From 6f8d97a78e93e1b470a7115e9c7491fcfe9c3ac9 Mon Sep 17 00:00:00 2001 From: Achilleas Pipinellis Date: Tue, 24 Jan 2017 15:42:28 +0100 Subject: [PATCH] Merge the two 2FA docs into one [ci skip] --- doc/README.md | 2 +- doc/profile/2fa_u2f_authenticate.png | Bin 17585 -> 0 bytes doc/profile/two_factor_authentication.md | 144 +----------- doc/user/account/security.md | 4 +- doc/user/account/two_factor_authentication.md | 69 +----- .../profile/account/img}/2fa.png | Bin .../profile/account/img}/2fa_auth.png | Bin .../account/img/2fa_u2f_authenticate.png | Bin 0 -> 17582 bytes .../profile/account/img}/2fa_u2f_register.png | Bin doc/user/profile/account/index.md | 5 + .../account/two_factor_authentication.md | 215 ++++++++++++++++++ 11 files changed, 224 insertions(+), 215 deletions(-) delete mode 100644 doc/profile/2fa_u2f_authenticate.png rename doc/{profile => user/profile/account/img}/2fa.png (100%) rename doc/{profile => user/profile/account/img}/2fa_auth.png (100%) create mode 100644 doc/user/profile/account/img/2fa_u2f_authenticate.png rename doc/{profile => user/profile/account/img}/2fa_u2f_register.png (100%) create mode 100644 doc/user/profile/account/index.md create mode 100644 doc/user/profile/account/two_factor_authentication.md diff --git a/doc/README.md b/doc/README.md index e329131b8ee..993b30ccdb5 100644 --- a/doc/README.md +++ b/doc/README.md @@ -6,7 +6,7 @@ ## User documentation -- [Account Security](user/account/security.md) Securing your account via two-factor authentication, etc. +- [Account Security](user/profile/account/two_factor_authentication.md) Securing your account via two-factor authentication, etc. - [API](api/README.md) Automate GitLab via a simple and powerful API. - [CI/CD](ci/README.md) GitLab Continuous Integration (CI) and Continuous Delivery (CD) getting started, `.gitlab-ci.yml` options, and examples. - [GitLab as OAuth2 authentication service provider](integration/oauth_provider.md). It allows you to login to other applications from GitLab. diff --git a/doc/profile/2fa_u2f_authenticate.png b/doc/profile/2fa_u2f_authenticate.png deleted file mode 100644 index b224ab141955b4a4988f3d9b78c9cbe8b57ccce0..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 17585 zcmd74WmsEl(=bYLDN>}g&_aPiiaUhhR*D6RJ1y?+THK+yB{&3kcPQ@e?oM%skM8}* ze&6q$Kj+sW*Ic=0?(uupngy82ZsQLgM+6+MR=yj7t=63 zzabh5N(;ill|^9Oe@A-8U)ait3BeT)z1w|WLyZ+w>{O(sK)ROZ4Bz!Eb@UmW%&nfe z;NW4u^X>Z3%PX5Qxe}4Yzm_a) z{}tAAfQ)~37?~NE82_XDS(N7w6(noyq;IAoVr;H&Vf$=@56H&B^B4dBwew$#|BzJu zuOvG=(?2EuvGXrU9>zZb{3D>hv-KDCIbD3{JdFQIJs*0q3whu3X`oqsQMHAGdrkQV zUWm(m{QZ2+FJz?@L~n0zcXxMBPEPLb?i3Xjudc2hA0MBdo)~gBSy@?