A2FA (Another 2-Factor Auth)

Hello, first of all thank you for maintaining this plugin. I wonder if it would be possible to activate the plugin for all users and make it manditory to use 2FA for login. Are there any plans for implementing this in the future? Love to hear from you, thank you in advance.

I was wondering if someone could help me out with this, having a bit of a problem trying to use this plugin. I followed the install directions for the plugin, but when I go to access my login page "mysite.com/auth/a2fa/login.php" it keeps coming back with the page isn't working, "ERR_EMPTY_RESPONSE". Just wondering if there is a permission setting I'm missing somewhere to get this to work?

Hi - will this plugin be updated to work with Moodle V3.8 or does it work with V3.8 now ? Grateful for any feedback - thank you.

This plugin does not work for current LTS version 3.5.9 unfortunately.

I thank Rajeshwar for the helpful comment of 21 Aug 2019.
Good news: I successfully set up the Moodle Android app for a2fa under Moodle 3.7.2.
Under Site administration/Mobile App/Mobile settings I set
Enable web services for mobile devices = Yes
Under Mobile authenticatation I set:
login = via an embedded browser
N. B. Leave "URL scheme" empty.
One extra detail:
You then need to add the following line to Moodle's config.php:
$CFG->alternateloginurl = 'https:///auth/a2fa/login.php';
Then all logins will be directed to the a2fa login page.
To gain access via the app, the user has to type in the full path to the moodle root. The 'https://' preceding the URL is optional as the app will prefer https over http.
Then the login works even via the embedded browser, which gives the most consistent user interface.
N.B. If some users still use manual login, you should set
login = "Via a browser window (for SSO plugin).
In this case, an external browser will be opened and the user has to manually navigate to the correct login URL, i. e. 'https:///auth/a2fa/login.php';

There is one configuration glitch that server administrator MUST avoid:
When creating the custom profile field "a2fasecret" you MUST choose:
Short name = "a2fasecret", Name = "a2fasecret" ... Who is this field visible to? = "Visible to user". If the setting is left at the default which is "Visible to everyone" than EVERYONE looking at my user profile in Moodle will see my a2fa secret QR-code.

The a2fa plugin is superbe! It saved our day. I am just coming out of a meeting with our IT security people: They insist that 2-factor be mandatory on our server. Without a2fa I could pack in now, but with a2fa we meet all IT security requirements. The only major snag: I do not get the Moodle Android app to work, even if I choose the setting mobile authentication to "Via an Embedded Browser (for SSO plugins)". If i made no error testing, this is a bug that needs to be fixed in the medium term.

I'm not 100% sure if the secret key is stored in plain text but it looks like it. If that's the case it would be really good if it was stored encrypted(for better security).
It would also be good if the qr generation was local(for better privacy), with something like PHP QR Code or even node-qrcode as a last resort.
It would be nice to also have longer secret keys and a stronger lookup table(for extra security).

We are using Moodle 3.5.1 and using users are using iOS as well as Android. I think we tested the Windows app last year as well but did not deploy. I'm not sure if there has been any change in 3.7

You don't need to do anything on the app.
You would need to change the mobile authentication under Site Administration to "Via an Embedded Browser (for SSO plugins)". When you do this, the mobile app opens up the required page for logging in with username, password and token. What it does is points the login to the page you have chosen which is auth/a2fa/login.php

You don't need to do anything on the app.
You would need to change the mobile authentication under Site Administration to "Via an Embedded Browser (for SSO plugins)". When you do this, the mobile app opens up the required page for logging in with username, password and token. What it does is points the login to the page you have chosen which is auth/a2fa/login.php

Question to Rajeshwar Devi Prasad:
How do you do this in the Android app? I do not find any corresponding setting that would change the behaviour of the app. There is however a workaround: Log in via your user account while authentication is still set to manual. Then upgrade your account with A2FA. The app will still connect with the Moodle server. There is no major risk involved as all site administration tasks are not available via the app, and if you launch the web view from the app you have to log on as usual.

For the post by Martin, we are using Moodle 3.5.1 with A2FA plugin and use the mobile app on iOS as well as Android. I am not sure if there is any restriction on 3.7

There are two issues that I am having: one is that the Change Password in Moodle does not allow entry of a token to change the password. To overcome this, I am using the Forgot Password in the login page. It will be nice for the user to click Change Password and change his password using his login credentials including token.
The other issue is about the Generate New Secret on the create a new user page. This button apparently works only for admin level permissions. We have a situation where Managers have been given the right to register new users but with the A2FA plugin, they cannot because the Generate Secret button doesn't generate the mix of characters in the box for the registration to complete.
Any fix for these two issues?

Yes, you can use the plugin with the mobile app. You would need to change the mobile authntication to "Via an Embedded Browser (for SSO plugins)". When you do this, the mobile app opens up the required page for logging in with username, password and token.