TOTP GUI restriction for Users

[nlaird80]

We allow our users of VPN to sign into the management GUI and only access the password management page. This lets them self-service a password change. What we would also like to allow is self-service for TOTP seeds (at a minimum the ability to get their QR). I cannot determine if there is already a permission in the access-control.

Any way to allow self-service for this? I would even be willing to accept self service to their own account management page (but not other users')

Thanks!

[franco]

Hi there,

At the moment there is no "profile" page for users that is tailored for read-only access of their settings.

I don't know what the best place would be for such a feature and what other data it should display.

Aiming for a simple solution... maybe showing the QR code on the password change page would be enough if the user has an OTP seed assigned?


Cheers,
Franco

[nlaird80]

That would most likely be enough. We just want users to be able to change their own passwords and/or get their QR code without the admin from manually distributing them all (50+).

[franco]

I've recorded this as ticket https://github.com/opnsense/core/issues/1197 just now, thanks