3.0.8

Disable Google MFA for specific user (#3595)
nilsteampassnet · May 21, 2023 · 9c505fb · 9c505fb
1 parent 884efa4
commit 9c505fb
Show file tree

Hide file tree

Showing 70 changed files with 2,675 additions and 32 deletions.
diff --git a/docs/_media/tp3_auth_mfa_1.png b/docs/_media/tp3_auth_mfa_1.png
diff --git a/docs/_media/tp3_auth_mfa_2.png b/docs/_media/tp3_auth_mfa_2.png
diff --git a/docs/_media/tp3_auth_mfa_3.png b/docs/_media/tp3_auth_mfa_3.png
diff --git a/docs/_media/tp3_auth_mfa_4.png b/docs/_media/tp3_auth_mfa_4.png
diff --git a/docs/features/authentication.md b/docs/features/authentication.md
@@ -57,4 +57,32 @@ Depending of the AD type and your users annuary configuration, the next keys nee
 * __Local and LDAP users__ - If LDAP authentication is enabled, only users synchronized with AD remote server will be allowed to log in Teampass. Locally managed users will by default be rejected. With this option enabled, both kind of users can be allowed to log in Teampass.
 * __AD user roles mapped with their AD groups (1)__ - When enabled, Administrator will be able to map existing AD Groups with local Teampass roles. By doing so, any AD user belonging with one of this AD group will automatically be promoted to the mapped Teampass role.
 * __Hide forgot password link on Home page__ - If LDAP authentication is enabled, you should disable forgot password feature but it can be enabled for locally managed users.
-* __AD user to get created automatically__ - Valid AD user will have an account automatically created in Teampass and his AD groups mapped with corresponding Teampass roles.
+* __AD user to get created automatically__ - Valid AD user will have an account automatically created in Teampass and his AD groups mapped with corresponding Teampass roles.
+
+
+## Multi Factor Authentication (MFA)
+
+> User authentication can be completed with an MFA protocol. Currently, `Google Authentication` and `DUO Security` can be enabled for users.
+
+### Setting up
+
+As an Administrator, select the `Settings \ MFA` option in the left menu.
+
+![Settings tasks options](../_media/tp3_auth_mfa_1.png)
+
+### Generalities
+
+🔔 Once an MFA protocol is enabled, the MFA code is mandatory for each user to get authenticated in Teampass. 2 exceptions are possible.
+
+👉 Administrator users can have this rule disabled globally using dedicated option.
+
+![Settings tasks options](../_media/tp3_auth_mfa_2.png)
+
+👉 By default, each user has to authenticated with an MFA code. But this can be disabled through the user form inside page `Users` using the input `MFA enabled`.
+
+![Settings tasks options](../_media/tp3_auth_mfa_4.png)
+
+If disabled for a user, a red fingerprint symbol is shown in the users list.
+
+![Settings tasks options](../_media/tp3_auth_mfa_3.png)
+
diff --git a/includes/config/include.php b/includes/config/include.php
@@ -15,8 +15,8 @@
  *
  * @see      http://www.teampass.net
  */
-define('TP_VERSION', '3.0.7');
-define("UPGRADE_MIN_DATE", "1681998259");
+define('TP_VERSION', '3.0.8');
+define("UPGRADE_MIN_DATE", "1684663811");
 define('TP_TOOL_NAME', 'Teampass');
 define('TP_ONE_DAY_SECONDS', 86400);
 define('TP_ONE_WEEK_SECONDS', 604800);

diff --git a/includes/language/bulgarian.php b/includes/language/bulgarian.php
@@ -1075,5 +1075,7 @@
     'email_body_user_config_5' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Keys encryption is now finished. Following code is expected next time using Teampass:<br><br><b>#code#</b><br><br><br>Cheers',
     'email_body_user_config_6' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Following credentials are expected next time using Teampass:<ul><li>login: #login#</li><li>Password: #password#</li></ul><br><br><br>Cheers',
     'error_data_not_valid' => 'Data is not valid',
+    'mfa_enabled' => 'MFA enabled',
+    'mfa_disabled_for_user' => 'MFA disabled for user',
 
