Optional two factor authentication

[Mauricio de Abreu Antunes]

I read the documentation and I am trying to achieve an optional two factor authentication.

In my case users can opt-in and then I need to show the QR code in order to enable it fully. After that, login will start to have another step. 

First users input email and password, and if they have 2FA enable they are redirected to a page asking the token.

In my case I don't need the device (not my idea here) only the token.

What do you recommend me to do?

[Peter Sagerson]

Sorry, I think this ended up in my Junk folder.

This should be pretty straightforward. If an authenticated user attempts to access a view that is protected by otp_required(if_configured=True),[1] and they have at least one valid device configured, then they will be redirected to OTP_LOGIN_URL. You probably want to point this to django_otp.views.login,[2] which is smart enough to only ask for the second factor if the user is already authenticated. You'll need to supply the template, of course.

Is there a particular part of this that you're having trouble with?

Thanks,

Peter

[1] http://django-otp-official.readthedocs.io/en/latest/auth.html#authorizing-users

[2] http://django-otp-official.readthedocs.io/en/latest/auth.html#the-easy-way

--
You received this message because you are subscribed to the Google Groups "django-otp" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-otp+...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Mauricio de Abreu Antunes]

Thanks! I adjusted my code and now I have optional 2FA.

One thing I am stuck is how to generate the qrcode. I got to generate it right but just like django-otp admin my code uses a HttResponse to add it to the template. Does not it makes two consecutive requests? 

To unsubscribe from this group and stop receiving emails from it, send an email to django-otp+unsubscribe@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to a topic in the Google Groups "django-otp" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/django-otp/SzgFdD_lEFU/unsubscribe.
To unsubscribe from this group and all its topics, send an email to django-otp+unsubscribe@googlegroups.com.

[Alpha Wins]

Can you please add a code snippet as to how you've implemented the optional 2FA, cause that's exactly what I've been trying to achieve for the past 3 days, but with no luck :(

On Wednesday, August 30, 2017 at 12:32:12 AM UTC+5:30, Mauricio de Abreu Antunes wrote:

Thanks! I adjusted my code and now I have optional 2FA.

One thing I am stuck is how to generate the qrcode. I got to generate it right but just like django-otp admin my code uses a HttResponse to add it to the template. Does not it makes two consecutive requests? 

Em 29 de ago de 2017 12:06, "Peter Sagerson" <psa...@ignorare.net> escreveu:

Sorry, I think this ended up in my Junk folder.

This should be pretty straightforward. If an authenticated user attempts to access a view that is protected by otp_required(if_configured=True),[1] and they have at least one valid device configured, then they will be redirected to OTP_LOGIN_URL. You probably want to point this to django_otp.views.login,[2] which is smart enough to only ask for the second factor if the user is already authenticated. You'll need to supply the template, of course.

Is there a particular part of this that you're having trouble with?

Thanks,

Peter

[1] http://django-otp-official.readthedocs.io/en/latest/auth.html#authorizing-users

[2] http://django-otp-official.readthedocs.io/en/latest/auth.html#the-easy-way

On Aug 14, 2017, at 5:50 AM, Mauricio de Abreu Antunes <maurici...@gmail.com> wrote:

I read the documentation and I am trying to achieve an optional two factor authentication.

In my case users can opt-in and then I need to show the QR code in order to enable it fully. After that, login will start to have another step. 

First users input email and password, and if they have 2FA enable they are redirected to a page asking the token.

In my case I don't need the device (not my idea here) only the token.

What do you recommend me to do?

--
You received this message because you are subscribed to the Google Groups "django-otp" group.

To unsubscribe from this group and stop receiving emails from it, send an email to django-otp+...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to a topic in the Google Groups "django-otp" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/django-otp/SzgFdD_lEFU/unsubscribe.

To unsubscribe from this group and all its topics, send an email to django-otp+...@googlegroups.com.