Current problem
The lack of mandatory two-factor authentication (2FA) represents a security risk for self-hosted instances.
Proposed change
- Mandatory 2FA enforcement: Allow administrators of self-hosted instances to enable a policy requiring 2FA for designated users, with setup required on their first login.
- Dedicated role or setting: Provide a specific role or setting to define which users are subject to mandatory 2FA, for example, exempting bots from the 2FA requirement.
- 2FA reset: Add a feature to the administration interface that allows administrators to manually reset a user's 2FA if they have lost their code or access to their authenticator app.
Platform
Self-hosting