 );
diff --git a/includes/language/catalan.php b/includes/language/catalan.php
@@ -1075,5 +1075,7 @@
     'email_body_user_config_5' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Keys encryption is now finished. Following code is expected next time using Teampass:<br><br><b>#code#</b><br><br><br>Cheers',
     'email_body_user_config_6' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Following credentials are expected next time using Teampass:<ul><li>login: #login#</li><li>Password: #password#</li></ul><br><br><br>Cheers',
     'error_data_not_valid' => 'Data is not valid',
+    'mfa_enabled' => 'MFA enabled',
+    'mfa_disabled_for_user' => 'MFA disabled for user',
 
 );
diff --git a/includes/language/chinese.php b/includes/language/chinese.php
@@ -1075,5 +1075,7 @@
     'email_body_user_config_5' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Keys encryption is now finished. Following code is expected next time using Teampass:<br><br><b>#code#</b><br><br><br>Cheers',
     'email_body_user_config_6' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Following credentials are expected next time using Teampass:<ul><li>login: #login#</li><li>Password: #password#</li></ul><br><br><br>Cheers',
     'error_data_not_valid' => 'Data is not valid',
+    'mfa_enabled' => 'MFA enabled',
+    'mfa_disabled_for_user' => 'MFA disabled for user',
 
 );
diff --git a/includes/language/czech.php b/includes/language/czech.php
@@ -1075,5 +1075,7 @@
     'email_body_user_config_5' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Keys encryption is now finished. Following code is expected next time using Teampass:<br><br><b>#code#</b><br><br><br>Cheers',
     'email_body_user_config_6' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Following credentials are expected next time using Teampass:<ul><li>login: #login#</li><li>Password: #password#</li></ul><br><br><br>Cheers',
     'error_data_not_valid' => 'Data is not valid',
+    'mfa_enabled' => 'MFA enabled',
+    'mfa_disabled_for_user' => 'MFA disabled for user',
 
 );
diff --git a/includes/language/dutch.php b/includes/language/dutch.php
@@ -1075,5 +1075,7 @@
     'email_body_user_config_5' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Keys encryption is now finished. Following code is expected next time using Teampass:<br><br><b>#code#</b><br><br><br>Cheers',
     'email_body_user_config_6' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Following credentials are expected next time using Teampass:<ul><li>login: #login#</li><li>Password: #password#</li></ul><br><br><br>Cheers',
     'error_data_not_valid' => 'Data is not valid',
+    'mfa_enabled' => 'MFA enabled',
+    'mfa_disabled_for_user' => 'MFA disabled for user',
 
 );
diff --git a/includes/language/english.php b/includes/language/english.php
@@ -16,6 +16,8 @@
  * @see       https://www.teampass.net
  */
 return array(
+    'mfa_enabled' => 'MFA enabled',
+    'mfa_disabled_for_user' => 'MFA disabled for user',
     'error_data_not_valid' => 'Data is not valid',
     'new_user_info_by_mail' => 'New user will receive an email with his credentials',
     'login_credentials' => 'Login credentials',

diff --git a/includes/language/estonian.php b/includes/language/estonian.php
@@ -1075,5 +1075,7 @@
     'email_body_user_config_5' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Keys encryption is now finished. Following code is expected next time using Teampass:<br><br><b>#code#</b><br><br><br>Cheers',
     'email_body_user_config_6' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Following credentials are expected next time using Teampass:<ul><li>login: #login#</li><li>Password: #password#</li></ul><br><br><br>Cheers',
     'error_data_not_valid' => 'Data is not valid',
+    'mfa_enabled' => 'MFA enabled',
+    'mfa_disabled_for_user' => 'MFA disabled for user',
 
