Wiki source code of XWiki Two-Factor Authentication
Version 7.2 by Alex Cotiuga on 2026/06/23 08:35
Hide last authors
| author | version | line-number | content |
|---|---|---|---|
 |
1.18 | 1 | {{velocity}} |
| 2 | #set ($discard = $xwiki.ssx.use('PublicWebSite.WebHome')) | ||
| 3 | #set ($discard = $xwiki.ssx.use('products.WebHome')) | ||
| |
6.11 | 4 | |
| 5 | #set ($mainCapabilityItems = [{ | ||
| 6 | 'title': 'Second verification step', | ||
| 7 | 'icon': 'key', | ||
| |
6.12 | 8 | 'content': 'Add an additional verification screen after the normal XWiki username and password login.' |
| |
6.11 | 9 | },{ |
| 10 | 'title': 'Authenticator app codes', | ||
| 11 | 'icon': 'mobile', | ||
| |
6.12 | 12 | 'content': 'Let users verify access with time-based TOTP codes generated by authenticator applications.' |
| |
6.11 | 13 | },{ |
| 14 | 'title': 'Email verification codes', | ||
| 15 | 'icon': 'envelope-o', | ||
| |
6.12 | 16 | 'content': 'Send one-time verification codes by email when this method is enabled or combined with app codes.' |
| |
6.11 | 17 | }]) |
| 18 | |||
| |
6.12 | 19 | #set ($adminExperienceItems = [{ |
| |
6.13 | 20 | 'title': 'MFA policy', |
| |
6.12 | 21 | 'icon': 'cog', |
| |
6.13 | 22 | 'content': 'Make MFA optional or required for all users from the XWiki Administration section.' |
| |
6.12 | 23 | },{ |
| 24 | 'title': 'Recovery and trusted devices', | ||
| 25 | 'icon': 'shield', | ||
| 26 | 'content': 'Configure recovery-code count and trusted-device duration according to the organization security policy.' | ||
| 27 | },{ | ||
| 28 | 'title': 'Administration overview', | ||
| 29 | 'icon': 'table', | ||
| 30 | 'content': 'Review MFA adoption across users with summary indicators and a filterable Live Data table.' | ||
| 31 | }]) | ||
| |
6.11 | 32 | |
| |
6.12 | 33 | #set ($userExperienceItems = [{ |
| 34 | 'title': 'Self-service setup', | ||
| 35 | 'icon': 'qrcode', | ||
| 36 | 'content': 'Users configure MFA from their profile by scanning a QR code or entering the setup key manually.' | ||
| 37 | },{ | ||
| 38 | 'title': 'Familiar login flow', | ||
| 39 | 'icon': 'sign-in', | ||
| 40 | 'content': 'After the normal login, users enter the configured verification code before accessing XWiki.' | ||
| 41 | },{ | ||
| 42 | 'title': 'Profile management', | ||
| 43 | 'icon': 'user', | ||
| 44 | 'content': 'Users can review MFA status, manage recovery codes and remove trusted devices from their profile.' | ||
| 45 | }]) | ||
| |
6.11 | 46 | |
| |
6.12 | 47 | #set ($recoveryItems = [{ |
| 48 | 'title': 'Recovery codes', | ||
| 49 | 'icon': 'life-ring', | ||
| 50 | 'content': 'Recovery codes provide backup access when a user loses access to the authenticator application.' | ||
| 51 | },{ | ||
| 52 | 'title': 'Trusted devices', | ||
| 53 | 'icon': 'desktop', | ||
| 54 | 'content': 'Trusted browsers or devices can skip repeated MFA prompts for a configured period.' | ||
| 55 | },{ | ||
| 56 | 'title': 'Administrator reset', | ||
| 57 | 'icon': 'refresh', | ||
| 58 | 'content': 'Administrators can reset a user MFA setup when the user needs to restart the configuration process.' | ||
| 59 | }]) | ||
| |
6.11 | 60 | |
| 61 | #set ($rolloutItems = [{ | ||
