0010181: enable instance password reset with 2-FA

ID	Project	Category	View Status	Date Submitted	Last Update
0010181	Taler	merchant backend	public	2025-07-14 17:57	2025-10-31 19:49

Reporter	Christian Grothoff	Assigned To	Christian Grothoff	Resolution deadline
Implementer		Reviewer
Release signed by		Deployed by
Verifier		Communicator
Data protection authority notification required	No
CSIRT notification required	No
Estimated effort (hours)		Actual effort (hours)	0
Fast-track	No
Work package	none
Priority	normal	Severity	feature	Reproducibility	N/A
Status	closed	Resolution	duplicate
Platform	i7	OS	Debian GNU/Linux	OS Version	squeeze
Product Version	git (master)
Target Version	1.1	Fixed in Version	1.1

Summary	0010181: enable instance password reset with 2-FA
Description	We should allow users to reset an instance password if they can do some kind of 2-FA. (This will be important once we have hosted/self-provisioned instances in production.) For 2-FA, we already have the owner's e-mail address and should add a (mobile) phone number as well. Furthermore, we probably want to support (T)OTP as well. Given 2 (other) factors, we should then allow password reset (possibly when the right merchant backend configuration option is set to ENABLED). We already have shell scripts for sending SMS in anastasis.git that can be used for sending the TAN code. It would be good if we validated the phone number / e-mail address on sign-up (again, if the right configuration option "VALIDATE_XXX" is set to enable the feature).
Tags	No tags attached.

ID	Summary	Status	Assigned To	Estimated effort (hours)
0009815	Backend as a Service (EASE) durch GLS Bank: self-provisioning / Erfassung von Email Adresse und Telefonnummer	closed	Christian Grothoff
0009816	Backend as a Service (EASE) durch GLS Bank: self-provisioning / Validierung von Email Adresse und Telefonnummer	closed	Christian Grothoff
This issue (hours)
Its children (hours)				0
Together (hours)				0

duplicate of	0009817	closed	Christian Grothoff	Backend as a Service (EASE) durch GLS Bank: self-provisioning / Prozess für Passwort Change
parent of	0009815	closed	Christian Grothoff	Backend as a Service (EASE) durch GLS Bank: self-provisioning / Erfassung von Email Adresse und Telefonnummer
parent of	0009816	closed	Christian Grothoff	Backend as a Service (EASE) durch GLS Bank: self-provisioning / Validierung von Email Adresse und Telefonnummer
child of	0010224	closed	Florian Dold	merchant backend self-provisioning [meta] [01sept]

Date Modified	Username	Field	Change
2025-07-14 17:57	Christian Grothoff	New Issue
2025-07-14 17:57	Christian Grothoff	Status	new => assigned
2025-07-14 17:57	Christian Grothoff	Assigned To	=> schanzen
2025-07-14 17:58	Christian Grothoff	Relationship added	parent of 0009815
2025-07-14 17:59	Christian Grothoff	Relationship added	parent of 0009817
2025-07-14 17:59	Christian Grothoff	Relationship added	parent of 0009816
2025-08-04 20:26	Christian Grothoff	Relationship added	child of 0010224
2025-08-04 20:26	Christian Grothoff	Target Version	1.5 => 1.1
2025-08-06 08:43	schanzen	Note Added: 0025632
2025-08-06 08:43	schanzen	Note Edited: 0025632
2025-09-04 15:34	Christian Grothoff	Assigned To	schanzen => Christian Grothoff
2025-09-04 15:36	Christian Grothoff	Relationship replaced	duplicate of 0009817
2025-09-06 18:31	Christian Grothoff	Status	assigned => informing
2025-09-06 18:31	Christian Grothoff	Resolution	open => duplicate
2025-09-06 18:31	Christian Grothoff	Fixed in Version	=> 1.1
2025-10-31 19:49	Christian Grothoff	Status	informing => closed

schanzen 2025-08-06 08:43 administrator ~0025632 Last edited: 2025-08-06 08:43	To clarify: I think changing the instance password was always possible if you could show proper authorization. So this issue wants to add that you can ONLY update the instance password AS INSTANCE OWNER WITH 2FA but still always without 2FA as admin? You also do realize that this will affect e.g. SPA?