Support for u2f and otp simultaneously

[markojak]

Hi All,

Would it be possible to support both OTP and U2F as authentication mechanisms? We have some users who have U2F and some who would prefer use an Authenticator application on their phones.

Thoughts?
Happy to do a Fork and try to help with the implementation of this if someone can also point me in the right direction.

[francislavoie]

Definitely +1 for this. For example, Dropbox attempts U2F first by default, with a link to fallback to TOTP if the user chooses. Enforcing one or the other isn't the best scheme - U2F is easier if your device is already plugged in, but OTP can be easier if you don't.

[gclawes]

+1 for this, as well as being able to change U2F/OTP tokens from the web UI after account creation.

[dadicool]

+1 on this, I am not enabling U2F on our setup because I can't mandate everybody to have a key.

[aberoham]

+1 for a very similar request, support both at once. Via an end-user: "Is it possible to use a Yubikey to provide the Teleport user passsword at login, as well as the two factor authentication token?"

[gclawes]

Kinda defeats the point of 2-factor auth, having 2 separate sources of authentication secrets. You'd get the same level of security just storing the normal password in the yubikey and disabling u2f mode.

[mpitt]

+1, we cannot force all our users to switch to U2F, but we would still like to offer the option

[awly]

#1929 is a superset of this request, closing this one.
We'll aim to get this fixed in 5.0 (in ~1-2 months from now).