Allow U2F 2FA without TOTP

models/fixtures/u2f_registration.yml

@@ -1,7 +1,7 @@
 -
   id: 1
   name: "U2F Key"
-  user_id: 1
+  user_id: 31
   counter: 0
   created_unix: 946684800
   updated_unix: 946684800

models/fixtures/user.yml

@@ -525,3 +525,19 @@
   avatar_email: [email protected]
   num_repos: 2
   is_active: true
+
+-
+  id: 31
+  lower_name: user31
+  name: user31
+  full_name: User 31 (U2F test)
+  email: [email protected]
+  passwd: 7d93daa0d1e6f2305cc8fa496847d61dc7320bb16262f9c55dd753480207234cdd96a93194e408341971742f4701772a025a # password
+  type: 0 # individual
+  salt: ZogKvWdyEx
+  is_admin: false
+  is_restricted: true
+  avatar: avatar31
+  avatar_email: [email protected]
+  num_repos: 0
+  is_active: true

models/u2f_test.go

@@ -26,7 +26,7 @@ func TestGetU2FRegistrationByID(t *testing.T) {
 func TestGetU2FRegistrationsByUID(t *testing.T) {
 	assert.NoError(t, PrepareTestDatabase())
 
-	res, err := GetU2FRegistrationsByUID(1)
+	res, err := GetU2FRegistrationsByUID(31)
 	assert.NoError(t, err)
 	assert.Len(t, res, 1)
 	assert.Equal(t, "U2F Key", res[0].Name)

models/user_test.go

@@ -136,13 +136,13 @@ func TestSearchUsers(t *testing.T) {
 	}
 
 	testUserSuccess(&SearchUserOptions{OrderBy: "id ASC", ListOptions: ListOptions{Page: 1}},
-		[]int64{1, 2, 4, 5, 8, 9, 10, 11, 12, 13, 14, 15, 16, 18, 20, 21, 24, 27, 28, 29, 30})
+		[]int64{1, 2, 4, 5, 8, 9, 10, 11, 12, 13, 14, 15, 16, 18, 20, 21, 24, 27, 28, 29, 30, 31})
 
 	testUserSuccess(&SearchUserOptions{ListOptions: ListOptions{Page: 1}, IsActive: util.OptionalBoolFalse},
 		[]int64{9})
 
 	testUserSuccess(&SearchUserOptions{OrderBy: "id ASC", ListOptions: ListOptions{Page: 1}, IsActive: util.OptionalBoolTrue},
-		[]int64{1, 2, 4, 5, 8, 10, 11, 12, 13, 14, 15, 16, 18, 20, 21, 24, 28, 29, 30})
+		[]int64{1, 2, 4, 5, 8, 10, 11, 12, 13, 14, 15, 16, 18, 20, 21, 24, 28, 29, 30, 31})
 
 	testUserSuccess(&SearchUserOptions{Keyword: "user1", OrderBy: "id ASC", ListOptions: ListOptions{Page: 1}, IsActive: util.OptionalBoolTrue},
 		[]int64{1, 10, 11, 12, 13, 14, 15, 16, 18})

options/locale/locale_en-US.ini

@@ -632,7 +632,6 @@ twofa_enrolled = Your account has been enrolled into two-factor authentication.
 twofa_failed_get_secret = Failed to get secret.
 
 u2f_desc = Security keys are hardware devices containing cryptographic keys. They can be used for two-factor authentication. Security keys must support the <a rel="noreferrer" href="https://fidoalliance.org/">FIDO U2F</a> standard.
-u2f_require_twofa = Your account must be enrolled in two-factor authentication to use security keys.
 u2f_register_key = Add Security Key
 u2f_nickname = Nickname
 u2f_press_button = Press the button on your security key to register it.

routers/user/auth.go

@@ -197,16 +197,22 @@ func SignInPost(ctx *context.Context) {
 		}
 		return
 	}
+
 	// If this user is enrolled in 2FA, we can't sign the user in just yet.
-	// Instead, redirect them to the 2FA authentication page.
+	// Instead, we check 2FA type and redirect them to the correct 2FA authentication page.
+
+	// Check whether the user is enrolled into TOTP 2FA.
 	_, err = models.GetTwoFactorByUID(u.ID)
-	if err != nil {
-		if models.IsErrTwoFactorNotEnrolled(err) {
-			handleSignIn(ctx, u, form.Remember)
-		} else {
+	if err == nil {
+		if err := ctx.Session.Set("totpEnrolled", u.ID); err != nil {
+			ctx.ServerError("UserSignIn: Unable to set twofaUid in session", err)
+			return
+		}
+	} else {
+		if !models.IsErrTwoFactorNotEnrolled(err) {
 			ctx.ServerError("UserSignIn", err)
+			return
 		}
-		return
 	}
 
 	// User needs to use 2FA, save data and redirect to 2FA page.
@@ -223,13 +229,21 @@ func SignInPost(ctx *context.Context) {
 		return
 	}
 
