2FA for Users in Addition to Agents

TheMitelGuy

Hello everyone!

I've been reading all of the documentation and forum information posted about osTicket. It appears to be a really great product and something we are definitely interest buying/using. Just one question though. I see 2FA is supported for Agents. That's a really nice item to have, but I need that more importantly on the User side. To be honest, I'm more concerned with Users and having them us 2FA, then I am Agents. Just wondering if this is possible or planned? I'm assuming it wouldn't take too much to add that code into osTicket to support that...????

Any thoughts or comments or suggestions would be very much appreciated!

Thanks so much!
The Original Mitel Guy.

RBGE

TheMitelGuy The 2FA plugin doesn't currently do this, but it depends how you have your users sign-in. If you have MS 365 for example, you can set up the system to use SSO and enforce MFA this way via conditional access policies.

TheMitelGuy

RBGE Thanks for your reply - very much appreciated.

In our case, the Agents would be our technicians and engineers (always internal staff). Our Users would be our customers. Each customer generally has 1-3 users that they request we setup accounts for. These are the Users that would normally open a ticket with our technical support organization. We don't care so much about 2FA at this point with our Agents, but we are concerned about our customers access. We would prefer to setup our customers (Users) with 2FA. We are not looking for SSO, just more/added security when it comes to our customer's access. We would like them to use a 2FA method of their choosing - either Google or Microsoft. This is what we are seeing with other ticketing systems.

Thanks again!

KevinTheJedi

TheMitelGuy

As RBGE mentioned we do not have such functionality available for users at this time. The only thing we have is SSO via OAuth2 or LDAP.

Cheers.

TheMitelGuy

Does that mean you need to use SSO in order to use 2FA? I normally don't associate them with one another. Of course they can be used together, but I always think of 2FA as an additional layer of security. I would have thought, even though 2FA is only supported with Agents, that SSO wouldn't necessarily be required in order to use 2FA.

KevinTheJedi

TheMitelGuy

SSO isn’t required at all for 2FA they are separate entities. It’s just that the 2FA Plugin only works for Agents at this time. What I’m saying is the only authentication methods available for Users are local username/email + password, LDAP, or SSO via OAuth2.

Cheers.

ntozier

Kevin is saying

the 2FA Plugin for osTicket does not provide 2FA for Users, it only provides 2FA for Agents.
Additionally osTicket does have SSO via the Authentication OAuth2 plugin. The OAuth2 plugin works with Google and Microsoft. Both of which has built in 2FA.

TheMitelGuy Does that mean you need to use SSO in order to use 2FA?

Yes and No.
If you want your Users to have 2FA right now, then yes because the 2FA plugin does provide 2FA for users.
If you just want your Agents to have 2FA now, then no because you can use the 2FA plugin.

TheMitelGuy

Thank you everyone for all of the information and help. It's all much appreciated!

Last question - where do we go to request this feature/suggest it as a feature? Is there a way for someone like me to do that?

Thanks again!

ntozier

These days people go to github and post an issue report and prepend the subject/title with [Feature Request].

https://github.com/osTicket/osTicket/issues/new/choose

abeermuh

Hi, do we have any update on 2FA for users in osticket? Any direction whether this will be available in future releases or not? if yes, till when it is expected?

KevinTheJedi

abeermuh

It was added long ago. Upgrade to v1.16.6 or v1.17.3 and you’ll have it available. After upgrading, you can also download the 2FA plugin so you can use Authenticator apps instead of receiving a code via email. You can read more about the plugin here:

https://docs.osticket.com/en/latest/Plugins/Two%20Factor%20Authentication.html

Cheers.

abeermuh

Here I am asking about users/clients. not Agents. We have already enabled 2FA for agents in our organization and want to enable it for users as well. Please let me know "do we have any update on 2FA for users in osticket? Any direction whether this will be available in future releases or not? if yes, till when it is expected?"

KevinTheJedi

abeermuh

No update. On our feature request list. Probably after v2.0is released. No timeline.

Cheers.

TheMitelGuy

Hello everyone,

I hope this message finds everyone well!

Just wondering if there has been any headway so that we can use 2FA with our customers (users). Agent 2FA is great, but we are looking to specifically harden the security where our customers login. A lot of our customers are also surprised we don't offer this (they are actually wanting it).

Thanks - The Mitel Guy!

vero

Hello @osticket-mod team! I am checking in on this thread to see if there are any plans to incorporate the 2FA plugin to the "Require user to turn on 2FA" feature. Please let me know, thanks!

KevinTheJedi

vero

Not in the current codebase/plugin. Maybe in v2.0 this will happen but no guarantees.

Cheers.