Authenticator Login Plus (2FA)

Two-factor authentication (TOTP) for Drupal, with QR code enrollment, one-time
backup codes, delegated admin management, and a themeable setup page.

Features

• TOTP enrollment with an inline SVG QR code
  (no third-party API calls) and a manual-entry fallback
  (issuer, account name, secret key).
• One-time backup codes, issued once at enrollment and
  shown exactly once; only their hash is stored.
• Configurable OTP parameters: code length (6–8 digits),
  validity period, and clock-drift tolerance window.
• Self-service reset via a single-use, time-limited
  emailed link for users who have lost access to their authenticator.
• Enforced enrollment: optionally redirect any
  authenticated user who has not configured 2FA yet to the setup page
  before they can use the rest of the site.
• Delegated admin management: a dedicated
  manage user 2fa permission lets support staff view every
  user's 2FA status and reset, enable, or disable it, without granting
  administer site configuration or
  administer users.
• REST/JSON login support:
  /user/login?_format=json (and other serialization formats)
  requires a valid mfa_token in the request body once 2FA is
  enabled for the account, without duplicating any of core's
  credential or flood-control logic.
• Encrypted secrets at rest using AES-256-GCM, keyed by
  a value from settings.php (recommended) or an
  auto-generated key stored in State.
• Themeable setup page: an opt-out card-style CSS design
  that can be turned off in favor of plain Drupal form styling, or
  overridden entirely via the
  auth_login_plus_setup_page theme hook.
• Drush command to reset a user's enrollment from the
  command line.

Configuration

1. Enable the module.
2. Go to
   
   Administration » Configuration » People »
   Authenticator Login Plus settings
   
   (/admin/config/people/auth_login_plus/settings)
   and review the following settings:
   • Enable two-factor authentication —
     the global kill switch. When disabled, no OTP challenge is issued
     anywhere on the site.
   • Use the custom setup page design —
     toggles the bundled card-style CSS on the setup, login-challenge,
     and status pages. The copy-to-clipboard button continues to work
     either way.
   • Issuer name —
     the name shown in the authenticator app. If left blank, the site
     name is used by default.
   • One-time code parameters —
     configure the code length, validity period, and clock-drift
     tolerance.
   • User self-service —
     configure whether users can enable or disable 2FA themselves,
     whether backup codes are issued, how many are generated, whether
     the emailed self-service reset link is available, and where users
     are redirected after a successful challenge.
   • Enforcement —
     force users who have not configured 2FA to the setup page and
     configure the message shown when this happens.
3. Set a permanent
   encryption key
   in settings.php before going to production.
4. Grant the manage user 2fa permission to the role that should
   be able to support end users, such as a helpdesk or support role.
   See Permissions.

Drush commands

drush auth-login-plus:reset <uid>;

Resets the given user's enrollment, including their secret and backup codes,
from the command line. This has the same effect as the admin overview's
“Reset” action.