Commits on Nov 24, 2023

1. Support requiring 2FA for authentication, checked with isEnrolledIn2Sv …

   Using Google's Admin SDK Directory API we can check the `isEnrolledIn2Sv`
   field on the Directory API User entity (https://developers.google.com/admin-sdk/directory/reference/rest/v1/users)
   to accurately obtain the 2FA status of a user.
   
   At the Guardian, in the past, we've checked the user for membership of the
   `2fa_enforce@guardian.co.uk` Google Group, as a proxy for being able to
   directly check the 2FA status of the user. The Google Group was manually
   administered, so suffered from reconciliation issues, and no longer
   corresponds to our onboarding process.
   
   Now, if you supply a `TwoFactorAuthChecker` to the `GoogleAuthConfig`,
   the 2FA status of the user will be checked at the point of authentication,
   and rejected if `isEnrolledIn2Sv` is false - only users with 2FA will be
   allowed to authenticate.

   

   rtyley committed Nov 24, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for e6cef99
   • Browse repository at this point

   Copy the full SHA

   e6cef99 View commit details

   Browse the repository at this point in the history