Can Authentik be used withouth a login/password, and ONLY using a
TOTP? (AKA: How can I have cloudflare tunnels authenticate with TOTP
only, but not via email?)
reddit / selfhosted

----------------------------------------------------------------------
jschwalbe · 2023-12-21 23:37

Here's my scenario: I'm accessing an application via cloudflare
tunnels. Currently when accessing the URL, cloudflare interrupts and
asks for an email address. IFF the email address is my own personal
email address, then cloudflare emails me a 6 digit code. Only after
entering that code am I redirected to my application (where I need to
actually login).

*I don't want to have to check my email*. I want to enter the TOTP
code from the authenticator app on my phone. No need for email, right?
How?

I'm currently trying this with Authentik. It's working, sort of.. but
with full username and password (not via TOTP only). Is there a way to
make it work without user/pass, and only with the TOTP that I have on
my phone? Thanks!

----------------------------------------------------------------------
ericesev · 2023-12-22 00:04

How would Authentik know which user's TOTP to use if a username and
password isn't entered first? And if only TOTP is used instead of a
password, it'll only take a computer seconds to brute-force a 6 digit
TOTP code.

----------------------------------------------------------------------
jschwalbe · 2023-12-22 00:12

Doesn’t have to be authentik.

- It’s no less safe than what cloudflare currently does (emails me a 6
digit code).
- It’s 10^6 possible passcodes, and by nature of TOTP, it changes
every 30 seconds. So I don’t think brute forcing over the internet is
really a concern. Maybe 2 guesses per second(?) if my internet is fast
(it’s not). And that’s without any sort of limit to the number of
guesses.
- Knowing which user account? There’s only me, so that’s not a huge
issue.

That’s for the thoughts!

----------------------------------------------------------------------
myeyehurtsrn · 2023-12-22 07:15

I don't think Authentik will let you do just your email & then your
TOTP code without entering your password.

You could however set up passwordless login & have a passkey on your
device/password manager. Then you can have the 2fa as your TOTP code?
That way you wouldn't need to enter your email or password

----------------------------------------------------------------------
justinillusion · 2023-12-22 07:50

You can setup a passwordless login for authentik

https://youtu.be/aEpT2fYGwLw?si=UAt4y79mLEJ1z2aa

----------------------------------------------------------------------
BeryJu · 2023-12-22 10:50

You can in theory set this up with authentik with policies that
basically skip the password stage, however as other people already
recommend, it's probably better to use Passwordless WebAuthn/Passkeys,
which with the right setup will let you login without having to enter
anything