diff options
author | Thong Kuah <tkuah@gitlab.com> | 2019-06-14 03:46:30 +0300 |
---|---|---|
committer | Thong Kuah <tkuah@gitlab.com> | 2019-06-14 03:46:30 +0300 |
commit | 6de8cb7e9cf715e720fab9e7359ddb63c992af3b (patch) | |
tree | db642e4210cdfb6bf125c78ebbf0e883eac276ad /doc/security/two_factor_authentication.md | |
parent | 7808259922906877f866d4b28fcd6994790ad8dd (diff) | |
parent | 7bfc4f999231385f2dc24cbb2d34b09cf5ae96c1 (diff) |
Merge branch 'feature/require-2fa-for-all-entities-in-group' into 'master'
inherit require 2fa for all subgroups and projects
See merge request gitlab-org/gitlab-ce!24965
Diffstat (limited to 'doc/security/two_factor_authentication.md')
-rw-r--r-- | doc/security/two_factor_authentication.md | 22 |
1 files changed, 20 insertions, 2 deletions
diff --git a/doc/security/two_factor_authentication.md b/doc/security/two_factor_authentication.md index ad5daef805a..49dadd5abc2 100644 --- a/doc/security/two_factor_authentication.md +++ b/doc/security/two_factor_authentication.md @@ -39,8 +39,26 @@ If you want to enforce 2FA only for certain groups, you can: To change this setting, you need to be administrator or owner of the group. -If there are multiple 2FA requirements (i.e. group + all users, or multiple -groups) the shortest grace period will be used. +> [From](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/24965) GitLab 12.0, 2FA settings for a group are also applied to subgroups. + +If you want to enforce 2FA only for certain groups, you can enable it in the +group settings and specify a grace period as above. To change this setting you +need to be administrator or owner of the group. + +The following are important notes about 2FA: + +- Projects belonging to a 2FA-enabled group that + [is shared](../user/project/members/share_project_with_groups.md) + with a 2FA-disabled group will *not* require members of the 2FA-disabled group to use + 2FA for the project. For example, if project *P* belongs to 2FA-enabled group *A* and + is shared with 2FA-disabled group *B*, members of group *B* can access project *P* + without 2FA. To ensure this scenario doesn't occur, + [prevent sharing of projects](../user/group/index.md#share-with-group-lock) + for the 2FA-enabled group. +- If you add additional members to a project within a group or subgroup that has + 2FA enabled, 2FA is **not** required for those individually added members. +- If there are multiple 2FA requirements (for example, group + all users, or multiple + groups) the shortest grace period will be used. ## Disabling 2FA for everyone |