Feature addition: Multi-Factor Authentication #401

chesspro13 · 2024-09-07T17:26:11Z

Features added

TOTP (Time-based One-Time Password) with recovery codes
OpenID/SSO via Google (for now)

Documentation

Testing Instructions

TOTP

Start Trilium Notes normally.
Go to "Menu" -> "Options" -> "MFA"
Click the "Generate TOTP Secret" button
Copy the generated secret to your authentication app/extension

Set an environment variable "TOTP_SECRET" as the generated secret. Environment variables can be set with a .env file in the root directory, by defining them in the command line, or with a docker container.

# .env in the project root directory
TOTP_ENABLED="true"
TOTP_SECRET="secret"

# Terminal/CLI
export TOTP_ENABLED="true"
export TOTP_SECRET="secret"

# Docker
docker run -p 8080:8080 -v ~/trilium-data:/home/node/trilium-data -e TOTP_ENABLED="true" -e TOTP_SECRET="secret" triliumnext/notes:[VERSION]

Restart Trilium
Go to "Options" -> "MFA"
Click the "Generate Recovery Codes" button
Save the recovery codes. Recovery codes can be used once in place of the TOTP if you loose access to your authenticator. After a rerecovery code is used, it will show the unix timestamp when it was used in the MFA options tab.
Load the secret into an authentication app like google authenticator

OpenID

Currently only compatible with Google. Other services like Authentik and Auth0 are planned on being added.

In order to setup OpenID, you will need to setup a authentication provider. This requires a bit of extra setup. Follow these instructions to setup an OpenID service through google.

Set an environment variable "SSO_ENABLED" to true and add the client ID and secret you obtained from google. Environment variables can be set with a .env file in the root directory, by defining them in the command line, or with a docker container.

.env File

# .env in the project root directory
SSO_ENABLED="true"
BASE_URL="http://localhost:8080"
CLIENT_ID=<client ID from google>
SECRET=<client secret from google>

Environment variable (linux)

export SSO_ENABLED="true"
export BASE_URL="http://localhost:8080"
export CLIENT_ID=<client ID from google>
export SECRET=<client secret from google>

Docker

docker run -d -p 8080:8080 -v ~/trilium-data:/home/node/trilium-data -e SSO_ENABLED="true" -e BASE_URL="http://localhost:8080" -e CLIENT_ID=<client ID from google> -e SECRET=<client secret from google> triliumnext/notes:[VERSION]

After you restart Trilium Notes, you will be redirected to Google's account selection page. Login to an account and Trilium Next will bind to that account, allowing you to login with it.

You can now login using your google account.

perfectra1n · 2024-09-07T23:00:18Z

This is super cool, thanks for doing this.

Is it also possible to configure the .env variables via the local environment variables? I was poking around in the commits, and didn't see any documentation modified for this change, but I'm assuming that you're saving those changes for once someone else with a much bigger brain than myself reviews it! :)

I'll also review the additional routes for the OTP.

chesspro13 · 2024-09-07T23:28:32Z

@perfectra1n the environment variables can be set with environment variables (ie export TOTP_ENABLED="true"), -e with docker, and in a .env file in the root directory.

Honestly I forgot to update documentation. Whoops!

edit: I'm working on adding some pages now.

chesspro13 · 2024-09-09T18:47:22Z

@perfectra1n

Docs complete here.

chesspro13 · 2024-09-14T17:32:51Z

Since you are adding a new table, and it doesn't add it automatically. I got an error here:

@JYC333 I was able to reproduce this and fix it.

No, I mean the database version for the syncing, I think the database version should be the same bewteen client and server. So the previous Trilium (like 0.63.7) won't be compatible. But I see sync version here also, so I'm not sure whether I'm right.

I'll have to look into that. I'm not familiar with the client version.

@perfectra1n When I build docker it is successful, however the setup page doesn't render any text when I tried it again.

It's only behaving this was for the Docker image.