| |
6.12 | 62 | 'title': 'Start with a pilot group', |
| 63 | 'content': 'Test the extension with administrators or a small user group before enabling it widely.' | ||
| |
6.11 | 64 | },{ |
| 65 | 'title': 'Define the MFA policy', | ||
| 66 | 'content': 'Decide whether MFA should be optional, required for administrators, or required for all users.' | ||
| 67 | },{ | ||
| |
6.12 | 68 | 'title': 'Configure recovery options', |
| 69 | 'content': 'Choose whether recovery codes and trusted devices should be enabled.' | ||
| |
6.11 | 70 | },{ |
| |
6.12 | 71 | 'title': 'Inform users', |
| 72 | 'content': 'Explain how users configure MFA, save recovery codes and manage trusted devices.' | ||
| |
6.11 | 73 | },{ |
| 74 | 'title': 'Monitor adoption', | ||
| 75 | 'content': 'Use the administration overview to identify users who still need to configure MFA.' | ||
| 76 | }]) | ||
| 77 | |||
| |
1.18 | 78 | {{html clean="false"}} |
| |
1.2 | 79 | |
| |
6.11 | 80 | <section class="hero hero-centered" aria-labelledby="product-title"> |
| |
1.18 | 81 | <div class="container hero-inner"> |
| 82 | <div class="hero-kicker"> | ||
| |
1.2 | 83 | <i class="fa fa-lock" aria-hidden="true"></i> |
| |
1.18 | 84 | XWiki 2FA and MFA |
| |
1.2 | 85 | </div> |
| 86 | |||
| |
1.18 | 87 | <h1 id="product-title">XWiki Two-Factor Authentication</h1> |
| |
1.2 | 88 | |
| |
1.18 | 89 | <p class="lead"> |
| |
6.2 | 90 | Protect XWiki logins with a second verification step using authenticator app codes, |
| 91 | email verification codes, or both. | ||
| |
1.2 | 92 | </p> |
| 93 | |||
| |
1.18 | 94 | <div class="hero-actions"> |
| 95 | <a class="btn btn-primary" href="$xwiki.getURL('contact.WebHome')">Ask about this extension</a> | ||
| 96 | <a class="btn btn-secondary" href="$xwiki.getURL('products.WebHome')">View all products</a> | ||
| 97 | </div> | ||
| 98 | </div> | ||
| 99 | </section> | ||
| 100 | |||
| 101 | <section aria-labelledby="overview-title"> | ||
| 102 | <div class="container"> | ||
| 103 | <div class="product-layout"> | ||
| 104 | <article class="product-summary-card"> | ||
| 105 | <h2 id="overview-title">Two-factor authentication built into XWiki</h2> | ||
| 106 | |||
| 107 | <p> | ||
| |
6.11 | 108 | XWiki Two-Factor Authentication adds MFA/2FA support to the standard XWiki login flow. |
| 109 | Users continue to sign in with their normal username and password, then confirm access with | ||
| 110 | an additional verification method. | ||
| |
1.18 | 111 | </p> |
| 112 | |||
| 113 | <p> | ||
| |
6.11 | 114 | The extension supports authenticator app codes, email-delivered verification codes, or a combined |
| |
6.13 | 115 | setup where both methods are required. It improves account protection without replacing the familiar |
| 116 | XWiki authentication experience. | ||
| |
1.18 | 117 | </p> |
| 118 | </article> | ||
| 119 | |||
| 120 | <aside class="product-info-card" aria-labelledby="quick-facts-title"> | ||
| 121 | <h3 id="quick-facts-title">Quick facts</h3> | ||
| 122 | <ul> | ||
| 123 | <li>Works with the standard XWiki login flow</li> | ||
| |
6.12 | 124 | <li>Supports TOTP authenticator applications</li> |
| 125 | <li>Supports email-delivered one-time codes</li> | ||
