How to implement the newly built 2fa

[Amala4]

I had wanted to use django-allauth-2fa but I saw that Django all-auth now has the same feature inbuilt, however, there is no explanation anywhere on how to implement the newly added 2fA feature. The documentation just barely scratches on the feature. Could someone who has been successful with it be kind enough to point me to somewhere I can get information on how to implement it in my project? I have already successfully integrated Django all-auth for both regular and social accounts. Or is it still at the early stages and not ready for usage

[pennersr]

It really should only be a matter of pip install django-allauth[mfa] followed by adding "allauth.mfa" to your INSTALLED_APPS.

[derek-adair]

@Amala4 beyond the configuration/installation, is there anything in particular you are confused about or any specific features/configs you need elaborated on?

I agree it is pretty sparse. One of the things i think it needs is an elaboration on the views. Also the adapter docs are non existent.

[Amala4]

Just to be clear this fits into my use case. I just want an email based OTP where a code is sent to user email, which he inputs and logs in

[derek-adair]

What is your question or problem you are having implementing it?

[pennersr]

Your email address is typically part of your first factor, so I am not sure how you regard sending a code to an email address as Two-Factor Authentication?

[josylad]

hi,
I think what you are looking for is Django OTP - https://django-otp-official.readthedocs.io/en/stable/

[julianwachholz]

OP is specifically referring to allauth's MFA module

[mecampbellsoup]

Does anyone have a high-level summary of the flows that users will take through the new allauth MFA views?

e.g.

1. /accounts/2fa/authenticate/ allauth.mfa.views.AuthenticateView mfa_authenticate (to ... authenticate I guess?)
2. /accounts/2fa/totp/activate/ allauth.mfa.views.ActivateTOTPView mfa_activate_totp (to present a code that satisfies the TOTP challenge)

Is there a view that I hit to generate the QR code they scan though, so their OTP app/client generates a code that they then submit to mfa_authenticate view?

[pennersr]

Have a look at that ActivateTOTPView:

django-allauth/allauth/mfa/views.py

Line 117 in 8281bd7

totp_svg = totp.build_totp_svg(totp_url)

That view is the one generating the QR code.

[mecampbellsoup]

Hmmm I was expecting to see some sort of ConfirmTOTPView, where, after scanning the QR code returned from ActivateTOTPView, the user supplies a valid TOTP code thus confirming that the MFA should be set/confirmed... is that not the workflow though?