! The sample is a lot more useful than the how-to guide. Thank you for the quick response.

[ramonmalcolm10]

Hi @schepuri-bisc, I'm glad you have interest in this topic. I do too. However, it's not at the top of the list at the moment, as it's not currently the most up-voted.

I built a sample some time ago that I will eventually use to build this how-to guide. Take a look at this branch. It is based on the mfa sample in spring-security-samples, and I added a nice UI to demonstrate some additional concepts. Hope it helps!

When I follow the mfa sample, I was able to bypass mfa by simple closing the current tab and re-login from the client application. Can anyone else confirm this behavior or I am missing something?

[sjohnr]

When I follow the mfa sample, I was able to bypass mfa by simple closing the current tab and re-login from the client application. Can anyone else confirm this behavior or I am missing something?

Hi @ramonmalcolm10, thanks for your interest and trying out the sample! Yes, unfortunately the sample is incomplete and also on a very out of date branch.

The issue you mention is because this line simply requires any authenticated user (including a partially authenticated one). Once we get closer to finalizing a how-to guide for this, I will revisit the authorization config, but at a minimum the /oauth2/authorize endpoint needs to require hasRole("USER"). There could be other improvements as well, which is why this issue is still waiting to be tackled.

[ramonmalcolm10]

Anytime line on this, this features is critical for me

[wdkeyser02]

I tried to make a working system, based on the Steve Riesenberg code.
The code works but is not quite right yet. Can anyone give me advice on getting everything right?
Github: https://github.com/wdkeyser02/SpringMfaAuthorizationServer/tree/main/SpringMFAAuthorizationServer01

[wdkeyser02]

Can you try out the code to this video?
https://www.youtube.com/watch?v=0dSgrhv2nrE&t=28s

Thanks.

[Killian-fal]

Hey, I just published a system that seems to work well. I've explained everything in the repo, it allows to chain processes to set up two-factor authentication but not only. It works with or without Spring Authorization Server (the system is only connected to Spring Security). It's not based on the Steve Riesenberg code.

Repo link: https://github.com/Killian-fal/mfa-spring-authorization-server

[Lemick]

Hey, I just published a system that seems to work well. I've explained everything in the repo, it allows to chain processes to set up two-factor authentication but not only. It works with or without Spring Authorization Server (the system is only connected to Spring Security). It's not based on the Steve Riesenberg code.

Repo link: https://github.com/Killian-fal/mfa-spring-authorization-server

It's clean and works like a charm thanks, Spring could ship some filters designed that way IMO