 );
diff --git a/includes/language/french.php b/includes/language/french.php
@@ -1075,5 +1075,7 @@
     'email_body_user_config_5' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Keys encryption is now finished. Following code is expected next time using Teampass:<br><br><b>#code#</b><br><br><br>Cheers',
     'email_body_user_config_6' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Following credentials are expected next time using Teampass:<ul><li>login: #login#</li><li>Password: #password#</li></ul><br><br><br>Cheers',
     'error_data_not_valid' => 'Donnée non valide',
+    'mfa_enabled' => 'AMF activée',
+    'mfa_disabled_for_user' => 'AMF désactivée pour l&apos;utilisateur',
 
 );
diff --git a/includes/language/german.php b/includes/language/german.php
@@ -1075,5 +1075,7 @@
     'email_body_user_config_5' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Keys encryption is now finished. Following code is expected next time using Teampass:<br><br><b>#code#</b><br><br><br>Cheers',
     'email_body_user_config_6' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Following credentials are expected next time using Teampass:<ul><li>login: #login#</li><li>Password: #password#</li></ul><br><br><br>Cheers',
     'error_data_not_valid' => 'Data is not valid',
+    'mfa_enabled' => 'MFA enabled',
+    'mfa_disabled_for_user' => 'MFA disabled for user',
 
 );
diff --git a/includes/language/greek.php b/includes/language/greek.php
@@ -1075,5 +1075,7 @@
     'email_body_user_config_5' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Keys encryption is now finished. Following code is expected next time using Teampass:<br><br><b>#code#</b><br><br><br>Cheers',
     'email_body_user_config_6' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Following credentials are expected next time using Teampass:<ul><li>login: #login#</li><li>Password: #password#</li></ul><br><br><br>Cheers',
     'error_data_not_valid' => 'Data is not valid',
+    'mfa_enabled' => 'MFA enabled',
+    'mfa_disabled_for_user' => 'MFA disabled for user',
 
 );
diff --git a/includes/language/hungarian.php b/includes/language/hungarian.php
@@ -1075,5 +1075,7 @@
     'email_body_user_config_5' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Keys encryption is now finished. Following code is expected next time using Teampass:<br><br><b>#code#</b><br><br><br>Cheers',
     'email_body_user_config_6' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Following credentials are expected next time using Teampass:<ul><li>login: #login#</li><li>Password: #password#</li></ul><br><br><br>Cheers',
     'error_data_not_valid' => 'Data is not valid',
+    'mfa_enabled' => 'MFA enabled',
+    'mfa_disabled_for_user' => 'MFA disabled for user',
 
 );
diff --git a/includes/language/italian.php b/includes/language/italian.php
@@ -1075,5 +1075,7 @@
     'email_body_user_config_5' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Keys encryption is now finished. Following code is expected next time using Teampass:<br><br><b>#code#</b><br><br><br>Cheers',
     'email_body_user_config_6' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Following credentials are expected next time using Teampass:<ul><li>login: #login#</li><li>Password: #password#</li></ul><br><br><br>Cheers',
     'error_data_not_valid' => 'Data is not valid',
+    'mfa_enabled' => 'MFA enabled',
+    'mfa_disabled_for_user' => 'MFA disabled for user',
 
 );
diff --git a/includes/language/japanese.php b/includes/language/japanese.php
@@ -1075,5 +1075,7 @@
     'email_body_user_config_5' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Keys encryption is now finished. Following code is expected next time using Teampass:<br><br><b>#code#</b><br><br><br>Cheers',
     'email_body_user_config_6' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Following credentials are expected next time using Teampass:<ul><li>login: #login#</li><li>Password: #password#</li></ul><br><br><br>Cheers',
     'error_data_not_valid' => 'Data is not valid',
+    'mfa_enabled' => 'MFA enabled',
+    'mfa_disabled_for_user' => 'MFA disabled for user',
 
