Bug 34028 - Two factor authentication (2FA) shows the wrong values for manual entry
Summary: Two factor authentication (2FA) shows the wrong values for manual entry
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low major
Assignee: David Cook
QA Contact: Testopia
URL:
Keywords:
: 30586 31119 (view as bug list)
Depends on: 28786
Blocks:
  Show dependency treegraph
 
Reported: 2023-06-16 05:20 UTC by David Cook
Modified: 2024-12-23 08:06 UTC (History)
8 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
This fixes the details displayed for manually entering two-factor authentication (2FA) details into a 2FA application (when enabling 2FA). Currently, the wrong information is displayed - so you can't successfully add the account manually to your 2FA application.
Version(s) released in:
23.11.00,23.05.01,22.11.09
Circulation function:


Attachments
Bug 34028: Fix manual entry for two factor authentication (3.14 KB, patch)
2023-06-16 06:09 UTC, David Cook
Details | Diff | Splinter Review
Bug 34028: Fix manual entry for two factor authentication (3.18 KB, patch)
2023-06-19 07:50 UTC, David Nind
Details | Diff | Splinter Review
Bug 34028: Fix manual entry for two factor authentication (3.25 KB, patch)
2023-06-19 14:10 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review
Bug 34028: Show the secret when registering from the auth screen (999 bytes, patch)
2023-07-04 10:05 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2023-06-16 05:20:34 UTC
In koha-testing-docker, if you enable 2FA, you'll see the following:

`To add the entry manually, provide the following details to the application on your phone.

Account: Centerville

Key: Centerville_koha

Time based: Yes`

"Account" should be "Centerville: Centerville_koha", and "Key" should be the the "secret" value. 

The "Account" is really just a label, but the "Key" needs to be the shared secret.
Comment 1 David Cook 2023-06-16 06:09:42 UTC
Created attachment 152398 [details] [review]
Bug 34028: Fix manual entry for two factor authentication

This patch changes the "Account" and "Key" display so that
you can manually enter two factor authentication details into
an authenticator app.

The details are the same as those provided by scanning the QR code.

Test plan:
0. Apply patch
1. Go to
http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=TwoFactorAuthentication
2. Change setting to "Enable"
3. Go to http://localhost:8081/cgi-bin/koha/circ/circulation.pl?borrowernumber=51
4. Click "More" on record toolbar and choose "Manage two-factor authentication"
5. Click "Enable two-factor authentication"
6. Scan the QR code into an authenticator app and note it creates an entry called
"Centerville: Centerville_koha"
7. Manually enter an entry into an authenticator app (like Google Authenticator)
7a. Add the "Account" as shown on the Koha screen
7b. Add the "Key" as shown on the Koha screen
8. Note that the entries added by QR code and manual entry have the same
label and both were accepted by the authenticator app
Comment 2 Jonathan Druart 2023-06-19 07:29:18 UTC
*** Bug 31119 has been marked as a duplicate of this bug. ***
Comment 3 Jonathan Druart 2023-06-19 07:29:36 UTC
*** Bug 30586 has been marked as a duplicate of this bug. ***
Comment 4 David Nind 2023-06-19 07:50:28 UTC
Created attachment 152465 [details] [review]
Bug 34028: Fix manual entry for two factor authentication

This patch changes the "Account" and "Key" display so that
you can manually enter two factor authentication details into
an authenticator app.

The details are the same as those provided by scanning the QR code.

Test plan:
0. Apply patch
1. Go to
http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=TwoFactorAuthentication
2. Change setting to "Enable"
3. Go to http://localhost:8081/cgi-bin/koha/circ/circulation.pl?borrowernumber=51
4. Click "More" on record toolbar and choose "Manage two-factor authentication"
5. Click "Enable two-factor authentication"
6. Scan the QR code into an authenticator app and note it creates an entry called
"Centerville: Centerville_koha"
7. Manually enter an entry into an authenticator app (like Google Authenticator)
7a. Add the "Account" as shown on the Koha screen
7b. Add the "Key" as shown on the Koha screen
8. Note that the entries added by QR code and manual entry have the same
label and both were accepted by the authenticator app

Signed-off-by: David Nind <david@davidnind.com>
Comment 5 Martin Renvoize (ashimema) 2023-06-19 14:10:02 UTC
Created attachment 152473 [details] [review]
Bug 34028: Fix manual entry for two factor authentication

This patch changes the "Account" and "Key" display so that
you can manually enter two factor authentication details into
an authenticator app.

The details are the same as those provided by scanning the QR code.

Test plan:
0. Apply patch
1. Go to
http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=TwoFactorAuthentication
2. Change setting to "Enable"
3. Go to http://localhost:8081/cgi-bin/koha/circ/circulation.pl?borrowernumber=51
4. Click "More" on record toolbar and choose "Manage two-factor authentication"
5. Click "Enable two-factor authentication"
6. Scan the QR code into an authenticator app and note it creates an entry called
"Centerville: Centerville_koha"
7. Manually enter an entry into an authenticator app (like Google Authenticator)
7a. Add the "Account" as shown on the Koha screen
7b. Add the "Key" as shown on the Koha screen
8. Note that the entries added by QR code and manual entry have the same
label and both were accepted by the authenticator app

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 6 Martin Renvoize (ashimema) 2023-06-19 14:10:44 UTC
Solid fix, works as expected.

Passing QA
Comment 7 Tomás Cohen Arazi (tcohen) 2023-06-21 16:18:43 UTC
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 8 Fridolin Somers 2023-06-26 12:57:31 UTC
Pushed to 23.05.x for 23.05.01
Comment 9 Jonathan Druart 2023-07-04 10:03:50 UTC
Key is missing on the auth screen: https://snipboard.io/PlARWt.jpg
Comment 10 Jonathan Druart 2023-07-04 10:05:46 UTC
Created attachment 153009 [details] [review]
Bug 34028: Show the secret when registering from the auth screen
Comment 11 Pedro Amorim 2023-07-18 09:10:21 UTC
Waiting on follow-up to be pushed before we consider this for 22.11.x.
Comment 12 Tomás Cohen Arazi (tcohen) 2023-07-24 17:56:56 UTC
Follow-up pushed to master. Thanks.
Comment 13 Pedro Amorim 2023-08-17 14:44:16 UTC
@Frido can you please take a look at the follow-up for 23.05.x?
Comment 14 Fridolin Somers 2023-08-17 20:54:14 UTC
(In reply to Pedro Amorim from comment #13)
> @Frido can you please take a look at the follow-up for 23.05.x?

Followup pushed to 23.05.x for 23.05.03 :
  Bug 34028: Show the secret when registering from the auth screen
Comment 15 Pedro Amorim 2023-08-18 10:53:37 UTC
Nice work everyone!

Pushed to 22.11.x for next release