Feature addition: Multi-Factor Authentication #401

chesspro13 · 2024-09-07T17:26:11Z

Features added

TOTP (Time-based One-Time Password) with recovery codes
OpenID/SSO via Google (for now)

Documentation

Testing Instructions

TOTP

Start Trilium Notes normally.
Go to "Menu" -> "Options" -> "MFA"
Click the "Generate TOTP Secret" button
Copy the generated secret to your authentication app/extension

Set an environment variable "TOTP_SECRET" as the generated secret. Environment variables can be set with a .env file in the root directory, by defining them in the command line, or with a docker container.

# .env in the project root directory
TOTP_ENABLED="true"
TOTP_SECRET="secret"

# Terminal/CLI
export TOTP_ENABLED="true"
export TOTP_SECRET="secret"

# Docker
docker run -p 8080:8080 -v ~/trilium-data:/home/node/trilium-data -e TOTP_ENABLED="true" -e TOTP_SECRET="secret" triliumnext/notes:[VERSION]

Restart Trilium
Go to "Options" -> "MFA"
Click the "Generate Recovery Codes" button
Save the recovery codes. Recovery codes can be used once in place of the TOTP if you loose access to your authenticator. After a rerecovery code is used, it will show the unix timestamp when it was used in the MFA options tab.
Load the secret into an authentication app like google authenticator

OpenID

Currently only compatible with Google. Other services like Authentik and Auth0 are planned on being added.

In order to setup OpenID, you will need to setup a authentication provider. This requires a bit of extra setup. Follow these instructions to setup an OpenID service through google.

Set an environment variable "SSO_ENABLED" to true and add the client ID and secret you obtained from google. Environment variables can be set with a .env file in the root directory, by defining them in the command line, or with a docker container.

.env File

# .env in the project root directory
SSO_ENABLED="true"
BASE_URL="http://localhost:8080"
CLIENT_ID=<client ID from google>
SECRET=<client secret from google>

Environment variable (linux)

export SSO_ENABLED="true"
export BASE_URL="http://localhost:8080"
export CLIENT_ID=<client ID from google>
export SECRET=<client secret from google>

Docker

docker run -d -p 8080:8080 -v ~/trilium-data:/home/node/trilium-data -e SSO_ENABLED="true" -e BASE_URL="http://localhost:8080" -e CLIENT_ID=<client ID from google> -e SECRET=<client secret from google> triliumnext/notes:[VERSION]

After you restart Trilium Notes, you will be redirected to Google's account selection page. Login to an account and Trilium Next will bind to that account, allowing you to login with it.

You can now login using your google account.

perfectra1n · 2024-09-07T23:00:18Z

This is super cool, thanks for doing this.

Is it also possible to configure the .env variables via the local environment variables? I was poking around in the commits, and didn't see any documentation modified for this change, but I'm assuming that you're saving those changes for once someone else with a much bigger brain than myself reviews it! :)

I'll also review the additional routes for the OTP.

chesspro13 · 2024-09-07T23:28:32Z

@perfectra1n the environment variables can be set with environment variables (ie export TOTP_ENABLED="true"), -e with docker, and in a .env file in the root directory.

Honestly I forgot to update documentation. Whoops!

edit: I'm working on adding some pages now.

chesspro13 · 2024-09-09T18:47:22Z

@perfectra1n

Docs complete here.

JYC333

Thanks for your great work! I didn't finish testing the functionality, but the setup steps need some changes I believe.

Since you are adding a new table, and it doesn't add it automatically. I got an error here:

I'm not sure whether I'm doing something wrong, if not, I think this PR also need to fix the database migration stuff.

I don't know exactly how the database version is handled in Trilium, but for syncing, the database version should be the same. So after we merge this PR, it won't compatible with the latest Trilium from Zadam. (Correct me if I'm wrong) It could be the first big step for TriliumNext, not sure how careful we should be hhh.

Some minor stuffs I find so far:

MFA in option doesn't in the "right" place if I already have a database (I mean not start from scratch).
We have already upgrade bootstrap from v4 to v5, so some layouts are changed. Not sure whether you would like to fix it in this PR, it's ok to do it in a seperate PR I guess.

chesspro13 · 2024-09-13T16:36:33Z

@JYC333 I'll take any feedback I can get!