Both mobile.ejs and set_passowrd.ejs have some too, but there are none in login.ejs. The only one I made modifications to is login.ejs.

chesspro13 · 2024-09-14T17:47:18Z

@perfectra1n it looks like the t is part of the i18next package for translations.

const t: TFunction<["translation", ...string[]], undefined>

perfectra1n · 2024-09-14T18:19:08Z

Hmm, I wonder why it's throwing an error then, @eliandoran do you have any idea why by chance?

chesspro13 · 2024-09-14T18:25:56Z

@perfectra1n I can confirm that i18next is what is causing the text to not render. I'm unable to replicate your error. Have you updated all packages with npm i after switching to the new branch?

perfectra1n · 2024-09-14T18:27:58Z

I can confirm that I did not, but I believe those commands are built within the Docker container without cache -- so you can't replicate the issue when using the Docker container?

chesspro13 · 2024-09-14T18:51:57Z

so you can't replicate the issue when using the Docker container?

@JYC333 I can't replicate your issue. When I build the docker image it runs, but when I navigate to localhost:8080/setup no text is rendered (the picture I posted above). I think we are both having issues with the same package, but I'm still confused why we are getting different results since we are using docker. I may be wildly wrong, but I'm guessing i18next needs to be installed prior to running the docker build script because the typescript gets compiled in build-docker.sh and copied to the container afterwards in the Dockerfile. My guess is it throws off the translations. ¯\(ツ)/¯

JYC333 · 2024-09-15T07:41:50Z

so you can't replicate the issue when using the Docker container?

@JYC333 I can't replicate your issue. When I build the docker image it runs, but when I navigate to localhost:8080/setup no text is rendered (the picture I posted above). I think we are both having issues with the same package, but I'm still confused why we are getting different results since we are using docker. I may be wildly wrong, but I'm guessing i18next needs to be installed prior to running the docker build script because the typescript gets compiled in build-docker.sh and copied to the container afterwards in the Dockerfile. My guess is it throws off the translations. ¯_(ツ)_/¯

Sorry I didn't follow here, is the issue here you for the database issue?

And I didn't try to start with docker, I always run with npm run start-server for development, not sure what's the behaviors when using docker.

eliandoran · 2024-09-15T08:02:05Z

@perfectra1n I can confirm that i18next is what is causing the text to not render. I'm unable to replicate your error. Have you updated all packages with npm i after switching to the new branch?

There are still some bugs related to internationalization of the server that I'm trying to fix. If it occurs on 'develop' as well it can be ignored for this particular PR.

perfectra1n · 2024-09-27T05:01:57Z

@chesspro13 is this still good for testing? :)

I wonder what commits I would have to cherry pick to get the Docker container to build, or how would be best to test it...what have you been doing thus far to test it on your branch?

chesspro13 · 2024-09-29T23:32:44Z

so you can't replicate the issue when using the Docker container?

@JYC333 I can't replicate your issue. When I build the docker image it runs, but when I navigate to localhost:8080/setup no text is rendered (the picture I posted above). I think we are both having issues with the same package, but I'm still confused why we are getting different results since we are using docker. I may be wildly wrong, but I'm guessing i18next needs to be installed prior to running the docker build script because the typescript gets compiled in build-docker.sh and copied to the container afterwards in the Dockerfile. My guess is it throws off the translations. ¯_(ツ)_/¯

@perfectra1n I tried it in my dev environment as well as on a fresh VM today. The only issue I have is the one with i18next and text not showing up in the setup screen. What OS are you using?

@JYC333 I got the conversations mixed up. That last message I tagged you in was probably supposed to tag @perfectra1n.

Been busy with work related projects and school.

minecraftchest1 · 2024-10-30T13:09:34Z

src/services/open_id.ts

+    auth0Logout: false,
+    baseURL: process.env.BASE_URL,
+    clientID: process.env.CLIENT_ID,
+    issuerBaseURL: "https://accounts.google.com/.well-known/openid-configuration",


Make issuerBaseUrl load process.env.OPENID_CONFIG_URL', and now you have support for more services for OpenID Connect. would also prefix all of the Openid Connect related variables with something like OIDC_' or similar to prevent conflicts.

