It's valid 60 seconds, it could be a configuration option.
(In reply to Jonathan Druart from comment #0) > It's valid 60 seconds, it could be a configuration option. The interval is default 30 seconds in GoogleAuth. 30842 adds 1 older token. Note that GoogleAuth does not take the interval in the new method, but allows you to pass interval both to ->code as well as ->verify.
I'm getting reports that 60 seconds isn't long enough for some users. As I noted on https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28787#c12 it seems that other systems support up to 5 minutes. I reckon we should be using a different "range" for emailed tokens versus app tokens, but it looks like we'd need some extra session state to be able to know what method to expect.
Sorry I meant "interval" not "range".
Created attachment 155253 [details] [review] Bug 30843: Add mfa_range configuration option for TOTP This change adds a mfa_range configuration option for TOTP to koha-conf.xml Test plan: 0. Apply the patch 1. koha-plack --restart kohadev 2. Go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=TwoFactorAuthentication 3. Change the syspref to "Enable" 4. Go to http://localhost:8081/cgi-bin/koha/members/moremember.pl?borrowernumber=51 5. Click "More" and "Manage two-factor authentication" 6. Register using an app 7. In an Incognito window, go to http://localhost:8081/cgi-bin/koha/mainpage.pl 8. Sign in with the "koha" user 9. Note down a code from your Authenticator app 10. Wait until after 60 seconds and try it 11. Note it says "Invalid two-factor code" 12. Try a new code from the app 13. Note that it works 14. Add <mfa_range>10</mfa_range> to /etc/koha/sites/kohadev/koha-conf.xml 15. Clear memcached and koha-plack --restart kohadev 16. Sign in with the "koha" user 17. Note down a code from your Authenticator app 18. Wait 4 minutes and then try it 19. Note that it works
Note this change affects both app-based and emailed passwords. It would be way too much work to just do it for emailed passwords.
Why don't you set it in Koha/Auth/TwoFactorAuth.pm to also affect the call from Koha/REST/V1/TwoFactorAuth.pm (used for the registration)?
(In reply to Jonathan Druart from comment #6) > Why don't you set it in Koha/Auth/TwoFactorAuth.pm to also affect the call > from Koha/REST/V1/TwoFactorAuth.pm (used for the registration)? Funny you mention it... I did write a version where I overrode verify() but then I thought maybe we wouldn't want to embed C4::Context in Koha/Auth/TwoFactorAuth.pm, so I opted for this version instead. Both options seemed to have their pros and cons, and I was fine with both really. Happy to do the override version instead if folk prefer that.
(In reply to David Cook from comment #7) > (In reply to Jonathan Druart from comment #6) > > Why don't you set it in Koha/Auth/TwoFactorAuth.pm to also affect the call > > from Koha/REST/V1/TwoFactorAuth.pm (used for the registration)? > > Funny you mention it... I did write a version where I overrode verify() but > then I thought maybe we wouldn't want to embed C4::Context in > Koha/Auth/TwoFactorAuth.pm, so I opted for this version instead. That's not a problem. % git grep -l 'use C4::Context' Koha|wc -l 93
Created attachment 155348 [details] [review] Bug 30843: [alternate] Add mfa_range configuration option for TOTP This change adds a mfa_range configuration option for TOTP to koha-conf.xml, and overrides the "verify" method from Auth::GoogleAuth in order to provide a new default for "range" Test plan: 0. Apply the patch 1. koha-plack --restart kohadev 2. Go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=TwoFactorAuthentication 3. Change the syspref to "Enable" 4. Go to http://localhost:8081/cgi-bin/koha/members/moremember.pl?borrowernumber=51 5. Click "More" and "Manage two-factor authentication" 6. Register using an app 7. In an Incognito window, go to http://localhost:8081/cgi-bin/koha/mainpage.pl 8. Sign in with the "koha" user 9. Note down a code from your Authenticator app 10. Wait until after 60 seconds and try it 11. Note it says "Invalid two-factor code" 12. Try a new code from the app 13. Note that it works 14. Add <mfa_range>10</mfa_range> to /etc/koha/sites/kohadev/koha-conf.xml 15. Clear memcached and koha-plack --restart kohadev 16. Sign in with the "koha" user 17. Note down a code from your Authenticator app 18. Wait 4 minutes and then try it 19. Note that it works 20. Disable your two-factor authentication and click to re-enable it 21. Use a code older than 60 seconds when registering for the two factor authentication 22. Note that the code works