 );
diff --git a/includes/language/norwegian.php b/includes/language/norwegian.php
@@ -1075,5 +1075,7 @@
     'email_body_user_config_5' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Keys encryption is now finished. Following code is expected next time using Teampass:<br><br><b>#code#</b><br><br><br>Cheers',
     'email_body_user_config_6' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Following credentials are expected next time using Teampass:<ul><li>login: #login#</li><li>Password: #password#</li></ul><br><br><br>Cheers',
     'error_data_not_valid' => 'Data is not valid',
+    'mfa_enabled' => 'MFA enabled',
+    'mfa_disabled_for_user' => 'MFA disabled for user',
 
 );
diff --git a/includes/language/polish.php b/includes/language/polish.php
@@ -1075,5 +1075,7 @@
     'email_body_user_config_5' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Keys encryption is now finished. Following code is expected next time using Teampass:<br><br><b>#code#</b><br><br><br>Cheers',
     'email_body_user_config_6' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Following credentials are expected next time using Teampass:<ul><li>login: #login#</li><li>Password: #password#</li></ul><br><br><br>Cheers',
     'error_data_not_valid' => 'Data is not valid',
+    'mfa_enabled' => 'MFA enabled',
+    'mfa_disabled_for_user' => 'MFA disabled for user',
 
 );
diff --git a/includes/language/portuguese.php b/includes/language/portuguese.php
@@ -1075,5 +1075,7 @@
     'email_body_user_config_5' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Keys encryption is now finished. Following code is expected next time using Teampass:<br><br><b>#code#</b><br><br><br>Cheers',
     'email_body_user_config_6' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Following credentials are expected next time using Teampass:<ul><li>login: #login#</li><li>Password: #password#</li></ul><br><br><br>Cheers',
     'error_data_not_valid' => 'Data is not valid',
+    'mfa_enabled' => 'MFA enabled',
+    'mfa_disabled_for_user' => 'MFA disabled for user',
 
 );
diff --git a/includes/language/portuguese_br.php b/includes/language/portuguese_br.php
@@ -1075,5 +1075,7 @@
     'email_body_user_config_5' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Keys encryption is now finished. Following code is expected next time using Teampass:<br><br><b>#code#</b><br><br><br>Cheers',
     'email_body_user_config_6' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Following credentials are expected next time using Teampass:<ul><li>login: #login#</li><li>Password: #password#</li></ul><br><br><br>Cheers',
     'error_data_not_valid' => 'Data is not valid',
+    'mfa_enabled' => 'MFA enabled',
+    'mfa_disabled_for_user' => 'MFA disabled for user',
 
 );
diff --git a/includes/language/romanian.php b/includes/language/romanian.php
@@ -1075,5 +1075,7 @@
     'email_body_user_config_5' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Keys encryption is now finished. Following code is expected next time using Teampass:<br><br><b>#code#</b><br><br><br>Cheers',
     'email_body_user_config_6' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Following credentials are expected next time using Teampass:<ul><li>login: #login#</li><li>Password: #password#</li></ul><br><br><br>Cheers',
     'error_data_not_valid' => 'Data is not valid',
+    'mfa_enabled' => 'MFA enabled',
+    'mfa_disabled_for_user' => 'MFA disabled for user',
 
 );
diff --git a/includes/language/russian.php b/includes/language/russian.php
@@ -1076,5 +1076,7 @@
     'email_body_user_config_5' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Keys encryption is now finished. Following code is expected next time using Teampass:<br><br><b>#code#</b><br><br><br>Cheers',
     'email_body_user_config_6' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Following credentials are expected next time using Teampass:<ul><li>login: #login#</li><li>Password: #password#</li></ul><br><br><br>Cheers',
     'error_data_not_valid' => 'Data is not valid',
+    'mfa_enabled' => 'MFA enabled',
+    'mfa_disabled_for_user' => 'MFA disabled for user',
 
