Matthias Mair
4121d9a8a5
* fix basic auth without mfa * refactor order to use new basic auth class * remove session auth taht would bybpass mfa (mfa thing fixed in another session) * allign with other PRs prep for merge with https://github.com/inventree/InvenTree/pull/13169/ * fix schema generation
1.6 KiB
title
| title |
|---|
| InvenTree Multi Factor Authentication |
Multi Factor Authentication
InvenTree gives the option to use TOTP or statically generated backup tokens as an additional factor to password or SSO authentication. This is a widely adopted security feature on enterprise web services. We highly encourage to enable it if you expose your instance to the public internet.
As TOTP is an open standard there are a lot of different ways to hold your key and generate the time based tokens needed for authentication. That ranges from physical devices to password managers and mobile apps. We do not advertise any method but recommend to keep password and token generator separate from each other.
Configuration
To make MFA mandatory for all users:
- Enable it in the global settings.
Security Consideration
Password based basic authentication against the API is refused for users with MFA configured, and for all users while MFA is enforced. API clients should use tokens (generated in the user interface) or OAuth2 instead.
A user can lock themselves out if they lose access to both the device with their TOTP app and their backup tokens. An admin can delete their tokens from the Database Admin interface (they exist under the 'TOTP devices' / 'static devices' models). This should be a last resort and only done by people knowledgeable about the Database Admin interface, as changes there might circumvent InvenTree's business and security logic.