diff --git a/.env.development b/.env.development index f4237f24eb4..0330da83776 100644 --- a/.env.development +++ b/.env.development @@ -2,6 +2,3 @@ ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=fkSxKD2bF396kdQbrP1EJ7WbU7ZgNokR ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=r0hvVmzBVsjxC7AMlwhOzmtc36ZCOS1E ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=PhdFyyfy5xJ7WVd2lWBpcPScRQHzRTNr - -#testing MFA Enforcement -MFA_FORCE=true diff --git a/.env.production.sample b/.env.production.sample index 15004b9d0d9..d11c65aeaa4 100644 --- a/.env.production.sample +++ b/.env.production.sample @@ -109,3 +109,6 @@ FETCH_REPLIES_MAX_SINGLE=500 # Max number of replies Collection pages to fetch - total FETCH_REPLIES_MAX_PAGES=500 + +# MFA Required for Users +REQUIRE_MULTI_FACTOR_AUTH=false \ No newline at end of file diff --git a/app/controllers/concerns/mfa_force_concern.rb b/app/controllers/concerns/mfa_force_concern.rb index c2dc4f8a985..15d4661a91b 100644 --- a/app/controllers/concerns/mfa_force_concern.rb +++ b/app/controllers/concerns/mfa_force_concern.rb @@ -14,12 +14,12 @@ module MfaForceConcern return if current_user.otp_enabled? return if mfa_setup_allowed_paths? - flash[:warning] = I18n.t('mfa_force.required_message') + flash[:warning] = I18n.t('require_multi_factor_auth.required_message') redirect_to settings_otp_authentication_path end def mfa_force_enabled? - ENV['MFA_FORCE'] == 'true' + ENV['REQUIRE_MULTI_FACTOR_AUTH'] == 'true' end def mfa_setup_allowed_paths? diff --git a/config/locales/en.yml b/config/locales/en.yml index 07cd8100258..243634873b2 100644 --- a/config/locales/en.yml +++ b/config/locales/en.yml @@ -2119,6 +2119,6 @@ en: otp_required: To use security keys please enable two-factor authentication first. registered_on: Registered on %{date} - mfa_force: + require_multi_factor_auth: required_message: The administrator of this site has configured as mandatory that users enable two-factor authentication due to security policies. Please configure your two-factor authentication to continue using the platform. security_policy: Security Policy Requirement diff --git a/config/locales/es.yml b/config/locales/es.yml index a6952fcce14..c2aabea9f55 100644 --- a/config/locales/es.yml +++ b/config/locales/es.yml @@ -2116,8 +2116,4 @@ es: not_enabled: Aún no has activado WebAuthn not_supported: Este navegador no soporta claves de seguridad otp_required: Para usar claves de seguridad, por favor habilite primero la autenticación de doble factor. - registered_on: Registrado el %{date} - - mfa_force: - required_message: El administrador de este sitio ha configurado como obligatorio que los usuarios habiliten la autenticación de dos factores debido a las políticas de seguridad. Por favor, configura tu autenticación de dos factores para continuar usando la plataforma. - security_policy: Requisito de Política de Seguridad + registered_on: Registrado el %{date} \ No newline at end of file diff --git a/docs/MFA_FORCE.md b/docs/MFA_FORCE.md deleted file mode 100644 index 2a514967747..00000000000 --- a/docs/MFA_FORCE.md +++ /dev/null @@ -1,139 +0,0 @@ -# MFA Force Feature - -## Overview - -The MFA Force feature allows administrators to require all users to enable two-factor authentication (2FA) before they can access the platform. This is useful for organizations with strict security policies. - -## Configuration - -### Environment Variable - -To enable MFA forcing, set the following environment variable: - -```bash -MFA_FORCE=true -``` - -### Docker Compose - -Add the environment variable to your `.env.production` file: - -```env -MFA_FORCE=true -``` - -Or add it directly to your `docker-compose.yml`: - -```yaml -services: - web: - environment: - - MFA_FORCE=true - # ... other configuration -``` - -## Behavior - -When `MFA_FORCE=true` is set: - -1. **After Login**: Users who don't have 2FA enabled will be automatically redirected to the 2FA setup page (`/settings/otp_authentication`) - -2. **Message Display**: A warning message (using Mastodon's flash message system) is shown explaining that 2FA is required due to security policies - -3. **Access Restriction**: Users cannot access most parts of the platform until they configure 2FA - -4. **Allowed Pages**: Users can still access: - - - 2FA setup pages (`/settings/otp_authentication`) - - 2FA confirmation pages (`/settings/two_factor_authentication/confirmation`) - - Account settings (`/settings/profile`) - - Logout (`/auth/sign_out`) - - Setup pages for unconfirmed users (`/auth/setup`) - -5. **User Experience**: A clear message explains why 2FA