Since you are adding a new table, and it doesn't add it automatically. I got an error here:

I do have a way to create the table if it doesn't exist, however it looks like it's in the wrong place since you got that error. I'll add it to the startup sequence.

I don't know exactly how the database version is handled in Trilium, but for syncing, the database version should be the same. So after we merge this PR, it won't compatible with the latest Trilium from Zadam. (Correct me if I'm wrong) It could be the first big step for TriliumNext, not sure how careful we should be hhh.

Do you mean the versioning change from BetterSqlite3? That was changed earlier with the dependency cleanup.

1. MFA in option doesn't in the "right" place if I already have a database (I mean not start from scratch).
2. We have already upgrade bootstrap from v4 to v5, so some layouts are changed. Not sure whether you would like to fix it in this PR, it's ok to do it in a seperate PR I guess.

I will look into it, but honestly my UI/UX skills are nothing to write home about.

JYC333 · 2024-09-13T17:10:43Z

Do you mean the versioning change from BetterSqlite3? That was changed earlier with the dependency cleanup.

No, I mean the database version for the syncing, I think the database version should be the same bewteen client and server. So the previous Trilium (like 0.63.7) won't be compatible. But I see sync version here also, so I'm not sure whether I'm right.

I will look into it, but honestly my UI/UX skills are nothing to write home about.

You can also leave this for later if you don't want spend too much time on this, I can help with this.

perfectra1n · 2024-09-13T18:25:03Z

I'm also not sure if it's just me, but running the branch on a brand new instance brings the following errors when navigating to the setup page:

{"message":"/usr/src/app/src/views/setup.ejs:6\n    4|     <meta charset=\"utf-8\">\n    5|     <meta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1\">\n >> 6|     <title><%= t(\"setup.title\") %></title>\n    7| \n    8|     <style>\n    9|         .lds-ring {\n\nt is not defined"}

Full output of the Docker run command:

[root on DESKTOP-M0FBO5A] ~
 »  docker run -v /root/triliumtest:/home/node/trilium-data -p 8080:8080 gitea.example.com/perf3ct/testnotes:mfatest
No USER_UID specified, leaving 1000
No USER_GID specified, leaving 1000
(node:9) ExperimentalWarning: Importing JSON modules is an experimental feature and might change at any time
(Use `node --trace-warnings ...` to show where the warning was created)
Generated session secret
DB not initialized, please visit setup page - http://[your-server-host]:8080 to see instructions on how to initialize Trilium.
DB size: 4 KB
(node:9) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
{
  "appVersion": "0.90.6-beta",
  "dbVersion": 228,
  "nodeVersion": "v22.8.0",
  "syncVersion": 32,
  "buildDate": "2024-09-07T18:36:34Z",
  "buildRevision": "7c0d6930fa8f20d269dcfbcbc8f636a25f6bb9a7",
  "dataDirectory": "/home/node/trilium-data",
  "clipperProtocolVersion": "1.0",
  "utcDateTime": "2024-09-13T18:23:05.503Z"
}
CPU model: AMD Ryzen 7 5800X 8-Core Processor, logical cores: 16, freq: 0 Mhz
Trusted reverse proxy: false
App HTTP server starting up at port 8080
Listening on port 8080
200 GET /api/health-check with 15 bytes took 3ms
ReferenceError: /usr/src/app/src/views/setup.ejs:6
    4|     <meta charset="utf-8">
    5|     <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
 >> 6|     <title><%= t("setup.title") %></title>
    7|
    8|     <style>
    9|         .lds-ring {

t is not defined
    at eval ("/usr/src/app/src/views/setup.ejs":12:7)
    at setup (/usr/src/app/node_modules/ejs/lib/ejs.js:703:17)
    at tryHandleCache (/usr/src/app/node_modules/ejs/lib/ejs.js:274:36)
    at exports.renderFile [as engine] (/usr/src/app/node_modules/ejs/lib/ejs.js:491:10)
    at View.render (/usr/src/app/node_modules/express/lib/view.js:135:8)
    at tryRender (/usr/src/app/node_modules/express/lib/application.js:657:10)
    at Function.render (/usr/src/app/node_modules/express/lib/application.js:609:3)
    at ServerResponse.render (/usr/src/app/node_modules/express/lib/response.js:1048:7)
    at setupPage (file:///usr/src/app/src/routes/setup.js:24:9)
    at Function.cb (file:///usr/src/app/src/routes/routes.js:377:34) {
  path: '/usr/src/app/src/views/setup.ejs'
}
200 GET /api/health-check with 15 bytes took 0ms
200 GET /api/health-check with 15 bytes took 1ms