JeffrinCh · 2024-11-04T18:33:07Z

package.json

@@ -69,6 +69,7 @@
    "dayjs": "^1.11.13",
    "dayjs-plugin-utc": "0.1.2",
    "debounce": "^2.1.0",
+    "dotenv": "^16.4.5",


chesspro13 Do we need dotenv now? we can use the inbuilt functionality of nodejs now https://nodejs.org/en/learn/command-line/how-to-read-environment-variables-from-nodejs

eliandoran · 2024-12-10T21:39:28Z

Hi, @chesspro13 .

What's the status of this PR, do you have the time to work on it?

pano9000 · 2024-12-17T17:31:13Z

quick comment on the env naming:

I personally feel like the env vars should be prefixed with some sort of code, to make sure they are clearly belonging to TriliumNext - which will reduce the chance of accidentally resetting/overwriting these.

E.g. instead of TOTP_ENABLED maybe it could be TRILIUMNEXT_TOTP_ENABLED or just TRILIUM_TOTP_ENABLED

What do you think?

pano9000 · 2025-01-13T20:07:32Z

quick other remark: since this project seems to use ini files for setting some config options, I would think it makes sense to continue using the existing solution here as well, instead of going to the .env file way.

(Admittedly: yes, it also uses optional env variables, but these are e.g. used to "point" to the data-dir (via TRILIUM_DATA_DIR), where the ini file lies (or gets created, if not existing))

https://github.com/TriliumNext/Notes/blob/develop/config-sample.ini

what do you think?

chesspro13 · 2025-02-02T04:03:17Z

@eliandoran I think I'm fairly close to closing up my personal project that pulled me away from working on Trilium, so I should be back here sometime this month.

@pano9000 I'll look into implementing it that way. I didn't particularly like using .env, so that seems like a good solution.

Ported from branch OIDC

9c748f3

chesspro13 linked an issue Sep 7, 2024 that may be closed by this pull request

(Feature request) Multi-factor authentication #68

Open

chesspro13 added 12 commits September 7, 2024 11:41

TOTP working

e232c66

Fixed login errors

37b4bf6

Changed Verification order.

494721f

Added package-lock.json

1a8625b

OAuth working

c74da18

Removed references to disconnecting OpenID Accounts. For now.

df3cbf8

Removed unused script

d763960

Removed outdated comments

13937a2

Removed unused files/code/imports/comments.

9dd185e

Fixed recovery code refresh bug.

ede7bbd

Disabled TOTP checkbox

06da11f

Simplified .env

55b0f0e

chesspro13 marked this pull request as ready for review September 7, 2024 22:17

chesspro13 requested review from adoriandoran and a team September 7, 2024 22:18

chesspro13 added the enhancement label Sep 7, 2024

chesspro13 mentioned this pull request Sep 9, 2024

Feature addition: Updated MFA [Docs] TriliumNext/Docs#108

Merged

chesspro13 added 4 commits September 9, 2024 12:01

Added check for running both OpenID and TOTP at the same time.

d8c8fe0

Changed wording from "Regerate TOTP Secret" to "Generate TOTP Secret"

953f539

Added OpenID and TOTP to readme

fa5c5ce

Merge branch 'develop' into feature/MFA

2e21a45

chesspro13 mentioned this pull request Sep 10, 2024

Feature addition: Multi-Factor Authentication #163

Closed

chesspro13 requested review from eliandoran and removed request for adoriandoran September 10, 2024 19:21

chesspro13 changed the title ~~Feature addition: Updated MFA~~ Feature addition: Multi-Factor Authentication Sep 12, 2024

