# Second Factors

Two-Factor Authentication (as known as 2FA) is a kind (subset) of multi-factor authentication. It is a method to confirm a user's claimed identity by using a combination of two different factors between:

1. something they know (login / password, …)
2. something they have (U2F Key, smartphone, …)
3. something they are (biometrics like fingerprints, ...)

Since 2.0, LLNG provides some second factor plugins that can be used to complete authentication module with 2FA :

- U2F-or-TOTP (enable both U2F and TOTP)
- TOTP (to use with FreeOTP, Google-Authenticator,…)
- U2F tokens
- Yubikey tokens provide by Yubico
- E-Mail 2F (Send a code to an email address)
- External 2F (to call an external command)
- REST (Remote REST app)
- RADIUS (Remote RADIUS server)

The E-Mail, External and REST 2F modules may be declared multiple times with different sets of parameters.

If you want to force a 2F registration on first login, you can use 'Require 2FA'. You can also use a rule to force 2FA registration only for some users.
You can display a message if an expired second factor has been removed by enabling 'Display a message if an expired SF is removed' option or setting a rule.
Link to second factor Manager is automatically display if at least a SFA module is enabled. You can set a rule to display or not the link.

## Providing tokens from an external source

If you don't want to use self-registration features for U2F, TOTP and so on, you can set tokens by yourself (in your LDAP server for example) and map it to `_2fDevices` attribute. `_2fDevices` is a JSON array that contains token descriptions :

    [ {"type" : "TOTP", "name" : "MyTOTP", …}, {<other_token>}, …]

### U2F Tokens

    {"name" : "MyU2FKey" , "type" : "U2F" , "_userKey" : "########" , "_keyHandle":"########" , "epoch":"1524078936"}

### TOTP Tokens

    {"name" : "MyTOTP" , "type" : "TOTP" , "_secret" : "########" , "epoch" : "1523817955"}

### Yubikey Tokens

    {"name" : "MyYubikey" , "type" : "UBK" , "_yubikey" : "########" , "epoch" : "1523817715"}

## Developer corner

To develop a new 2FA plugin, read `Lemonldap::NG::Portal::Main::SecondFactor (3pm)` manpage. Your 2F module must be a Perl class named `Lemonldap::NG::Portal::2F::<custom_name>`. To enable it, set `available2F` key in your `lemonldap-ng.ini` file :

    [portal]
    available2F = U2F,TOTP,<custom_name>

To enable manager Second Factor Administration Module, set `enabledModules` key in your `lemonldap-ng.ini` file :

    [portal]
    enabledModules = conf, sessions, notifications, 2ndFA