diff options
| author | Timothy Andrew <mail@timothyandrew.net> | 2017-02-24 20:41:50 +0300 |
|---|---|---|
| committer | Lin Jen-Shin <godfat@godfat.org> | 2017-03-16 12:25:56 +0300 |
| commit | b2f48132e7268f5256e1aef2a85cd563378cc150 (patch) | |
| tree | ff4d02baa8cb3069966707b0bebdfc40f8eefce1 /doc | |
| parent | 7a6925b25b27e310feaa9aa196f77efbc99b79b3 (diff) | |
Document U2F limitations with multiple hostnames/FQDNs.
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/user/profile/account/two_factor_authentication.md | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/doc/user/profile/account/two_factor_authentication.md b/doc/user/profile/account/two_factor_authentication.md index eaa39a0c4ea..63a3d3c472e 100644 --- a/doc/user/profile/account/two_factor_authentication.md +++ b/doc/user/profile/account/two_factor_authentication.md @@ -215,3 +215,14 @@ you may have cases where authorization always fails because of time differences. [Google Authenticator]: https://support.google.com/accounts/answer/1066447?hl=en [FreeOTP]: https://freeotp.github.io/ [YubiKey]: https://www.yubico.com/products/yubikey-hardware/ + +- The GitLab U2F implementation does _not_ work when the GitLab instance is accessed from +multiple hostnames, or FQDNs. Each U2F registration is linked to the _current hostname_ at +the time of registration, and cannot be used for other hostnames/FQDNs. + + For example, if a user is trying to access a GitLab instance from `first.host.xyz` and `second.host.xyz`: + + - The user logs in via `first.host.xyz` and registers their U2F key. + - The user logs out and attempts to log in via `first.host.xyz` - U2F authentication suceeds. + - The user logs out and attempts to log in via `second.host.xyz` - U2F authentication fails, because + the U2F key has only been registered on `first.host.xyz`. |