minecraftchest1 reviewed Oct 30, 2024

View reviewed changes

JeffrinCh reviewed Nov 4, 2024

View reviewed changes

eliandoran added 3 commits December 24, 2024 13:30

Merge remote-tracking branch 'origin/develop' into feature/MFA

2eb4d4f

feat(client/mfa): improve layout by separating into multiple sections

e20e53f

feat(client/mfa): improve headings

0916d87

eliandoran removed the enhancement label Jan 28, 2025

JYC333 added 10 commits March 22, 2025 12:35

Merge branch 'develop' into feature/MFA

8df1e32

feat: 🎸 fix ts error

fdc10d0

feat: 🎸 remove conflict code

0871d16

feat: 🎸 fix open_id error

b320553

feat: 🎸 fix recovery_codes error

c8164c8

feat: 🎸 Fix ts compile error

9d49546

Merge branch 'develop' into feature/MFA

c3d3ab4

feat: 🎸 Fix option defintions

54a5f81

feat: 🎸 Port MFA to ts

717ad3b

feat: 🎸 Reformat MFA option page

e3fb871

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature addition: Multi-Factor Authentication #401

Feature addition: Multi-Factor Authentication #401

chesspro13 commented Sep 7, 2024 •

edited

Loading

perfectra1n commented Sep 7, 2024

chesspro13 commented Sep 7, 2024 •

edited

Loading

chesspro13 commented Sep 9, 2024 •

edited

Loading

chesspro13 commented Sep 14, 2024 •

edited

Loading

chesspro13 commented Sep 14, 2024 •

edited

Loading

perfectra1n commented Sep 14, 2024

chesspro13 commented Sep 14, 2024 •

edited

Loading

perfectra1n commented Sep 14, 2024 •

edited

Loading

chesspro13 commented Sep 14, 2024 •

edited

Loading

JYC333 commented Sep 15, 2024

eliandoran commented Sep 15, 2024

perfectra1n commented Sep 27, 2024

chesspro13 commented Sep 29, 2024 •

edited

Loading

minecraftchest1 Oct 30, 2024 •

edited

Loading

JeffrinCh Nov 4, 2024 •

edited

Loading

eliandoran commented Dec 10, 2024

pano9000 commented Dec 17, 2024

pano9000 commented Jan 13, 2025

chesspro13 commented Feb 2, 2025

Feature addition: Multi-Factor Authentication #401

Are you sure you want to change the base?

Feature addition: Multi-Factor Authentication #401

Conversation

chesspro13 commented Sep 7, 2024 • edited Loading

Testing Instructions

TOTP

OpenID

.env File

Environment variable (linux)

Docker

perfectra1n commented Sep 7, 2024

chesspro13 commented Sep 7, 2024 • edited Loading

chesspro13 commented Sep 9, 2024 • edited Loading

chesspro13 commented Sep 14, 2024 • edited Loading

chesspro13 commented Sep 14, 2024 • edited Loading

perfectra1n commented Sep 14, 2024

chesspro13 commented Sep 14, 2024 • edited Loading

perfectra1n commented Sep 14, 2024 • edited Loading

chesspro13 commented Sep 14, 2024 • edited Loading

JYC333 commented Sep 15, 2024

eliandoran commented Sep 15, 2024

perfectra1n commented Sep 27, 2024

chesspro13 commented Sep 29, 2024 • edited Loading

minecraftchest1 Oct 30, 2024 • edited Loading

Choose a reason for hiding this comment

JeffrinCh Nov 4, 2024 • edited Loading

Choose a reason for hiding this comment

eliandoran commented Dec 10, 2024

pano9000 commented Dec 17, 2024

pano9000 commented Jan 13, 2025

chesspro13 commented Feb 2, 2025

chesspro13 commented Sep 7, 2024 •

edited

Loading

chesspro13 commented Sep 7, 2024 •

edited

Loading

chesspro13 commented Sep 9, 2024 •

edited

Loading

chesspro13 commented Sep 14, 2024 •

edited

Loading

chesspro13 commented Sep 14, 2024 •

edited

Loading

chesspro13 commented Sep 14, 2024 •

edited

Loading

perfectra1n commented Sep 14, 2024 •

edited

Loading

chesspro13 commented Sep 14, 2024 •

edited

Loading

chesspro13 commented Sep 29, 2024 •

edited

Loading

minecraftchest1 Oct 30, 2024 •

edited

Loading

JeffrinCh Nov 4, 2024 •

edited

Loading