| 126 | <li>Can require app and email verification together</li> | ||
| |
6.11 | 127 | <li>Includes recovery codes for backup access</li> |
| |
1.18 | 128 | <li>Can remember trusted browsers or devices</li> |
| |
6.12 | 129 | <li>Includes administration and user controls</li> |
| |
1.18 | 130 | </ul> |
| 131 | </aside> | ||
| 132 | </div> | ||
| 133 | </div> | ||
| 134 | </section> | ||
| 135 | |||
| |
6.12 | 136 | <section aria-labelledby="capabilities-title"> |
| |
1.18 | 137 | <div class="container"> |
| |
6.12 | 138 | <h2 id="capabilities-title">Main capabilities</h2> |
| |
1.18 | 139 | |
| 140 | <p class="section-intro"> | ||
| |
6.12 | 141 | A focused set of MFA/2FA features for stronger XWiki account protection without changing the standard login experience. |
| |
1.2 | 142 | </p> |
| |
1.18 | 143 | |
| 144 | <div class="product-feature-grid"> | ||
| |
6.11 | 145 | #foreach ($entry in $mainCapabilityItems) |
| 146 | <article class="product-feature"> | ||
| 147 | <div class="card-heading"> | ||
| 148 | <div class="feature-icon"> | ||
| 149 | <i class="fa fa-$entry.icon" aria-hidden="true"></i> | ||
| 150 | </div> | ||
| 151 | <h3>$entry.title</h3> | ||
| |
6.7 | 152 | </div> |
| 153 | |||
| |
6.11 | 154 | <p>$entry.content</p> |
| 155 | </article> | ||
| 156 | #end | ||
| 157 | </div> | ||
| 158 | </div> | ||
| 159 | </section> | ||
| 160 | |||
| 161 | <section class="product-section-muted" aria-labelledby="security-title"> | ||
| 162 | <div class="container"> | ||
| 163 | <div class="product-layout"> | ||
| 164 | <article class="product-summary-card"> | ||
| |
6.12 | 165 | <h2 id="security-title">Useful for XWiki security and access protection</h2> |
| |
6.11 | 166 | |
| |
1.18 | 167 | <p> |
| |
6.12 | 168 | Many organizations need multi-factor authentication for internal tools, knowledge bases, |
| 169 | intranets, documentation platforms and systems containing operational or sensitive information. | ||
| |
1.18 | 170 | </p> |
| |
6.11 | 171 | |
| 172 | <p> | ||
| |
6.12 | 173 | For XWiki, adding two-factor authentication directly to the standard login flow helps protect |
| 174 | administrator accounts, remote users, private knowledge bases and customer or partner portals. | ||
| |
6.11 | 175 | </p> |
| |
1.18 | 176 | </article> |
| 177 | |||
| |
6.11 | 178 | <aside class="product-info-card" aria-labelledby="use-cases-title"> |
| 179 | <h3 id="use-cases-title">Typical use cases</h3> | ||
| 180 | <ul> | ||
| |
6.12 | 181 | <li>Administrator account protection</li> |
| 182 | <li>Internal knowledge base security</li> | ||
| 183 | <li>Private documentation platforms</li> | ||
| 184 | <li>Remote user access protection</li> | ||
| 185 | <li>Customer or partner portals</li> | ||
| 186 | <li>Security review and NIS 2 readiness initiatives</li> | ||
| |
6.11 | 187 | </ul> |
| 188 | </aside> | ||
| 189 | </div> | ||
| 190 | </div> | ||
| 191 | </section> | ||
| |
6.7 | 192 | |
| |
6.12 | 193 | <section aria-labelledby="admin-experience-title"> |
| |
6.11 | 194 | <div class="container"> |
| |
6.12 | 195 | <h2 id="admin-experience-title">Administrator experience</h2> |
| |
6.11 | 196 | |
| |
6.12 | 197 | <p class="section-intro"> |
