1364233 - Add setting to force a group to require MFA and restrict users in that group who have not enabled MFA

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: General, enhancement, P1)

Description

[Emma Humphries ☕️🎸🧞‍♀️✨ (she/they) [:emceeaich] (Pacific Time) use needinfo]

See the user story for the details.

:jeff, would the approach outlined in the user stories work for you?

Comment 1

[Jeff Bryner [:jeff] (use NEEDINFO 😉)]

Sounds correct to me, r+

Comment 3

[Mark Côté [:mcote]]

Laura would like to see this done this quarter.

Comment 4

[Dylan Hardison [:dylan] (he/him)]

Rather than having this be per-group, we'll make an admin param that takes a group.
We can use the group permission system to apply that to other groups if needed, but I suspect mozilla-employee is the right group for this.

We'll want to add code here: https://github.com/mozilla-bteam/bmo/blob/master/Bugzilla/Auth.pm#L299

if all of the following are true:

* the user is logged in
* the user is a member of $group (configured by a new data/params entry 'require_2fa_group')
* the page being accessed is anything other than userprefs.cgi

then

return a new page that explains that the user is required to setup MFA before using BMO
We'll work out exactly what the copy says later.

Comment 5

[Dylan Hardison [:dylan] (he/him)]

I'll have a proof of concept up for this today.

Comment 6

[Dylan Hardison [:dylan] (he/him)]

Attachment: PR

Comment 7

[Dylan Hardison [:dylan] (he/him)]

Comment on attachment 8899615 [details] [review]
PR

Adding Sebastin as reviewer too, since he has a working dev env.

Comment 8

[Dylan Hardison [:dylan] (he/him)]

probably r+ as I addressed the concern and will do additional testing.