Skip to Content
Last modified by Agnease on 2026/05/23 18:56
From version 1.7
edited by Agnease
on 2026/05/19 06:09
Change comment: There is no comment for this version
To version 1.14
edited by Agnease
on 2026/05/22 03:43
Change comment: There is no comment for this version

Summary

Details

Page properties
Content
... ... @@ -17,8 +17,8 @@
17 17   </p>
18 18  
19 19   <p class="hero-support">
20 - This extension protects XWiki accounts with time-based one-time verification codes while keeping the familiar
21 - XWiki username and password authentication as the first login step.
20 + This XWiki MFA / 2FA extension adds an additional verification step after the standard username and password login.
21 + Users can verify access with authenticator app codes, email-delivered one-time codes, or a combined setup requiring both methods.
22 22   </p>
23 23  
24 24   <div class="hero-actions">
... ... @@ -35,19 +35,21 @@
35 35   <h2 id="overview-title">Stronger login protection for XWiki</h2>
36 36  
37 37   <p>
38 - The XWiki Two-Factor Authentication extension adds an additional verification screen after the standard
39 - username and password login. Users confirm their identity with a time-based one-time code before accessing
40 - the wiki.
38 + The XWiki MFA / Two-Factor Authentication extension adds additional verification after the standard
39 + XWiki username and password login. It strengthens account protection without replacing the familiar
40 + XWiki authentication flow.
41 41   </p>
42 42  
43 43   <p>
44 - The extension is designed for organizations that want to improve account security while keeping authentication
45 - close to the standard XWiki login experience.
44 + The extension supports authenticator app codes using TOTP, email-delivered one-time verification codes,
45 + and stricter configurations where both verification methods are required. This allows organizations to
46 + choose between a simpler 2FA setup or a stronger multi-step MFA policy.
46 46   </p>
47 47  
48 48   <p>
49 - It can be useful for internal knowledge bases, intranets, documentation platforms, SOP systems, or other
50 - XWiki environments where access to content and administration should be better protected.
50 + Trusted clients can also be remembered for a configured period. In practice, this means that a known
51 + browser or device can avoid repeated MFA prompts, while new or untrusted clients still require the
52 + configured verification steps.
51 51   </p>
52 52   </article>
53 53  
... ... @@ -55,10 +55,11 @@
55 55   <h3 id="quick-facts-title">Quick facts</h3>
56 56   <ul>
57 57   <li>Works with the standard XWiki login flow</li>
58 - <li>Adds a second TOTP verification step</li>
59 - <li>Configuration available from wiki administration</li>
60 - <li>User setup available during login or from the user profile</li>
61 - <li>Administrators can enable, disable or reset MFA for users</li>
60 + <li>Supports authenticator app codes using TOTP</li>
61 + <li>Supports email-delivered one-time verification codes</li>
62 + <li>Can require app code and email code together for stricter MFA</li>
63 + <li>Can remember trusted browsers or devices beyond the current session</li>
64 + <li>Includes wiki administration and user profile controls</li>
62 62   <li>Can be used on the main wiki and subwikis</li>
63 63   </ul>
64 64   </aside>
... ... @@ -81,12 +81,43 @@
81 81   </div>
82 82   <h3>Second login step</h3>
83 83   <p>
84 - After the username and password are verified, users are asked to enter a time-based verification code.
87 + After the username and password are verified, users are asked to enter an additional verification code
88 + before accessing the wiki.
85 85   </p>
86 86   </article>
87 87  
88 88   <article class="product-feature">
89 89   <div class="feature-icon">
94 + <i class="fa fa-mobile" aria-hidden="true"></i>
95 + </div>
96 + <h3>Authenticator app codes</h3>
97 + <p>
98 + Users can verify access with TOTP codes generated by authenticator applications on a mobile device or desktop.
99 + </p>
100 + </article>
101 +
102 + <article class="product-feature">
103 + <div class="feature-icon">
104 + <i class="fa fa-envelope-o" aria-hidden="true"></i>
105 + </div>
106 + <h3>Email verification codes</h3>
107 + <p>