| 198 | Administrators can configure the MFA policy, monitor adoption and reset user MFA setups when needed. | ||
| 199 | </p> | ||
| |
6.11 | 200 | |
| |
6.12 | 201 | <div class="product-feature-grid"> |
| 202 | #foreach ($entry in $adminExperienceItems) | ||
| 203 | <article class="product-feature"> | ||
| 204 | <div class="card-heading"> | ||
| 205 | <div class="feature-icon"> | ||
| 206 | <i class="fa fa-$entry.icon" aria-hidden="true"></i> | ||
| 207 | </div> | ||
| 208 | <h3>$entry.title</h3> | ||
| 209 | </div> | ||
| |
6.11 | 210 | |
| |
6.12 | 211 | <p>$entry.content</p> |
| 212 | </article> | ||
| 213 | #end | ||
| 214 | </div> | ||
| |
1.18 | 215 | |
| |
6.12 | 216 | <p class="product-gallery-caption"> |
| 217 | Administration screens for configuring MFA and reviewing MFA adoption across users. | ||
| 218 | </p> | ||
| |
6.7 | 219 | |
| |
6.11 | 220 | {{/html}} |
| 221 | |||
| 222 | {{gallery}} | ||
| 223 | [[image:mfa-admin-configuration.png]] | ||
| |
6.12 | 224 | [[image:mfa-admin-overview.png]] |
| |
6.11 | 225 | {{/gallery}} |
| 226 | |||
| 227 | {{html clean="false"}} | ||
| 228 | |||
| |
7.2 | 229 | </div> |
| 230 | </section> | ||
| 231 | |||
| |
6.12 | 232 | <section class="product-section-muted" aria-labelledby="user-experience-title"> |
| |
6.11 | 233 | <div class="container"> |
| |
6.12 | 234 | <h2 id="user-experience-title">User experience</h2> |
| |
6.11 | 235 | |
| |
6.12 | 236 | <p class="section-intro"> |
| 237 | Users can configure MFA from their profile and complete the second verification step during login. | ||
| 238 | </p> | ||
| |
6.11 | 239 | |
| |
6.12 | 240 | <div class="product-feature-grid"> |
| 241 | #foreach ($entry in $userExperienceItems) | ||
| 242 | <article class="product-feature"> | ||
| 243 | <div class="card-heading"> | ||
| 244 | <div class="feature-icon"> | ||
| 245 | <i class="fa fa-$entry.icon" aria-hidden="true"></i> | ||
| 246 | </div> | ||
| 247 | <h3>$entry.title</h3> | ||
| 248 | </div> | ||
| |
6.11 | 249 | |
| |
6.12 | 250 | <p>$entry.content</p> |
| 251 | </article> | ||
| 252 | #end | ||
| |
1.18 | 253 | </div> |
| 254 | |||
| |
6.12 | 255 | <p class="product-gallery-caption"> |
| 256 | User setup and login verification screens. | ||
| 257 | </p> | ||
| |
6.11 | 258 | |
| 259 | {{/html}} | ||
| 260 | |||
| 261 | {{gallery}} | ||
| 262 | [[image:mfa-user-setup-qr.png]] | ||
| 263 | [[image:mfa-login-verification.png]] | ||
| 264 | {{/gallery}} | ||
| 265 | |||
| 266 | {{html clean="false"}} | ||
| 267 | |||
| |
7.2 | 268 | </div> |
| 269 | </section> | ||
| 270 | |||
| |
6.11 | 271 | <section aria-labelledby="recovery-title"> |
| 272 | <div class="container"> | ||
| |
6.12 | 273 | <h2 id="recovery-title">Recovery codes and trusted devices</h2> |
| |
6.11 | 274 | |
| |
6.12 | 275 | <p class="section-intro"> |
| 276 | Recovery codes and trusted devices help balance stronger access protection with a smoother user experience. | ||
| 277 | </p> | ||
| |
6.11 | 278 | |
| |
6.12 | 279 | <div class="product-feature-grid"> |
| 280 | #foreach ($entry in $recoveryItems) | ||
| 281 | <article class="product-feature"> | ||
| 282 | <div class="card-heading"> | ||
| 283 | <div class="feature-icon"> | ||
