Bug 30843

Summary: TOTP expiration delay should be configurable
Product: Koha Reporter: Jonathan Druart <jonathan.druart>
Component: AuthenticationAssignee: David Cook <dcook>
Status: Pushed to oldstable --- QA Contact: Martin Renvoize <martin.renvoize>
Severity: enhancement    
Priority: P5 - low CC: dcook, dpavlin, fridolin.somers, m.de.rooy, martin.renvoize
Version: unspecifiedKeywords: release-notes-needed
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
The mfa_range element in the koha-conf.xml file can now be used to change the default "range".
Version(s) released in:
23.11.00,23.05.05,22.11.11
Bug Depends on: 30842    
Bug Blocks:    
Attachments: Bug 30843: Add mfa_range configuration option for TOTP
Bug 30843: [alternate] Add mfa_range configuration option for TOTP
Bug 30843: Add unit test for Koha::Auth::TwoFactorAuth::verify
Bug 30843: [alternate] Add mfa_range configuration option for TOTP
Bug 30843: Add unit test for Koha::Auth::TwoFactorAuth::verify
Bug 30843: Add mfa_range configuration option for TOTP
Bug 30843: Add unit test for Koha::Auth::TwoFactorAuth::verify

Description Jonathan Druart 2022-05-25 08:09:14 UTC
It's valid 60 seconds, it could be a configuration option.
Comment 1 Marcel de Rooy 2022-05-27 06:03:26 UTC
(In reply to Jonathan Druart from comment #0)
> It's valid 60 seconds, it could be a configuration option.

The interval is default 30 seconds in GoogleAuth.
30842 adds 1 older token.
Note that GoogleAuth does not take the interval in the new method, but allows you to pass interval both to ->code as well as ->verify.
Comment 2 David Cook 2023-07-30 23:25:59 UTC
I'm getting reports that 60 seconds isn't long enough for some users.

As I noted on https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28787#c12 it seems that other systems support up to 5 minutes. 

I reckon we should be using a different "range" for emailed tokens versus app tokens, but it looks like we'd need some extra session state to be able to know what method to expect.
Comment 3 David Cook 2023-07-30 23:26:38 UTC
Sorry I meant "interval" not "range".
Comment 4 David Cook 2023-09-06 05:24:33 UTC
Created attachment 155253 [details] [review]
Bug 30843: Add mfa_range configuration option for TOTP

This change adds a mfa_range configuration option for TOTP
to koha-conf.xml

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Go to
http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=TwoFactorAuthentication
3. Change the syspref to "Enable"
4. Go to
http://localhost:8081/cgi-bin/koha/members/moremember.pl?borrowernumber=51
5. Click "More" and "Manage two-factor authentication"
6. Register using an app
7. In an Incognito window, go to
http://localhost:8081/cgi-bin/koha/mainpage.pl
8. Sign in with the "koha" user
9. Note down a code from your Authenticator app
10. Wait until after 60 seconds and try it
11. Note it says "Invalid two-factor code"
12. Try a new code from the app
13. Note that it works

14. Add <mfa_range>10</mfa_range> to /etc/koha/sites/kohadev/koha-conf.xml
15. Clear memcached and koha-plack --restart kohadev
16. Sign in with the "koha" user
17. Note down a code from your Authenticator app
18. Wait 4 minutes and then try it
19. Note that it works
Comment 5 David Cook 2023-09-06 05:30:57 UTC
Note this change affects both app-based and emailed passwords. It would be way too much work to just do it for emailed passwords.
Comment 6 Jonathan Druart 2023-09-06 07:00:54 UTC
Why don't you set it in Koha/Auth/TwoFactorAuth.pm to also affect the call from Koha/REST/V1/TwoFactorAuth.pm (used for the registration)?
Comment 7 David Cook 2023-09-06 07:18:53 UTC
(In reply to Jonathan Druart from comment #6)
> Why don't you set it in Koha/Auth/TwoFactorAuth.pm to also affect the call
> from Koha/REST/V1/TwoFactorAuth.pm (used for the registration)?

Funny you mention it... I did write a version where I overrode verify() but then I thought maybe we wouldn't want to embed C4::Context in Koha/Auth/TwoFactorAuth.pm, so I opted for this version instead. 

Both options seemed to have their pros and cons, and I was fine with both really. 

Happy to do the override version instead if folk prefer that.
Comment 8 Jonathan Druart 2023-09-06 09:16:54 UTC
(In reply to David Cook from comment #7)
> (In reply to Jonathan Druart from comment #6)
> > Why don't you set it in Koha/Auth/TwoFactorAuth.pm to also affect the call
> > from Koha/REST/V1/TwoFactorAuth.pm (used for the registration)?
> 
> Funny you mention it... I did write a version where I overrode verify() but
> then I thought maybe we wouldn't want to embed C4::Context in
> Koha/Auth/TwoFactorAuth.pm, so I opted for this version instead. 

That's not a problem.

