This Django app add’s two factor authentication to Wagtail. Behind the scenes it use django-otp which supports Time-based One-Time Passwords (TOTP). This allows you to use various apps like Authy, Google Authenticator, or 1Password.
Installation
pip install wagtail-2faThen add the following lines to the INSTALLED_APPS list in your Django settings:
INSTALLED_APPS = [
# ...
'wagtail_2fa',
'django_otp',
'django_otp.plugins.otp_totp',
# ...
]Add the following line to the MIDDLEWARE list in your Django settings:
MIDDLEWARE = [
# ...
'wagtail_2fa.middleware.VerifyUserMiddleware',
# ...
]Migrate your database:
python manage.py migrateNext add the required middleware to the MIDDLEWARE. It should come after the AuthenticationMiddleware:
MIDDLEWARE = [
# .. other middleware
# 'django.contrib.auth.middleware.AuthenticationMiddleware',
'wagtail_2fa.middleware.VerifyUserMiddleware',
# 'wagtail.core.middleware.SiteMiddleware',
# .. other middleware
]Settings
The following settings are available (Set via your Django settings):
WAGTAIL_2FA_REQUIRED (default False): When set to True all staff, superuser and other users with access to the Wagtail Admin site are forced to login using two factor authentication.
WAGTAIL_MOUNT_PATH (default: ''): The uWSGI mount point that Wagtail is running at. Ex. /wagtail
WAGTAIL_2FA_OTP_TOTP_NAME (default: False): The issuer name to identify which site is which in your authenticator app. If not set and WAGTAIL_SITE_NAME is defined it uses this. sets OTP_TOTP_ISSUER under the hood.
Making 2FA optional
With the default VerifyUserMiddleware middleware, 2FA is enabled for every user. To make 2FA optional, use the VerifyUserPermissionsMiddleware middleware instead.
To do so, use the VerifyUserPermissionsMiddleware middleware instead of the VerifyUserMiddleware in your Django settings:
MIDDLEWARE = [
# ...
# 'wagtail_2fa.middleware.VerifyUserMiddleware',
'wagtail_2fa.middleware.VerifyUserPermissionsMiddleware',
# ...
]When this middleware is used, a checkbox is added to the group permissions and 2FA can be enabled or disabled per group.
2FA is always enabled for superusers, regardless of the middleware used.
Sandbox
First create a new virtualenv with Python 3.6.1 and activate it. Then run the following commands:
make sandbox
You can then visit http://localhost:8000/admin/ and login with the following credentials:
E-mail: superuser@example.com
Password: testing
5 maintainers
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file wagtail-2fa-1.3.2.tar.gz.
File metadata
- Download URL: wagtail-2fa-1.3.2.tar.gz
- Upload date:
- Size: 16.3 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
- Uploaded via:
twine/3.1.0 pkginfo/1.5.0.1 requests/2.22.0 setuptools/40.8.0 requests-toolbelt/0.9.1 tqdm/4.39.0 CPython/3.7.3
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
84dd8229c60be902a93d61d6e512095e48744be8e819f17fbf7ed908eac636da
|
|
| MD5 |
f3b30b0820245c5d771dcf5d531d1e5d
|
|
| BLAKE2b-256 |
5a63523b2d486b5ae93ac30be296c4f51c5f3f29193b9a5a4f4aaf4aa26e456d
|
File details
Details for the file wagtail_2fa-1.3.2-py3-none-any.whl.
File metadata
- Download URL: wagtail_2fa-1.3.2-py3-none-any.whl
- Upload date:
- Size: 21.8 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? No
- Uploaded via:
twine/3.1.0 pkginfo/1.5.0.1 requests/2.22.0 setuptools/40.8.0 requests-toolbelt/0.9.1 tqdm/4.39.0 CPython/3.7.3
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
1aba56377c34f116815da314ae57ffbf9909a57d76ec039b386a3dcc5919aa02
|
|
| MD5 |
30169245ea9b934cf5bda2bc6fbdf330
|
|
| BLAKE2b-256 |
788e5ac6975991c1905c8069b4abfd231743a5ceac72cf16cf245f1ef5a97937
|