 );
diff --git a/includes/language/spanish.php b/includes/language/spanish.php
@@ -1075,5 +1075,7 @@
     'email_body_user_config_5' => 'Hola #lastname#,<br><br>Este es un correo electrónico generado por Teampass.<br><br>El cifrado de claves ya ha finalizado. Se espera el siguiente código la próxima vez que use Teampass:<br><br><b>#code#</b><br><br>Saludos.',
     'email_body_user_config_6' => 'Hola #lastname#,<br><br>Este es un correo electrónico generado por Teampass.<br><br>Se esperan las siguientes credenciales la próxima vez que use Teampass:<br><br><ul><li>Usuario: #login#</li><li>Contraseña: #contraseña#</li></ul><br><br>Saludos.',
     'error_data_not_valid' => 'Data is not valid',
+    'mfa_enabled' => 'MFA enabled',
+    'mfa_disabled_for_user' => 'MFA disabled for user',
 
 );
diff --git a/includes/language/swedish.php b/includes/language/swedish.php
@@ -1075,5 +1075,7 @@
     'email_body_user_config_5' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Keys encryption is now finished. Following code is expected next time using Teampass:<br><br><b>#code#</b><br><br><br>Cheers',
     'email_body_user_config_6' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Following credentials are expected next time using Teampass:<ul><li>login: #login#</li><li>Password: #password#</li></ul><br><br><br>Cheers',
     'error_data_not_valid' => 'Data is not valid',
+    'mfa_enabled' => 'MFA enabled',
+    'mfa_disabled_for_user' => 'MFA disabled for user',
 
 );
diff --git a/includes/language/turkish.php b/includes/language/turkish.php
@@ -1075,5 +1075,7 @@
     'email_body_user_config_5' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Keys encryption is now finished. Following code is expected next time using Teampass:<br><br><b>#code#</b><br><br><br>Cheers',
     'email_body_user_config_6' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Following credentials are expected next time using Teampass:<ul><li>login: #login#</li><li>Password: #password#</li></ul><br><br><br>Cheers',
     'error_data_not_valid' => 'Data is not valid',
+    'mfa_enabled' => 'MFA enabled',
+    'mfa_disabled_for_user' => 'MFA disabled for user',
 
 );
diff --git a/includes/language/ukrainian.php b/includes/language/ukrainian.php
@@ -1075,5 +1075,7 @@
     'email_body_user_config_5' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Keys encryption is now finished. Following code is expected next time using Teampass:<br><br><b>#code#</b><br><br><br>Cheers',
     'email_body_user_config_6' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Following credentials are expected next time using Teampass:<ul><li>login: #login#</li><li>Password: #password#</li></ul><br><br><br>Cheers',
     'error_data_not_valid' => 'Data is not valid',
+    'mfa_enabled' => 'MFA enabled',
+    'mfa_disabled_for_user' => 'MFA disabled for user',
 
 );
diff --git a/includes/language/vietnamese.php b/includes/language/vietnamese.php
@@ -1075,5 +1075,7 @@
     'email_body_user_config_5' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Keys encryption is now finished. Following code is expected next time using Teampass:<br><br><b>#code#</b><br><br><br>Cheers',
     'email_body_user_config_6' => 'Hello #lastname#,<br><br>This is a generated email from Teampass passwords manager.<br><br>Following credentials are expected next time using Teampass:<ul><li>login: #login#</li><li>Password: #password#</li></ul><br><br><br>Cheers',
     'error_data_not_valid' => 'Data is not valid',
+    'mfa_enabled' => 'MFA enabled',
+    'mfa_disabled_for_user' => 'MFA disabled for user',
 
 );
diff --git a/install/install.queries.php b/install/install.queries.php
@@ -780,6 +780,7 @@ function encryptFollowingDefuse($message, $ascii_key)
                             `otp_provided` BOOLEAN NOT NULL DEFAULT FALSE,
                             `roles_from_ad_groups` varchar(1000) NULL,
                             `ongoing_process_id` VARCHAR(100) NULL,
+                            `mfa_enabled` tinyint(1) NOT null DEFAULT '1',
                             PRIMARY KEY (`id`),
                             UNIQUE KEY `login` (`login`)
                             ) CHARSET=utf8;"