We need to temporarily disable 2FA for a user (after verifying their ID) so they can log in if their mobile phone/ 2FA device has been damaged, lost, stolen, or left at home!
We currently modify the user’s entry in the following twofactorauth.ini file to enabled=no, escort them through the login process, and then reinstate enabled=yes :
C:\Program Files (x86)\TSplus\Clients\webserver\twofa\twofactorauth.ini
This is a dangerous practice that is vulnerable to editing mistakes on an important .ini file.
Ideally, we need two disable options in the Admin Tool for a specific user:
Disable 2FA for next login
Disable 2FA until specific date
We do not want the ability to permanently disable the 2FA for a user because that would encourage bad practice that would invalidate our cyber security insurance … “no 2FA, no insurance”.
