We are looking at implementing Multi-factor authentication for our application, using Time-based one-time password (TOTP) algorithm.
What we want to achieve:
Users should have the option to enable Multi-factor authentication for their account. Once enabled, they will be prompted for the
Authorization code (which they need to get using an Authenticator app)
It is clear, how the flow should work - registering for the MFA, showing the QR-code etc. But I have a few questions around the general architecture of the flow - especially for the REST API's.
Firstly, lets say we implement it for the web application. Once a user reigsters for MFA, we ask need to also ask for the Authorization code. But what do we do with the REST API's - I would think we need to also enable MFA there (Oauth2 login)
If so, how do we make sure the different client applications that might be using the API - are not affected? I would think all the apps need to migrate to the new way of logging in - before we allow the users to register for MFA.
One way we are thinking of achieving this:
- When the user tries to logs in, we check if MFA is enabled.
- If not, we login the user
- If yes, we give an error that is understandable by the client that - and they ask for the authorization code
- The user logs in by providing the correct authorization code
But it still has the problem of the client applications not implementing the flow - and hence the user being locked out.
Mostly, I am not clear on how best to implement MFA for the REST API's - Maybe there is a better way?