Feature Request: Show otpauth URI during TOTP setup

[suspectpart]

When setting up two factor authentication, a QR code is shown to be scanned with TOTP device:

This is sufficient for all users that setup their token generator devices with a camera-enabled device, e.g. a mobile application in Android or iOS or with a hardware token that has a built-in camera.

For all other users that need to flash a hardware token without a camera or that use software like KeePassXC, the otpauth:// is required in plain text. Of course one could scan the QR code to extract the URL, but that is kind of clumsy.

As an example, LinOTP (a software that we use internally for managing general MFA tokens) allows for displaying the token information as both a otpauth:// as well as a seed:// URI:

Adding something like that to SeaHub as well to support advanced enrollment scenarios seems like not a big change.

I did a little proof of concept by adding a line in

seahub/seahub/two_factor/views/core.py

Line 178 in 79448fe

def get_context_data(self, form, **kwargs):

to:

def get_context_data(self, form, **kwargs):
        context = super(SetupView, self).get_context_data(form, **kwargs)
        if self.steps.current == 'generator':
            key = self.get_key('generator')
            rawkey = unhexlify(key.encode('ascii'))
            b32key = b32encode(rawkey).decode('utf-8')
            self.request.session[QR_SESSION_KEY] = b32key

            # ====> Generate otpauth:// URL and add it to context
            otpauth_url = get_otpauth_url(
                accountname=self.request.user.username,
                issuer=config.SITE_NAME,
                secret=b32key,
                digits=totp_digits()
            )
            context.update({'QR_URL': reverse(self.qrcode_url), 'OATH_URL': otpauth_url})

and then including that URL in the two factor setup template

seahub/seahub/two_factor/templates/two_factor/core/setup.html

Line 20 in 7be2a06

<img src="{{ QR_URL }}" alt="QR Code" />

.

As a result, the otpauth:// URL is displayed alongside the QR code:

Do you think something like that would be feasible? It would really improve enrollment workflows when a camera-enabled device is not an option.

[suspectpart]

bump

Any comment on this feature request?

[freeplant]

We have recorded the requirement internally. It is currently a low priority task.