Two factor Auth

[ryuken]

Question 💬

Hi is it possible to use the email provider (passwordless login) together with another provider (like onelogin) for two factor authentication? How could I combine these?

So I want to login with both required. Is this possible?

How to reproduce ☕️

It's not a bug to reproduce

Contributing 🙌🏽

No, I am afraid I cannot help regarding this

[rklubenspies]

Two factor is not something that NextAuth has announced plans to build into the library, at least at the time of this comment. We've been faced with the same requirement for TOTP-based 2FA on our team.

#4820 discussed how to (conceptually) implement a customization like 2FA. To implement something like password-less login, then provide TOTP 2FA code, to log in, you'll need to add some custom logic to the default function on your api/pages/[...nextauth].ts page. You can inspect the request and then override the function's default logic on a sign-in callback to implement 2FA there.

[ryuken]

@rklubenspies thanks. Do you know if its possible to reuse logic from the providers in the custom code? Like would that be as simple to call some functions or do you have to copy/paste and modify the code?

[rklubenspies]

@ryuken I'm not sure how much NextAuth exposes in the way of internals to trigger something like that. When a provider runs, all the normal callbacks run so I'd think that trying to do this would overwrite some of the session storage by default. There may be a highly tweaked way to do that, but using a third-party service to send 2-factor codes via email and treating it like we would be treating TOTP 2FA may be the easier route for implementation. If we arrive at a solid TOTP 2FA implementation with NextAuth, I plan to open source the example.

[YandiBanyuKarimaWaly]

My take on this is to make a custom OAuth compatible endpoint. When the user is logging in using the "traditional" username+password and other additional factor, you are interacting with your own OAuth implementation. Your endpoint can then redirect the result to the usual endpoint that AuthJS accept. In fact, you can maybe use Keycloak integration and AuthJS shouldn't care that it is not an actual Keycloak that make the redirect.

EDIT: Nevermind. My response is basically this documented feature. But maybe for unsupported yet framework like Nuxt.js then you can mock the Keycloak as I mentioned.