Is there a way to require moderators and admins to use two factor authentication?
I thought there was a setting, but cannot find it in the current version.
AI-generated summary
The discussion revolves around requiring two-factor authentication (2FA) for staff in Discourse. nibl initially inquired about the possibility of enforcing 2FA for moderators and admins, but itsbhanusharma replied that no such setting exists. dax mentioned that while it’s not possible to require 2FA, admins can see which staff members have enabled it.
jomaxro proposed implementing a feature to enforce 2FA for staff, with options to set it for none, admins, staff, or all. The suggested process involves redirecting users without 2FA to the configuration page, where they must set it up before accessing other features. jomaxro later confirmed that this suggestion was added to the list for Discourse version 2.3. The feature was eventually implemented in March 2019, as seen in jomaxro’s follow-up post.
I don’t think such a setting exists!
But it may exist in future.
7 Likes
Moved this topic to Contribute > Feature. I recently enabled mandatory 2FA on our mattermost server and I really like how it worked. I think we could do this quite nicely in Discourse by following a similar process:
- Admin enables site setting
enforce 2FA:staff - If other staff users are logged in, and have 2FA configured, great! Nothing to do here.
- If other staff users are logged in, but do not have 2FA configured, redirect them to 2FA configuration page. Users cannot do anything else (except log out) until they’ve configured 2FA.
- If other staff users are logged out, upon next login immediately redirect them to 2FA configuration page. Users cannot do anything else (except log out) until they’ve configured 2FA.
Other valid options for the site setting would be none, admins, and all. I think in most cases (especially public boards) all is overkill, but I could see this as a benefit for internal sites.
13 Likes
Thanks again for the suggestion @nibl. This is now on the list to be included in Discourse Version 2.3 (list always subject to change).
6 Likes
This was added in March 2019.
https://review.discourse.org/t/feature-enforce-two-factor-authentication-6348/2198
5 Likes