Nextcloud supports web logins with a second factor (two-factor authentication, 2FA). To support a certain type of 2FA, a "2FA provider" (server-)app must be installed. 2FA kicks in after the primary authentication stage (typically username and password) were successful. This provider challenges the user to enter a randomly generated authentication code (aka one-time password, OTP, currently six digits). It sends that code to the user's primary email address and expects the user to enter it on an additional second step web login page.
As with any 2FA provider, two-factor email must be installed from the Nextcloud app store and enabled by a Nextcloud server admin. Additionally, the Nextcloud must have a working email server configured.
The user may set up any of the installed providers or even multiple. This provider uses email to send the code and thus can only be enabled if an email address is set in 'Personal info'. Mind that a user may not be able to log in if that email address is invalid (or email server setup of the Nextcloud is not working properly).
Admins with console access may enable and disable this provider for specified users via OCC command (occ twofactorauth:enable <uid> email, see the administrator guide). Admins may also enforce 2FA for all users (or specific groups) via Admin Settings. This is a Nextcloud feature and not specific to this provider. If enforced, users with no 2FA are prompted to enable any installed provider (that supports AtLogin setup – this provider supports it since v3). If the admin installs this provider and enforces 2FA, it should be ensured that each user does have a valid email address.
Mind that, once a user enabled any 2FA provider, they can no longer use their password in applications that don't support the web-based 2FA login flow. For such applications, the user needs to create and use app passwords (to be found at the bottom of Personal Settings/Security).
- Guides for users, for administrators, and for developers
- The architecture and the threat model
To report a security vulnerability, see SECURITY.md.
This version 3.x.x ("v3") is the successor of the deprecated twofactor_email app 2.x.x ("v2"). v2 will remain in the Nextcloud App Store alongside v3 as long as upcoming security issues may be fixed with reasonable effort. After that, or after all supported Nextcloud versions may use v3, it will be pulled from the App Store. v3 is based on twofactor_totp but has been refactored. v2 is installable on NC ≤33, v3 on NC ≥33 (v3.0–3.3 also ran on NC 32).
The code is stable now. There are plans for further enhancements. See open tasks in the roadmap. It keeps the status of whether this provider is enabled for a specific user or not when migrating from v2 to v3. However, from 3.1.1 onwards, v2 codes are no longer migrated to v3 since most of them were obsolete. Mind that the look and some behaviour changed or was enhanced.
This app is a community effort. Help of any kind is welcome — code, tests, documentation, translations, bug reports and ideas.
CONTRIBUTING.md explains how to get started; CONTRIBUTORS.md lists who to ask.
To build the app, check out the repo and use krankerl package or follow these steps:
composer i --no-devnpm cinpm run buildornpm run devmore info
krankerl is the tool proposed by Nextcloud to build apps.