I checked out the feature/MFA branch and then built the Docker container on it 👀

perfectra1n · 2024-09-13T18:25:43Z

Oh, looks like it might be a fatfinger somewhere with the t in setup.ejs lol

perfectra1n · 2024-09-14T17:25:23Z

Yeah I'm not sure why it can't find what t is supposed to be, here, does it work for you when you create the Docker container @chesspro13 ?

chesspro13 · 2024-09-14T17:32:51Z

Since you are adding a new table, and it doesn't add it automatically. I got an error here:

@JYC333 I was able to reproduce this and fix it.

No, I mean the database version for the syncing, I think the database version should be the same bewteen client and server. So the previous Trilium (like 0.63.7) won't be compatible. But I see sync version here also, so I'm not sure whether I'm right.

I'll have to look into that. I'm not familiar with the client version.

@perfectra1n When I build docker it is successful, however the setup page doesn't render any text when I tried it again.

It's only behaving this was for the Docker image.

Both mobile.ejs and set_passowrd.ejs have some too, but there are none in login.ejs. The only one I made modifications to is login.ejs.

chesspro13 · 2024-09-14T17:47:18Z

@perfectra1n it looks like the t is part of the i18next package for translations.

const t: TFunction<["translation", ...string[]], undefined>

perfectra1n · 2024-09-14T18:19:08Z

Hmm, I wonder why it's throwing an error then, @eliandoran do you have any idea why by chance?

chesspro13 · 2024-09-14T18:25:56Z

@perfectra1n I can confirm that i18next is what is causing the text to not render. I'm unable to replicate your error. Have you updated all packages with npm i after switching to the new branch?

perfectra1n · 2024-09-14T18:27:58Z

I can confirm that I did not, but I believe those commands are built within the Docker container without cache -- so you can't replicate the issue when using the Docker container?

chesspro13 · 2024-09-14T18:51:57Z

so you can't replicate the issue when using the Docker container?

@JYC333 I can't replicate your issue. When I build the docker image it runs, but when I navigate to localhost:8080/setup no text is rendered (the picture I posted above). I think we are both having issues with the same package, but I'm still confused why we are getting different results since we are using docker. I may be wildly wrong, but I'm guessing i18next needs to be installed prior to running the docker build script because the typescript gets compiled in build-docker.sh and copied to the container afterwards in the Dockerfile. My guess is it throws off the translations. ¯\(ツ)/¯

JYC333 · 2024-09-15T07:41:50Z

so you can't replicate the issue when using the Docker container?

@JYC333 I can't replicate your issue. When I build the docker image it runs, but when I navigate to localhost:8080/setup no text is rendered (the picture I posted above). I think we are both having issues with the same package, but I'm still confused why we are getting different results since we are using docker. I may be wildly wrong, but I'm guessing i18next needs to be installed prior to running the docker build script because the typescript gets compiled in build-docker.sh and copied to the container afterwards in the Dockerfile. My guess is it throws off the translations. ¯_(ツ)_/¯

Sorry I didn't follow here, is the issue here you for the database issue?

And I didn't try to start with docker, I always run with npm run start-server for development, not sure what's the behaviors when using docker.

eliandoran · 2024-09-15T08:02:05Z

@perfectra1n I can confirm that i18next is what is causing the text to not render. I'm unable to replicate your error. Have you updated all packages with npm i after switching to the new branch?

There are still some bugs related to internationalization of the server that I'm trying to fix. If it occurs on 'develop' as well it can be ignored for this particular PR.

perfectra1n · 2024-09-27T05:01:57Z

@chesspro13 is this still good for testing? :)

I wonder what commits I would have to cherry pick to get the Docker container to build, or how would be best to test it...what have you been doing thus far to test it on your branch?

chesspro13 · 2024-09-29T23:32:44Z

so you can't replicate the issue when using the Docker container?

