Single TOTP for multiple subdomains

[alpha-pix]

Make it possible to use the same username, password and TOTP secret across multiple subdomains of the same company.

[calvinalkan]

There is no way to have that natively in Fortress.

Fortress has no way of knowing what other sites you are using.

That said, it's very much possible if you use the same Secrets for each "related" site.

[alpha-pix]

Understood. I'm not familiar with the process for creating a TOTP QR code, but I assume that even with the same site and underlying hash/resources, setting up a new TOTP will always result in a different one, so there would need to be a way to register an existing TOTP from one site with another?

[calvinalkan]

If your Fortress secrets are the same, you'd only need one setup for all sites.

Each six-digit code will then be valid for all sites.

[alpha-pix]

Cool, so it is just a question of setting up on the bare domain, then copying the secrets to relevant users on subdomains, and they will just work? Can you do a brief HowTo for what to copy?

[calvinalkan]

Correct, the storage type and location depends on your hosting integration.

[alpha-pix]

In that file, I have
define("SNICCO_FORTRESS_PASSWORD_ENCRYPTION_KEY_HEX","0000");
define("SNICCO_FORTRESS_DEVICE_ID_AUTHENTICATION_KEY_HEX","0000");
define("SNICCO_FORTRESS_TOTP_ENCRYPTION_SECRET_HEX","0000");
define("SNICCO_FORTRESS_LIBSODIUM_GENERIC_HASH_KEY_HEX","0000");
define("SNICCO_FORTRESS_LIBSODIUM_GENERIC_ENCRYPTION_KEY_HEX","0000");

Are you saying copy just SNICCO_FORTRESS_TOTP_ENCRYPTION_SECRET_HEX from source to target and all users set up with TOTP on target will stop being able to use their earlier target TOTPs, and the source one will take over? and no other dependencies? Or if more of those keys must be copied over, does that affect existing passwords?

[calvinalkan]

This is going a bit into the weeds, the "safest" way to will always work is to copy all secrets, or maybe create a symlink if they are on the same server.

The site that "receives" the new secrets will need a password reset for all users and a TOTP reset for all users.

Currently, these two are used for TOTP:

define("SNICCO_FORTRESS_TOTP_ENCRYPTION_SECRET_HEX","0000");
define("SNICCO_FORTRESS_LIBSODIUM_GENERIC_HASH_KEY_HEX","0000");

While this one:

define("SNICCO_FORTRESS_PASSWORD_ENCRYPTION_KEY_HEX","0000");

is used for passwords.

But I can't guarantee that that will always be the case.

Is there any good reason not to use all secrets in sync?

The "only" downside is that passwords must be reset on the other, non-source sites.

[alpha-pix]

Yes that was more or less what I feared. I was hoping not to need to reset customer passwords. We have 2 separate sites that customers log into. Shop with c.6k accounts and the main domain with only 300. I can see which direction this is going...
I'm guessing that if I hadn't just bulk updated the 6k passwords it would be the other way round.

[alpha-pix]

If I understand it right from this, then a user account with the same username will always produce the same TOTP QR code if those secrets are the same on both sites? I had previously assumed there was some kind of random input that would mean resetting the TOTP QR would result in a different set if 6-figure codes.
This opens the theoretical possibility that a new user on one site could choose the username of someone else on the other site and receive the same TOTPs.

[calvinalkan]

You are 100% right...

I replied to this late at night and did not question the premise to begin with.

Of course, every TOTP configuration is encrypted and UNIQUE (randomly).

You'd also need to sync the database table for the TOTP secrets.

There are ways to make Fortress use a custom (centralized) storage of TOTP secrets.

But that is custom development territory and not currently documented.