MFA / TOTP support ?

[maximelebastard]

Currently with v2, is there any way to support multi factor authentication in addition to the username/password credentials ?

By MFA, I mean these 4 factors:

• A temporary code generated by an application like Google Authenticator with the TOTP protocol. This implies devices pairing support and storing users TOTP secrets
• A list of emergency secrets given to the user at pairing time and allowing autonomous account recovery in case of device loss. This implies storing these codes.
• A temporary code sent to the user by any channel (mostly text messages). This implies storing arbitrary messaging data to send the message (ie. the user's phone number), handling expiration of this data (a phone number can be affected to someone else after a few years) and probably anti brute-force mesures (looping on the sms sending can cost a lot of money)
• A webauthn factor to get another login factor directly from the web browser. This would be mostly a fingerprint sensor or a Yubikey. This implies storing a public key associated to the user account.

Among these features, what is currently available ?

Would you be willing to implement this and do you have guidelines or thoughts about it ?

Would that be available directly on Lucia or could this be a separate module or library ?

[maximelebastard]

I made a RFC :)
#883