Feature Request - 2FA Remember me

alessandrobozzo

The idea of the FIDO keys is excellent, we also use it successfully to access Microsoft 365 for example. At the moment for ITFLOW at least the possibility that for 14 days on the device you always use is not required MFA every time during the day would be sufficient it happens to insert it even 7/8 times.

johnny

First step we just added a remember me option on the login page, more to come tommarow

see here

itflow-org/itflow3f2f405

psiiota

This does not seem to be working in mobile on chrome.

wrongecho

psiiota

Can you share an image of what you see instead of the button?

psiiota

Aah, I missed this was not yet working.

johnny

Its finally official Remember me is fully working and wont have to enter your MFA for up to 14 days if selected during login. Please let us know if you find bugs

See here:

itflow-org/itflow0d6c58f

Bigbug

johnny why does the "remember me" checkbox appear twice?

I think it should only appear in the 2fa view

Makes sense?

Bigbug

I also think that the admin should be able to decide how long "remember me" should be

Bigbug

Also I think you should change to this one with the ✔️ because it looks better

johnny

Moved Remember me to MFA Screen only

See:

itflow-org/itflow90bb949

Im not sure why the checkbox looks that way on the login screen, its a standard check everywhere else.

It may be a static ADminLTE CSS style for the login class page, but I dont mess with that CSS as like to keep that close to default as possible

wrongecho

Do we have the ability to clear remembered 2FA sessions? Use case being potential account compromise.

johnny

no but this can be easily added by nulling out the user config remember me token, ill add this function also we can give the user ability to do so via their user profile

johnny

Added the ability to revoke Remember Me for a user although still need to work on the UI a bit

itflow-org/itflowb3c37b6

EduLangy

Thought I'd tag this on here as it's quite new, rather than creating a bug thread.

The Remember Me checkbox on the MFA page doesn't seem to work on for us - after entering OTP code, checking the box and pressing Sign In, we get this HTTP 500 error.

Signing in with OTP without Remember Me works fine. This seems to be the case with any user account.

Is this something known about that I've missed, or something broken our end? It's a bog standard install on Ubuntu with script installation, updated today to the latest version.

I'm not a pro with php/whatever but I can probably find logs if someone can point me the right way.

This is the only slightly annoying 'bug' i've found yet with ITFlow after a week of live use, coming from ITGlue. Great job 🙂

wrongecho

EduLangy

Thanks for raising. I'm unable to replicate on my test instance.

Would you be able to provide relevant error logs please? You should be able to run tail -F /var/log/apache2/error.log and then attempt the sign in with 2FA remember me to see what's going wrong.

EduLangy

Thanks, that's turned up stuff that looks relevant:

[Fri Dec 01 14:32:14.601761 2023] [php:warn] [pid 49245] [client 172.20.2.23:52794] PHP Warning: Undefined array key "important" in /var/www/itflow.<mydomain>.uk/post/client_logins_model.php on line 10, referer: https://itflow.<mydomain>.uk/client_logins.php?client_id=4

[Fri Dec 01 14:32:14.800211 2023] [php:warn] [pid 41181] [client 172.20.3.12:37440] PHP Warning: Undefined array key "user_config_remember_me_token" in /var/www/itflow.<mydomain>.uk/login.php on line 114, referer: https://itflow.<mydomain>.uk/login.php?key=

[Fri Dec 01 14:32:14.800411 2023] [php:error] [pid 41181] [client 172.20.3.12:37440] PHP Fatal error: Uncaught mysqli_sql_exception: Unknown column 'user_config_remember_me_token' in 'field list' in /var/www/itflow.<mydomain>.uk/login.php:131\nStack trace:\n#0 /var/www/itflow.<mydomain>.uk/login.php(131): mysqli_query()\n#1 {main}\n thrown in /var/www/itflow.<mydomain>.uk/login.php on line 131, referer: https://itflow.<mydomain>.uk/login.php?key=

As mentioned it's a fresh install as per the docs, here's a history.

johnny

This will affect new installs since Nov 21st as I forgot to Dump the latest DB with the remembermetoken field

This did not affect existing installs, just new installs since then

This Commit fixes the new installs

itflow-org/itflow7d0813a

@EduLangy You have two option manually add

`user_config_remember_me_token` varchar(255) DEFAULT NULL,

after user role in the user_setting table or blow away your install and start fresh

wrongecho

@EduLangy - Do you have phpMyAdmin installed? If not, it may be worth adding to make this schema edit.

This isn't a common occurrence (possibly the 1st time it's happened) so you can remove afterwards.

ALTER TABLE `user_settings` ADD `user_config_remember_me_token` VARCHAR(255) NULL DEFAULT NULL AFTER `user_role`;

EduLangy

I'll have a play today. Thanks both!

« Previous Page