Created attachment 155349 [details] [review] Bug 30843: Add unit test for Koha::Auth::TwoFactorAuth::verify This change adds a unit test to test Koha::Auth::TwoFactorAuth::verify
(In reply to Jonathan Druart from comment #6) > Why don't you set it in Koha/Auth/TwoFactorAuth.pm to also affect the call > from Koha/REST/V1/TwoFactorAuth.pm (used for the registration)? Done [U+1F44D]
Created attachment 155354 [details] [review] Bug 30843: [alternate] Add mfa_range configuration option for TOTP This change adds a mfa_range configuration option for TOTP to koha-conf.xml, and overrides the "verify" method from Auth::GoogleAuth in order to provide a new default for "range" Test plan: 0. Apply the patch 1. koha-plack --restart kohadev 2. Go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=TwoFactorAuthentication 3. Change the syspref to "Enable" 4. Go to http://localhost:8081/cgi-bin/koha/members/moremember.pl?borrowernumber=51 5. Click "More" and "Manage two-factor authentication" 6. Register using an app 7. In an Incognito window, go to http://localhost:8081/cgi-bin/koha/mainpage.pl 8. Sign in with the "koha" user 9. Note down a code from your Authenticator app 10. Wait until after 60 seconds and try it 11. Note it says "Invalid two-factor code" 12. Try a new code from the app 13. Note that it works 14. Add <mfa_range>10</mfa_range> to /etc/koha/sites/kohadev/koha-conf.xml 15. Clear memcached and koha-plack --restart kohadev 16. Sign in with the "koha" user 17. Note down a code from your Authenticator app 18. Wait 4 minutes and then try it 19. Note that it works 20. Disable your two-factor authentication and click to re-enable it 21. Use a code older than 60 seconds when registering for the two factor authentication 22. Note that the code works Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 155355 [details] [review] Bug 30843: Add unit test for Koha::Auth::TwoFactorAuth::verify This change adds a unit test to test Koha::Auth::TwoFactorAuth::verify Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 155356 [details] [review] Bug 30843: Add mfa_range configuration option for TOTP This change adds a mfa_range configuration option for TOTP to koha-conf.xml, and overrides the "verify" method from Auth::GoogleAuth in order to provide a new default for "range" Test plan: 0. Apply the patch 1. koha-plack --restart kohadev 2. Go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=TwoFactorAuthentication 3. Change the syspref to "Enable" 4. Go to http://localhost:8081/cgi-bin/koha/members/moremember.pl?borrowernumber=51 5. Click "More" and "Manage two-factor authentication" 6. Register using an app 7. In an Incognito window, go to http://localhost:8081/cgi-bin/koha/mainpage.pl 8. Sign in with the "koha" user 9. Note down a code from your Authenticator app 10. Wait until after 60 seconds and try it 11. Note it says "Invalid two-factor code" 12. Try a new code from the app 13. Note that it works 14. Add <mfa_range>10</mfa_range> to /etc/koha/sites/kohadev/koha-conf.xml 15. Clear memcached and koha-plack --restart kohadev 16. Sign in with the "koha" user 17. Note down a code from your Authenticator app 18. Wait 4 minutes and then try it 19. Note that it works 20. Disable your two-factor authentication and click to re-enable it 21. Use a code older than 60 seconds when registering for the two factor authentication 22. Note that the code works Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Created attachment 155357 [details] [review] Bug 30843: Add unit test for Koha::Auth::TwoFactorAuth::verify This change adds a unit test to test Koha::Auth::TwoFactorAuth::verify Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This is a solid improvement, works well and is unit tested.. no regressions and qa scripts are happy. Passing QA
Though strictly and enhancement, I'd be tempted to treat this as a bugfix and have it backported a few versions personally.
Pushed to master for 23.11. Nice work everyone, thanks!
ping Fridolin
Pushed to 23.05.x for 23.05.05
Nice work everyone! Pushed to oldstable for 22.11.x