| 284 | <i class="fa fa-$entry.icon" aria-hidden="true"></i> | ||
| 285 | </div> | ||
| 286 | <h3>$entry.title</h3> | ||
| 287 | </div> | ||
| |
6.11 | 288 | |
| |
6.12 | 289 | <p>$entry.content</p> |
| 290 | </article> | ||
| 291 | #end | ||
| 292 | </div> | ||
| |
1.18 | 293 | |
| |
6.12 | 294 | <p class="product-gallery-caption"> |
| 295 | Recovery codes, trusted devices and user profile management. | ||
| 296 | </p> | ||
| |
1.18 | 297 | |
| |
6.11 | 298 | {{/html}} |
| 299 | |||
| 300 | {{gallery}} | ||
| 301 | [[image:mfa-recovery-codes.png]] | ||
| 302 | [[image:mfa-trusted-devices.png]] | ||
| 303 | [[image:mfa-user-profile-overview.png]] | ||
| 304 | [[image:mfa-admin-user-management.png]] | ||
| 305 | {{/gallery}} | ||
| 306 | |||
| 307 | {{html clean="false"}} | ||
| 308 | |||
| |
7.2 | 309 | </div> |
| 310 | </section> | ||
| 311 | |||
| |
6.12 | 312 | <section class="product-section-muted" aria-labelledby="rollout-title"> |
| |
6.11 | 313 | <div class="container"> |
| 314 | <div class="product-layout"> | ||
| 315 | <article class="product-summary-card"> | ||
| |
6.12 | 316 | <h2 id="rollout-title">Rollout recommendations</h2> |
| |
6.11 | 317 | |
| 318 | <p> | ||
| |
6.12 | 319 | For a smooth rollout, start with a small administrator or pilot group before requiring MFA for everyone. |
| 320 | This helps validate the configuration, prepare user communication and reduce support issues. | ||
| |
6.11 | 321 | </p> |
| 322 | |||
| |
6.12 | 323 | <ol class="process-list"> |
| 324 | #foreach ($entry in $rolloutItems) | ||
| 325 | <li> | ||
| 326 | <strong>$entry.title</strong> | ||
| 327 | $entry.content | ||
| 328 | </li> | ||
| 329 | #end | ||
| 330 | </ol> | ||
| |
6.11 | 331 | </article> |
| 332 | |||
| |
6.12 | 333 | <aside class="product-info-card" aria-labelledby="planning-title"> |
| 334 | <h3 id="planning-title">Useful information before installation</h3> | ||
| |
7.2 | 335 | |
| 336 | <p class="product-card-note"> | ||
| 337 | These details help evaluate compatibility, rollout scope and configuration options. | ||
| 338 | </p> | ||
| 339 | |||
| |
6.11 | 340 | <ul> |
| 341 | <li>XWiki version</li> | ||
| 342 | <li>Single wiki or wiki farm with subwikis</li> | ||
| 343 | <li>Current authentication setup</li> | ||
| 344 | <li>Optional or globally required MFA policy</li> | ||
| 345 | <li>Trusted-device policy</li> | ||
| 346 | <li>Recovery-code policy</li> | ||
| 347 | <li>Rollout communication needs</li> | ||
| 348 | </ul> | ||
| 349 | </aside> | ||
| 350 | </div> | ||
| 351 | </div> | ||
| 352 | </section> | ||
| 353 | |||
| |
1.18 | 354 | <section class="cta-section" aria-labelledby="cta-title"> |
| 355 | <div class="container"> | ||
| 356 | <div class="cta-panel"> | ||
| 357 | <h2 id="cta-title">Interested in using this extension?</h2> | ||
| |
6.11 | 358 | |
| |
1.18 | 359 | <p> |
| |
7.2 | 360 | Send a short message with your XWiki version, current authentication setup and MFA rollout goal. |
| |
1.18 | 361 | </p> |
| |
6.11 | 362 | |
| |
1.18 | 363 | <a class="btn btn-primary" href="$xwiki.getURL('contact.WebHome')">Contact Agnease</a> |
| 364 | </div> | ||
| 365 | </div> | ||
| 366 | </section> | ||
| 367 | |||
| 368 | {{/html}} | ||
| 369 | {{/velocity}} |