+	// Check whether the user has any U2F tokens registered.
 	regs, err := models.GetU2FRegistrationsByUID(u.ID)
 	if err == nil && len(regs) > 0 {
+		// If so, redirect to the U2F page.
 		ctx.Redirect(setting.AppSubURL + "/user/u2f")
 		return
 	}
 
-	ctx.Redirect(setting.AppSubURL + "/user/two_factor")
+	// Fallback to TOTP
+	if ctx.Session.Get("twofaUid") != nil {
+		ctx.Redirect(setting.AppSubURL + "/user/two_factor")
+	}
+
+	// No two factor auth configured.
+	handleSignIn(ctx, u, form.Remember)
 }
 
 // TwoFactor shows the user a two-factor authentication page.
@@ -392,6 +406,11 @@ func U2F(ctx *context.Context) {
 		return
 	}
 
+	// See whether TOTP is also available.
+	if ctx.Session.Get("totpEnrolled") != nil {
+		ctx.Data["TotpEnrolled"] = true
+	}
+
 	ctx.HTML(200, tplU2F)
 }
 

routers/user/setting/security.go

@@ -63,12 +63,10 @@ func loadSecurityData(ctx *context.Context) {
 		}
 	}
 	ctx.Data["TwofaEnrolled"] = enrolled
-	if enrolled {
-		ctx.Data["U2FRegistrations"], err = models.GetU2FRegistrationsByUID(ctx.User.ID)
-		if err != nil {
-			ctx.ServerError("GetU2FRegistrationsByUID", err)
-			return
-		}
+	ctx.Data["U2FRegistrations"], err = models.GetU2FRegistrationsByUID(ctx.User.ID)
+	if err != nil {
+		ctx.ServerError("GetU2FRegistrationsByUID", err)
+		return
 	}
 
 	tokens, err := models.ListAccessTokens(models.ListAccessTokensOptions{UserID: ctx.User.ID})

templates/user/auth/u2f.tmpl

@@ -12,9 +12,11 @@
 				<p>{{.i18n.Tr "u2f_sign_in"}}</p>
 			</div>
 			<div id="wait-for-key" class="ui attached segment"><div class="ui active indeterminate inline loader"></div> {{.i18n.Tr "u2f_press_button"}} </div>
-			<div class="ui attached segment">
-				<a href="{{AppSubUrl}}/user/two_factor">{{.i18n.Tr "u2f_use_twofa"}}</a>
-			</div>
+			{{if .TotpEnrolled}}
+				<div class="ui attached segment">
+					<a href="{{AppSubUrl}}/user/two_factor">{{.i18n.Tr "u2f_use_twofa"}}</a>
+				</div>
+			{{end}}
 		</div>
 	</div>
 </div>

templates/user/settings/security_u2f.tmpl

@@ -3,32 +3,28 @@
 </h4>
 <div class="ui attached segment">
 	<p>{{.i18n.Tr "settings.u2f_desc" | Str2html}}</p>
-	{{if .TwofaEnrolled}}
-		<div class="ui key list">
-			{{range .U2FRegistrations}}
-			    <div class="item">
-			    	<div class="right floated content">
-			    		<button class="ui red tiny button delete-button" id="delete-registration" data-url="{{$.Link}}/u2f/delete" data-id="{{.ID}}">
-			    		{{$.i18n.Tr "settings.delete_key"}}
-			    		</button>
-			    	</div>
-			    	<div class="content">
-			    		<strong>{{.Name}}</strong>
-			    	</div>
-			    </div>
-			{{end}}
-		</div>
-		<div class="ui form">
-			{{.CsrfTokenHtml}}
-			<div class="required field">
-				<label for="nickname">{{.i18n.Tr "settings.u2f_nickname"}}</label>
-				<input id="nickname" name="nickname" type="text" required>
+	<div class="ui key list">
+		{{range .U2FRegistrations}}
+			<div class="item">
+				<div class="right floated content">
+					<button class="ui red tiny button delete-button" id="delete-registration" data-url="{{$.Link}}/u2f/delete" data-id="{{.ID}}">
+					{{$.i18n.Tr "settings.delete_key"}}
+					</button>
+				</div>
+				<div class="content">
+					<strong>{{.Name}}</strong>
+				</div>
 			</div>
-			<button id="register-security-key" class="ui green button">{{svg "octicon-key"}} {{.i18n.Tr "settings.u2f_register_key"}}</button>
+		{{end}}
+	</div>
+	<div class="ui form">
+		{{.CsrfTokenHtml}}
+		<div class="required field">
+			<label for="nickname">{{.i18n.Tr "settings.u2f_nickname"}}</label>
+			<input id="nickname" name="nickname" type="text" required>
 		</div>
-	{{else}}
-		<b>{{.i18n.Tr "settings.u2f_require_twofa"}}</b>
-	{{end}}
+		<button id="register-security-key" class="ui green button">{{svg "octicon-key"}} {{.i18n.Tr "settings.u2f_register_key"}}</button>
+	</div>
 </div>
 
 <div class="ui small modal" id="register-device">