Allow installs to require users add multi-factor auth to their accounts
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	epriestley
	May 17 2014, 1:05 AM

Description

Installs want a way to require users configure MFA. Roughly:

A per-account "this account must always have MFA" flag. This locks the account down so only MFA enrollment may be performed, and prevents removal of the last remaining MFA factor.
Tools for setting the flag (CLI + Web) and removing the flag (CLI).
A CLI tool for reviewing enrollment status (users, flag-or-not, enrolled-or-not).
And probably a global config setting for "all users must enroll".

rP Phabricator
	D9285	rP99c72a32d041 Allow installs to require multi-factor authentication for all users

Mentioned In: T6115: Allow multi-factor authentication to be a requirement for user subgroups, including administrators

epriestley claimed this task.

epriestley raised the priority of this task from to Normal.

epriestley updated the task description. (Show Details)

epriestley added a project: Auth.

security.require-multi-factor-auth seems to satisfy this for now. We can provide more granular alternatives later if use cases arise.