108 + Users can receive one-time verification codes by email, useful when an authenticator app is not available or preferred.
109 + </p>
110 + </article>
111 +
112 + <article class="product-feature">
113 + <div class="feature-icon">
114 + <i class="fa fa-plus-circle" aria-hidden="true"></i>
115 + </div>
116 + <h3>Combined verification</h3>
117 + <p>
118 + The extension can also require both an authenticator app code and an email code for stricter multi-factor verification.
119 + </p>
120 + </article>
121 +
122 + <article class="product-feature">
123 + <div class="feature-icon">
90 90   <i class="fa fa-qrcode" aria-hidden="true"></i>
91 91   </div>
92 92   <h3>User setup screen</h3>
... ... @@ -97,11 +97,21 @@
97 97  
98 98   <article class="product-feature">
99 99   <div class="feature-icon">
134 + <i class="fa fa-laptop" aria-hidden="true"></i>
135 + </div>
136 + <h3>Remember trusted clients</h3>
137 + <p>
138 + Known browsers or devices can be remembered for a configured period, reducing repeated MFA prompts from trusted clients.
139 + </p>
140 + </article>
141 +
142 + article class="product-feature">
143 + <div class="feature-icon">
100 100   <i class="fa fa-sliders" aria-hidden="true"></i>
101 101   </div>
102 102   <h3>Administration controls</h3>
103 103   <p>
104 - Administrators can enable the feature globally, manage user-level activation, and reset a user setup when required.
148 + Administrators can configure MFA behavior, manage user activation, and reset user setup when required.
105 105   </p>
106 106   </article>
107 107  
... ... @@ -150,6 +150,12 @@
150 150   </p>
151 151  
152 152   <p>
197 + It can also support organizations that need MFA as part of their cybersecurity controls, including companies
198 + working toward NIS 2 readiness. NIS 2 focuses on stronger cybersecurity risk management across essential and
199 + important entities in the EU, and MFA is often expected as part of enterprise access protection programs.
200 + </p>
201 +
202 + <p>
153 153   It is also useful when many users access the wiki remotely, when administrator accounts need stronger protection,
154 154   or when the organization wants to reduce the risk of compromised passwords.
155 155   </p>
... ... @@ -169,6 +169,46 @@
169 169   </div>
170 170  </section>
171 171  
222 +<section class="product-section-muted" aria-labelledby="compliance-title">
223 + <div class="container">
224 + <div class="product-layout">
225 + <article class="product-summary-card">
226 + <h2 id="compliance-title">Useful for MFA adoption and NIS 2 readiness</h2>
227 +
228 + <p>
229 + Many organizations now need multi-factor authentication for enterprise software, including internal
230 + knowledge bases, documentation platforms, intranets and systems that contain operational procedures
231 + or sensitive business information.
232 + </p>
233 +
234 + <p>
235 + For organizations using XWiki, adding MFA directly to the standard XWiki login flow can help close a
236 + practical access-control gap. The extension can support simple 2FA with one additional verification method,
237 + or a stricter MFA setup where both authenticator app and email verification are required.
238 + </p>
239 +
240 + <p>
241 + This can be relevant for organizations preparing for NIS 2, where multi-factor authentication or
242 + continuous authentication is part of cybersecurity risk-management measures, where appropriate.
243 + MFA support in XWiki is only one part of a broader compliance and security program, but it can be an
244 + important technical control for protecting access to the wiki.
245 + </p>
246 + </article>
247 +
248 + <aside class="product-info-card" aria-labelledby="mfa-readiness-title">
249 + <h3 id="mfa-readiness-title">Security controls supported</h3>
250 + <ul>
251 + <li>Second-factor verification after password login</li>
252 + <li>Authenticator app or email-based verification codes</li>
253 + <li>Reduced repeated prompts for trusted clients</li>
254 + <li>Administration controls for user-level MFA management</li>
255 + <li>Better protection for administrator and remote-access accounts</li>
256 + </ul>
257 + </aside>
258 + </div>
259 + </div>
260 +</section>
261 +
172 172  #*
173 173  <section aria-labelledby="gallery-title">
174 174   <div class="container">