@JYC333 I can't replicate your issue. When I build the docker image it runs, but when I navigate to localhost:8080/setup no text is rendered (the picture I posted above). I think we are both having issues with the same package, but I'm still confused why we are getting different results since we are using docker. I may be wildly wrong, but I'm guessing i18next needs to be installed prior to running the docker build script because the typescript gets compiled in build-docker.sh and copied to the container afterwards in the Dockerfile. My guess is it throws off the translations. ¯_(ツ)_/¯

@perfectra1n I tried it in my dev environment as well as on a fresh VM today. The only issue I have is the one with i18next and text not showing up in the setup screen. What OS are you using?

@JYC333 I got the conversations mixed up. That last message I tagged you in was probably supposed to tag @perfectra1n.

Been busy with work related projects and school.

minecraftchest1 · 2024-10-30T13:09:34Z

src/services/open_id.ts

+    auth0Logout: false,
+    baseURL: process.env.BASE_URL,
+    clientID: process.env.CLIENT_ID,
+    issuerBaseURL: "https://accounts.google.com/.well-known/openid-configuration",


Make issuerBaseUrl load process.env.OPENID_CONFIG_URL', and now you have support for more services for OpenID Connect. would also prefix all of the Openid Connect related variables with something like OIDC_' or similar to prevent conflicts.

JeffrinCh · 2024-11-04T18:33:07Z

package.json

@@ -69,6 +69,7 @@
    "dayjs": "^1.11.13",
    "dayjs-plugin-utc": "0.1.2",
    "debounce": "^2.1.0",
+    "dotenv": "^16.4.5",


chesspro13 Do we need dotenv now? we can use the inbuilt functionality of nodejs now https://nodejs.org/en/learn/command-line/how-to-read-environment-variables-from-nodejs

eliandoran · 2024-12-10T21:39:28Z

Hi, @chesspro13 .

What's the status of this PR, do you have the time to work on it?

pano9000 · 2024-12-17T17:31:13Z

quick comment on the env naming:

I personally feel like the env vars should be prefixed with some sort of code, to make sure they are clearly belonging to TriliumNext - which will reduce the chance of accidentally resetting/overwriting these.

E.g. instead of TOTP_ENABLED maybe it could be TRILIUMNEXT_TOTP_ENABLED or just TRILIUM_TOTP_ENABLED

What do you think?

Ported from branch OIDC

9c748f3

chesspro13 linked an issue Sep 7, 2024 that may be closed by this pull request

(Feature request) Multi-factor authentication #68

Open

chesspro13 added 12 commits September 7, 2024 11:41

TOTP working

e232c66

Fixed login errors

37b4bf6

Changed Verification order.

494721f

Added package-lock.json

1a8625b

OAuth working

c74da18

Removed references to disconnecting OpenID Accounts. For now.

df3cbf8

Removed unused script

d763960

Removed outdated comments

13937a2

Removed unused files/code/imports/comments.

9dd185e

Fixed recovery code refresh bug.

ede7bbd

Disabled TOTP checkbox

06da11f

Simplified .env

55b0f0e

chesspro13 marked this pull request as ready for review September 7, 2024 22:17

chesspro13 requested review from adoriandoran and a team September 7, 2024 22:18

chesspro13 added the enhancement New feature or request label Sep 7, 2024

chesspro13 mentioned this pull request Sep 9, 2024

Feature addition: Updated MFA [Docs] TriliumNext/Docs#108

Merged

chesspro13 added 4 commits September 9, 2024 12:01

Added check for running both OpenID and TOTP at the same time.

d8c8fe0

Changed wording from "Regerate TOTP Secret" to "Generate TOTP Secret"

953f539

Added OpenID and TOTP to readme

fa5c5ce

Merge branch 'develop' into feature/MFA

2e21a45

chesspro13 mentioned this pull request Sep 10, 2024

Feature addition: Multi-Factor Authentication #163

Closed

chesspro13 requested review from eliandoran and removed request for adoriandoran September 10, 2024 19:21

chesspro13 changed the title ~~Feature addition: Updated MFA~~ Feature addition: Multi-Factor Authentication Sep 12, 2024

JYC333 requested changes Sep 13, 2024

View reviewed changes

chesspro13 marked this pull request as draft September 13, 2024 16:15

chesspro13 added 2 commits September 14, 2024 10:04

Fixed problem with using existing databases.

