Time based One Time Password (TOTP) is an algorithm that computes a one-time password from a shared secret key and the current time. This is currently use by Google Authenticator or FreeOTP.
LLNG can propose users to register this kind of software to increase authentication level.
Tip
Note that it’s a second factor, not an authentication module. Users are authenticated both by login form and TOTP.
This feature uses libconvert-base32-perl. Before enable it, on Debian you must install libconvert-base32-perl by :
apt update
apt install libconvert-base32-perl
apt install libdigest-hmac-perl
Or from CPAN repository :
cpanm Convert::Base32
In the manager (advanced parameters), you just have to enable it:
Attention
If you want to use a custom rule for “activation” and
want to keep self-registration, you must include this in your rule that
$_2fDevices =~ /"type":\s*"TOTP"/s
is set, else TOTP will be
required even if users are not registered. This is automatically done
when “activation” is simply set to “on”.
Danger
Range is tested backward and forward to prevent positive or negative clock drift.
If you’ve enabled self registration, users can register their keys by using https://portal/2fregisters
If a user loses its key, you can remove it from manager Second Factor
module.// // To enable manager Second Factor Administration Module, set
enabledModules
key in your lemonldap-ng.ini
file :// //
[portal]
enabledModules = conf, sessions, notifications, 2ndFA
If you have another TOTP registration interface, you have to set these keys in Second Factor Devices array (JSON) in your user-database. Then map it to the _2fDevices attribute (see exported variables):
[{"name" : "MyTOTP" , "type" : "TOTP" , "_secret" : "########" , "epoch":"1524078936"}, ...]