% git grep -l 'use C4::Context' Koha|wc -l
93
Comment 9 David Cook 2023-09-08 01:55:41 UTC
Created attachment 155348 [details] [review]
Bug 30843: [alternate] Add mfa_range configuration option for TOTP

This change adds a mfa_range configuration option for TOTP
to koha-conf.xml, and overrides the "verify" method from
Auth::GoogleAuth in order to provide a new default for "range"

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Go to
http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=TwoFactorAuthentication
3. Change the syspref to "Enable"
4. Go to
http://localhost:8081/cgi-bin/koha/members/moremember.pl?borrowernumber=51
5. Click "More" and "Manage two-factor authentication"
6. Register using an app
7. In an Incognito window, go to
http://localhost:8081/cgi-bin/koha/mainpage.pl
8. Sign in with the "koha" user
9. Note down a code from your Authenticator app
10. Wait until after 60 seconds and try it
11. Note it says "Invalid two-factor code"
12. Try a new code from the app
13. Note that it works

14. Add <mfa_range>10</mfa_range> to /etc/koha/sites/kohadev/koha-conf.xml
15. Clear memcached and koha-plack --restart kohadev
16. Sign in with the "koha" user
17. Note down a code from your Authenticator app
18. Wait 4 minutes and then try it
19. Note that it works

20. Disable your two-factor authentication and click to re-enable it
21. Use a code older than 60 seconds when registering for the two
factor authentication
22. Note that the code works
Comment 10 David Cook 2023-09-08 01:55:44 UTC
Created attachment 155349 [details] [review]
Bug 30843: Add unit test for Koha::Auth::TwoFactorAuth::verify

This change adds a unit test to test Koha::Auth::TwoFactorAuth::verify
Comment 11 David Cook 2023-09-08 01:56:14 UTC
(In reply to Jonathan Druart from comment #6)
> Why don't you set it in Koha/Auth/TwoFactorAuth.pm to also affect the call
> from Koha/REST/V1/TwoFactorAuth.pm (used for the registration)?

Done 👍
Comment 12 Marcel de Rooy 2023-09-08 06:31:40 UTC
Created attachment 155354 [details] [review]
Bug 30843: [alternate] Add mfa_range configuration option for TOTP

This change adds a mfa_range configuration option for TOTP
to koha-conf.xml, and overrides the "verify" method from
Auth::GoogleAuth in order to provide a new default for "range"

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Go to
http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=TwoFactorAuthentication
3. Change the syspref to "Enable"
4. Go to
http://localhost:8081/cgi-bin/koha/members/moremember.pl?borrowernumber=51
5. Click "More" and "Manage two-factor authentication"
6. Register using an app
7. In an Incognito window, go to
http://localhost:8081/cgi-bin/koha/mainpage.pl
8. Sign in with the "koha" user
9. Note down a code from your Authenticator app
10. Wait until after 60 seconds and try it
11. Note it says "Invalid two-factor code"
12. Try a new code from the app
13. Note that it works

14. Add <mfa_range>10</mfa_range> to /etc/koha/sites/kohadev/koha-conf.xml
15. Clear memcached and koha-plack --restart kohadev
16. Sign in with the "koha" user
17. Note down a code from your Authenticator app
18. Wait 4 minutes and then try it
19. Note that it works

20. Disable your two-factor authentication and click to re-enable it
21. Use a code older than 60 seconds when registering for the two
factor authentication
22. Note that the code works

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 13 Marcel de Rooy 2023-09-08 06:31:42 UTC
Created attachment 155355 [details] [review]
Bug 30843: Add unit test for Koha::Auth::TwoFactorAuth::verify

This change adds a unit test to test Koha::Auth::TwoFactorAuth::verify

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 14 Martin Renvoize 2023-09-08 06:42:59 UTC
Created attachment 155356 [details] [review]
Bug 30843: Add mfa_range configuration option for TOTP

This change adds a mfa_range configuration option for TOTP
to koha-conf.xml, and overrides the "verify" method from
Auth::GoogleAuth in order to provide a new default for "range"

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Go to
http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=TwoFactorAuthentication
3. Change the syspref to "Enable"
4. Go to
http://localhost:8081/cgi-bin/koha/members/moremember.pl?borrowernumber=51
5. Click "More" and "Manage two-factor authentication"
6. Register using an app
7. In an Incognito window, go to
http://localhost:8081/cgi-bin/koha/mainpage.pl
8. Sign in with the "koha" user
9. Note down a code from your Authenticator app
10. Wait until after 60 seconds and try it
11. Note it says "Invalid two-factor code"
12. Try a new code from the app
13. Note that it works

14. Add <mfa_range>10</mfa_range> to /etc/koha/sites/kohadev/koha-conf.xml
15. Clear memcached and koha-plack --restart kohadev
16. Sign in with the "koha" user
17. Note down a code from your Authenticator app
18. Wait 4 minutes and then try it
19. Note that it works

20. Disable your two-factor authentication and click to re-enable it
21. Use a code older than 60 seconds when registering for the two
factor authentication
22. Note that the code works

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 15 Martin Renvoize 2023-09-08 06:43:02 UTC
Created attachment 155357 [details] [review]
Bug 30843: Add unit test for Koha::Auth::TwoFactorAuth::verify

This change adds a unit test to test Koha::Auth::TwoFactorAuth::verify

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 16 Martin Renvoize 2023-09-08 06:44:06 UTC
This is a solid improvement, works well and is unit tested.. no regressions and qa scripts are happy.

Passing QA
Comment 17 Martin Renvoize 2023-09-08 06:44:34 UTC
Though strictly and enhancement, I'd be tempted to treat this as a bugfix and have it backported a few versions personally.
Comment 18 Tomás Cohen Arazi 2023-09-25 13:54:39 UTC
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 19 Marcel de Rooy 2023-10-05 12:25:08 UTC
ping Fridolin
Comment 20 Fridolin Somers 2023-10-05 18:38:22 UTC
Pushed to 23.05.x for 23.05.05
Comment 21 Matt Blenkinsop 2023-10-17 16:56:47 UTC
Nice work everyone!

Pushed to oldstable for 22.11.x