diff options
| author | Timothy Andrew <mail@timothyandrew.net> | 2017-02-24 20:41:50 +0300 |
|---|---|---|
| committer | Timothy Andrew <mail@timothyandrew.net> | 2017-02-24 21:53:49 +0300 |
| commit | 7951b8469d81f58132f69ad3a1e71fbd39ef1f49 (patch) | |
| tree | 58ae7bca7e38f133a31478f393bb5c82927aa5d7 /doc/user/profile | |
| parent | 40b81cfafc8b25ec7bd2b7f43872e349bd7b4248 (diff) | |
Document U2F limitations with multiple hostnames/FQDNs.
Diffstat (limited to 'doc/user/profile')
| -rw-r--r-- | doc/user/profile/account/two_factor_authentication.md | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/doc/user/profile/account/two_factor_authentication.md b/doc/user/profile/account/two_factor_authentication.md index eaa39a0c4ea..63a3d3c472e 100644 --- a/doc/user/profile/account/two_factor_authentication.md +++ b/doc/user/profile/account/two_factor_authentication.md @@ -215,3 +215,14 @@ you may have cases where authorization always fails because of time differences. [Google Authenticator]: https://support.google.com/accounts/answer/1066447?hl=en [FreeOTP]: https://freeotp.github.io/ [YubiKey]: https://www.yubico.com/products/yubikey-hardware/ + +- The GitLab U2F implementation does _not_ work when the GitLab instance is accessed from +multiple hostnames, or FQDNs. Each U2F registration is linked to the _current hostname_ at +the time of registration, and cannot be used for other hostnames/FQDNs. + + For example, if a user is trying to access a GitLab instance from `first.host.xyz` and `second.host.xyz`: + + - The user logs in via `first.host.xyz` and registers their U2F key. + - The user logs out and attempts to log in via `first.host.xyz` - U2F authentication suceeds. + - The user logs out and attempts to log in via `second.host.xyz` - U2F authentication fails, because + the U2F key has only been registered on `first.host.xyz`. |