d928202

Removed unused import

120f167

minecraftchest1 reviewed Oct 30, 2024

View reviewed changes

JeffrinCh reviewed Nov 4, 2024

View reviewed changes

eliandoran added 3 commits December 24, 2024 13:30

Merge remote-tracking branch 'origin/develop' into feature/MFA

2eb4d4f

feat(client/mfa): improve layout by separating into multiple sections

e20e53f

feat(client/mfa): improve headings

0916d87

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature addition: Multi-Factor Authentication #401

Feature addition: Multi-Factor Authentication #401

chesspro13 commented Sep 7, 2024 •

edited

Loading

perfectra1n commented Sep 7, 2024

chesspro13 commented Sep 7, 2024 •

edited

Loading

chesspro13 commented Sep 9, 2024 •

edited

Loading

JYC333 left a comment

chesspro13 commented Sep 13, 2024

JYC333 commented Sep 13, 2024

perfectra1n commented Sep 13, 2024

perfectra1n commented Sep 13, 2024

perfectra1n commented Sep 14, 2024

chesspro13 commented Sep 14, 2024 •

edited

Loading

chesspro13 commented Sep 14, 2024 •

edited

Loading

perfectra1n commented Sep 14, 2024

chesspro13 commented Sep 14, 2024 •

edited

Loading

perfectra1n commented Sep 14, 2024 •

edited

Loading

chesspro13 commented Sep 14, 2024 •

edited

Loading

JYC333 commented Sep 15, 2024

eliandoran commented Sep 15, 2024

perfectra1n commented Sep 27, 2024

chesspro13 commented Sep 29, 2024 •

edited

Loading

minecraftchest1 Oct 30, 2024 •

edited

Loading

JeffrinCh Nov 4, 2024 •

edited

Loading

eliandoran commented Dec 10, 2024

pano9000 commented Dec 17, 2024

Feature addition: Multi-Factor Authentication #401

Are you sure you want to change the base?

Feature addition: Multi-Factor Authentication #401

Conversation

chesspro13 commented Sep 7, 2024 • edited Loading

Testing Instructions

TOTP

OpenID

.env File

Environment variable (linux)

Docker

perfectra1n commented Sep 7, 2024

chesspro13 commented Sep 7, 2024 • edited Loading

chesspro13 commented Sep 9, 2024 • edited Loading

JYC333 left a comment

Choose a reason for hiding this comment

chesspro13 commented Sep 13, 2024

JYC333 commented Sep 13, 2024

perfectra1n commented Sep 13, 2024

perfectra1n commented Sep 13, 2024

perfectra1n commented Sep 14, 2024

chesspro13 commented Sep 14, 2024 • edited Loading

chesspro13 commented Sep 14, 2024 • edited Loading

perfectra1n commented Sep 14, 2024

chesspro13 commented Sep 14, 2024 • edited Loading

perfectra1n commented Sep 14, 2024 • edited Loading

chesspro13 commented Sep 14, 2024 • edited Loading

JYC333 commented Sep 15, 2024

eliandoran commented Sep 15, 2024

perfectra1n commented Sep 27, 2024

chesspro13 commented Sep 29, 2024 • edited Loading

minecraftchest1 Oct 30, 2024 • edited Loading

Choose a reason for hiding this comment

JeffrinCh Nov 4, 2024 • edited Loading

Choose a reason for hiding this comment

eliandoran commented Dec 10, 2024

pano9000 commented Dec 17, 2024

chesspro13 commented Sep 7, 2024 •

edited

Loading

chesspro13 commented Sep 7, 2024 •

edited

Loading

chesspro13 commented Sep 9, 2024 •

edited

Loading

chesspro13 commented Sep 14, 2024 •

edited

Loading

chesspro13 commented Sep 14, 2024 •

edited

Loading

chesspro13 commented Sep 14, 2024 •

edited

Loading

perfectra1n commented Sep 14, 2024 •

edited

Loading

chesspro13 commented Sep 14, 2024 •

edited

Loading

chesspro13 commented Sep 29, 2024 •

edited

Loading

minecraftchest1 Oct 30, 2024 •

edited

Loading

JeffrinCh Nov 4, 2024 •

edited

Loading