is required and guides users through the setup process - -## User Interface - -### Message Display - -When MFA forcing is enabled, users will see: - -- **Warning Message**: "The administrator of this site has configured as mandatory that users enable two-factor authentication due to security policies. Please configure your two-factor authentication to continue using the platform." - -- **Flash Message**: Uses Mastodon's built-in flash message system with warning styling - -- **Visual Indicator**: A prominent notice on the 2FA setup page with a security icon - -### Multi-language Support - -The feature includes translations for: - -- English -- Spanish -- And other supported languages - -## Implementation Details - -### Files Modified - -1. **`app/controllers/concerns/mfa_force_concern.rb`**: Core logic for checking MFA requirements -2. **`app/controllers/application_controller.rb`**: Includes the MFA force concern -3. **`app/helpers/flashes_helper.rb`**: Updated to support warning flash messages -4. **`app/views/settings/two_factor_authentication/otp_authentication/show.html.haml`**: Updated to show the forced MFA message -5. **`app/javascript/styles/mastodon/forms.scss`**: Added styles for the MFA force notice -6. **`config/locales/en.yml`**: English translations -7. **`config/locales/es.yml`**: Spanish translations - -### Testing - -Run the tests to verify the functionality: - -```bash -bundle exec rspec spec/controllers/concerns/mfa_force_concern_spec.rb -``` - -## Security Considerations - -- **Existing Users**: Users who already have 2FA enabled are not affected -- **New Users**: All new users must configure 2FA before accessing the platform -- **Admin Access**: Administrators are also subject to this requirement -- **Graceful Degradation**: If the environment variable is not set, the feature is disabled - -## Troubleshooting - -### Common Issues - -1. **Users can't access the platform**: Ensure they complete 2FA setup -2. **Message not appearing**: Check that `MFA_FORCE=true` is set correctly -3. **Translation missing**: Add translations to the appropriate locale files - -### Disabling the Feature - -To disable MFA forcing: - -```bash -# Remove the environment variable or set it to false -MFA_FORCE=false -# or -unset MFA_FORCE -``` - -## Migration Guide - -### For Existing Instances - -1. **Backup**: Always backup your database before enabling this feature -2. **Communication**: Inform users about the new requirement -3. **Testing**: Test in a staging environment first -4. **Gradual Rollout**: Consider enabling for specific user groups first - -### For New Instances - -1. Set `MFA_FORCE=true` in your environment configuration -2. All new users will be required to set up 2FA during registration - -## Related Features - -- **Two-Factor Authentication**: The underlying 2FA system -- **Account Security**: General security features -- **User Management**: Admin tools for managing user accounts diff --git a/spec/controllers/concerns/mfa_force_concern_spec.rb b/spec/controllers/concerns/mfa_force_concern_spec.rb index 4a88825917c..f1d33fa9e07 100644 --- a/spec/controllers/concerns/mfa_force_concern_spec.rb +++ b/spec/controllers/concerns/mfa_force_concern_spec.rb @@ -16,9 +16,9 @@ RSpec.describe MfaForceConcern do end describe 'MFA force functionality' do - context 'when MFA_FORCE is enabled' do + context 'when REQUIRE_MULTI_FACTOR_AUTH is enabled' do before do - allow(ENV).to receive(:[]).with('MFA_FORCE').and_return('true') + allow(ENV).to receive(:[]).with('REQUIRE_MULTI_FACTOR_AUTH').and_return('true') sign_in user, scope: :user end @@ -45,7 +45,7 @@ RSpec.describe MfaForceConcern do it 'shows the required message' do get :index - expect(flash[:warning]).to eq(I18n.t('mfa_force.required_message')) + expect(flash[:warning]).to eq(I18n.t('require_multi_factor_auth.required_message')) end context 'when accessing MFA setup pages' do @@ -70,9 +70,9 @@ RSpec.describe MfaForceConcern do end end - context 'when MFA_FORCE is disabled' do + context 'when REQUIRE_MULTI_FACTOR_AUTH is disabled' do before do - allow(ENV).to receive(:[]).with('MFA_FORCE').and_return('false') + allow(ENV).to receive(:[]).with('REQUIRE_MULTI_FACTOR_AUTH').and_return('false') sign_in user, scope: :user user.update(otp_required_for_login: false) end @@ -85,7 +85,7 @@ RSpec.describe MfaForceConcern do context 'when user is not signed in' do before do - allow(ENV).to receive(:[]).with('MFA_FORCE').and_return('true') + allow(ENV).to receive(:[]).with('REQUIRE_MULTI_FACTOR_AUTH').and_return('true') end it 'allows access to normal pages' do