Temporary 2FA Bypass for Specific User

We need to temporarily disable 2FA for a user (after verifying their ID) so they can log in if their mobile phone/ 2FA device has been damaged, lost, stolen, or left at home!

We currently modify the user’s entry in the following twofactorauth.ini file to enabled=no, escort them through the login process, and then reinstate enabled=yes :

C:\Program Files (x86)\TSplus\Clients\webserver\twofa\twofactorauth.ini

This is a dangerous practice that is vulnerable to editing mistakes on an important .ini file.

Ideally, we need two disable options in the Admin Tool for a specific user:

• Disable 2FA for next login

• Disable 2FA until specific date

We do not want the ability to permanently disable the 2FA for a user because that would encourage bad practice that would invalidate our cyber security insurance … “no 2FA, no insurance”.