Two-factor local login option

I use openAM at work and we do authentication at reverse proxy level, using lua on nginx. To integrate with discourse was just a matter of creating one more nginx endpoint that responds to discourse SSO requests, we used lua too, so everything openAM is handled at nginx.

@Lee_Ars I fell here searching for another topic and I’m not really interested in this one, so I have honestly little clue what you’re talking about, but… Just wanted to thank you for mentioning PAM there. I enjoyed reading a few other offtopic bits here. :slight_smile:

Maybe time to bump the HAI GUYS CAN WE 2FA PLZ topic, @codinghorror??

1 Like

As far as I know, it won’t get into the core but as a plugin.

The code was scrambled in this commit. I believe I didn’t think much about sso, invite and many more stuff though (based on the age of this commit).


Is there any update on this?

Since we’re nearing the end of the year I’ll give this thread my yearly “hey @sam we would love 2FA” bump :slight_smile: Duo, Yubi, or just plain ol’ TOTP—anything would be great.


Is there any chance that this is still being looked at?

I think it would be a great option to have. Security and especially 2FA is such an important feature!

Thanks in Advance.

Now it’s a good time to ask @codinghorror about this :smile:


Let’s hope the @codinghorror likes it. I did find this code on how to integrate which uses the U2F FIDO standard.

1 Like

Are there any updates on this? This is still a must have in security for any community, and it’s one of the things I’d love to offer my users.

Perhaps, and we totally love 2fa at Discourse, but none of our paying customers are pushing for it. Keep in mind, if you use Google, you get 2fa for free by the virtue of using Google.


As a customer we think this feature is necessary… if it’s possible to think about it that will be awesome

should we start a campaign to help your paying customers see this thread? :wink:

That reminds me… do you have a “tip jar” somewhere, where community can donate small amounts in $ or BTC?

Yes it is at :slight_smile:


Hopefully, this will be implemented very soon, security is 100% very important too me, even a site setting “Require two factor authentication to enter admin panel” is a great idea. I’m with this idea! :slight_smile:

1 Like

Wondering what the progress has been on this idea. :slight_smile:

Will happen some time in 2018


Can’t wait for some modern 2FA implementations!

Check out the topic below. Lots of great progress being made!