2FA / MFA Authentication for users

[sktnetwork]

Hi,
As a security practice, is there a way to put 2FA / MFA based on simple TOTP. e.g. using Google Authenticator?
Maybe a drop in plugin or easy way to put it? Just putting a great idea on roadmap.

[sktnetwork]

Is this expected to be done anytime soon?

[jhuckaby]

Sorry for the lack of response here. Orchestra (Cronicle v2) will ship with SSO support, so you can integrate with OIDC or SAML based providers. The assumption is that your SSO provider would provide MFA on their side. Will this satisfy the need?

[sktnetwork]

Yes, that would also satisfy the need, if it works with SSO, e.g. Login with Microsoft or Google.

[StephaneBONDOIS]

for Entra ID (azure 365) first you need to create a application witch secretid.

client_id" -(yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy)-> ID d'application (client)
aaaaaaaaa-aaaaa-aaaaa-aaaaa-aaaaaaaaaa -> ID de tenant
and you can edite the oauth section on your config.json.
client_secret -> the value of the Secret client (can config on Certificats & secret)

and on your conf/config.json edit the oauth section
"oauth": {
"enabled": true,
"insecure": false,
"client_id": "yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy",
"client_secret": "*********************************************",
"redirect_uri": "https://croniclesi.bt-blue.com/api/user/callback",
"authorize_url": "https://login.microsoftonline.com/aaaaaaaaa-aaaaa-aaaaa-aaaaa-aaaaaaaaaa/oauth2/v2.0/authorize",
"token_url": "https://login.microsoftonline.com/aaaaaaaaa-aaaaa-aaaaa-aaaaa-aaaaaaaaaa/oauth2/v2.0/token",
"user_url": "https://graph.microsoft.com/v1.0/me",
"user_attribute": "userPrincipalName",
"avatar_attribute": null,
"scope": "openid profile email https://graph.microsoft.com/User.Read",
"params": {
"access_type": "offline",
"prompt": "consent"
},
"headers": {
"accept": "application/json",
"content-type": "application/x-www-form-urlencoded"
}
},

[sktnetwork]

Is this already supported in the current Cronicle?

[jhuckaby]

No, Cronicle doesn't support this. I think @StephaneBONDOIS is using an unofficial fork of Cronicle, likely Mike's fork over at: https://github.com/cronicle-edge/cronicle-edge

[StephaneBONDOIS]

yes I use a docker croncible-edge.
it's true @jhuckaby
sorry @sktnetwork
https://github.com/cronicle-edge/cronicle-edge