+j*jS4XKrq8 zPESww_V%u?ua%XRpHn_FGjn-)>EPht;o+gFsoCG(-`CfdkdUCEp)ox@ot&I(YHE6L za3CforlzKLe0*G7T&%0BJ2f?BWo1=VRJ6apzqYpa`}gn4%1Spkw_m@0Jv=^bZ*QNU zpD!*hE-WlePEH;k9{TzD@$>VqtgM`!oh>abU0hr|dj>4r8W|ZG8yl;ssmYl;7Zw)I z&(FWVzptpMC@d^2D=YiTPtVx z`uh4wlV_QknSp_U(p9?y0|QP@PAx4hjg5`>k54Bzj~g2sa&mIr-Q7GqJQ5NTGBPs0 z1HVm7Oyc6=7EkVigM-iR9+Q%ijEsx|27h1OKlbcgM?^#%UOx;C4T+ZT3?JOM^&Z>W z+NRB%g@lASbsue<-|t;L6fRzPd3p8k-NcTcYBcP(Z(X~%xRfkiM2wzPtXv9|Y&Wc5 z{pdT+Tey&|-j$Y?w&^@FXgz4!xSIWaH+6KodwHi^x2IjTQZ#c!m%hM|v;M7m6_h>4 zl{M$ne>^At%?=Lk1Dv>spn}uf0c2igzK5h+n&!%goO@}-K;1~3Q-ByZBP{MG@<#!U zsQh`MzH*7VaypO@fuame?CXiWTpk4;1@~2b?O}db1Go3x@!z_?lifY=P+BJ>Z?m=} zo*=Gj!~ICW89{^-0Klc;!HuB7!9n4Efd7TUfnNNL!tEf!*}?yf{$ctX{g2Eu`hUwj z@BTl?JZt>h&Oc@TY4$%d&l>-SS!FOR8BW8s*cV*+PF;OJh8RvmUgc?VZcm1q>~&&w zu9$b$r(o1pc0UJg@iZm#3$hrT5Ge&p`!bE_O+>h9eAVJuLdARqQXw?!o~&H`x}ODl zXViVDaMM^*wr8^v#UJ7oDeGn3_d0T%qtw73D`tg?3en*-)F*6;ehyOM=_~5UH}_8m z`B9ZYayRgp&|U_}2f0yxeeGw&hxRZlA}mjzDD$Zn^P7q+?yO!Ia_%QSH21m6gxrk} zcyAceZDKogKBoG5nD`h1T%AIyo* z6=Li1E%$3hxy?F@U50Iw(Cb4?|70_-p-beF@j?3U%mH;IZ!TxGESMLTQgEDi74p*S z+N|UYd^LDPC&lyh`;9D^7Gf&cH*M^q&Srw(el-(D#xqL7@YRT4a_9Ar?)oSE0Drr- zmk8wi>)3yI=7TAW%$N>B|4}^utvEaQ5ww5ToB-gzMVE&61N@(|0}1}SR(BAgaCYAR zuGasErV(cP@(9xk0C3{Lx<*Jlh{b;3y^Z9mQvxXrkTY3T4$oUpiY_g~h{mq%$4l-q zJC?`Kb@iYoa^HIwq;YR>il&>lQ*=0gzPRg=+2dsc?cjJliH0gPi^@F9`lK%#3ED{A zoOj*FHu+&Uu^=DV!x#vvo!oMId_LjiQqQMC8J@8M!#a4oi zzOi>fg%;<5>)ezM8GUT{QqPwh)!kFss4L3f@4ozH&bXJzX{`Xt!=`c@#wJk#WJ~_ zUEz}jS=beG!dcze@~`aW;Frsv9?IKtpGFH%QA`UH zFy=bhOIDNp;5P#yzcu%^UDm5tEEc)VpR8$A`AQjkr8ZlJZ9=i}hgIDVVvK zQDpGt6~JalE<0%|TXnQAP`F=SOMkh_*^pDQLD$16-t~<(JF;Me|DJ@T$;|XT_fX(n zdkc7kIvAW8-pxEW4z}pgDob^5p3o6%s$?D3x{rBTG;UiIu#iL-+ciTA)=5A0)dXo% zvsbp&EJR-LHlRI+zO2YqtmjC(49pAz13<;bxDWrv#Hp<{T+&u71P zILK^joxFy)A4?h+|0-6HcgtHUKdx4i7*>I9Q?gQoGwWtXs27MYS0#ao*dK~Dds9q( z2Df9eJJGm_Bm8Z0vQ4CusN;y{jANZ6OO6vQp=t6Tp|2xuU?P%J50fq2rtBwtt`o%( zft&2NF6?jRV472#9OsE4x3sG@NHkZ8TDRGWIUYj(4vqEBbYBh>5tH zi;T=_DIOK!^^fY(t`Q%0;JKLIcXc7rHcEJo*3i1(Xy=^RYE((EceX1DOXgn2YZ`tH zktK!PZ8>t#f0srBN+sjI zhX^IN5UoUY9+H0W08)xg!BaRcyZr(agsO(|N(9X1;DP}l-xiGx9!h$P<*;OW+8A_SYH~ca!SF^LWS)D__;;v`?p*FJ5=@Wr^tb;f-_1uMNVac2HP@ z-EAv>T)9CTs~yvdgVK(=F6x*>73}n6mO=Lim<_3X@VGD0bC__4#1WBM000`MJgzmh zA4>cI5`^V~M#Iey9iOj$TNhU4+V64^M9CdT4_hn-66eF;(toc1+iR|-brwFK*D2+=?w!;O(K6e#r{3MAs84Fa?8^8H&I62nVAG5>{?`&ib zs8=cJ}r49}lT;2j-b5pTGu7%HxVr!<{d>6)d4f-h@sI z19#gc@-)(OLq5T5xypD=&nKP1-?f+)qHjut!aI-ODBaI#j{uMf)>jZwb)N>tL%K{xzDEaY$I1XZ0df1lZy|L zIOw1k`FM80#p4vFa{}{cvJKFFrE|t4$68k+rs&JNCWOH>&E-{LR(XuXUg@x>cEe;h03!4Vs)7`}x9r&1MY4-h zJL0nHz6G#6+IxdX?RDn6#Vg#8O)zrZZE-E_&dskh(=&D1cjE;|5(%wyST7G}Jd#AV z&BRPBq3|I%cEv$C!%)AO6(#?&9g*$6$zsm|D~rP2jNJ|o0laJBs6HF_M?m}2+LSho z*Rf$FG@0CvXd$u5)!=%0>h;?`-Au(vy!BV;$&&V|(`?<&c@<3tatbaNha!g6cdK+w zd2jPzU_nvTp(y{hyarq3@#qEleHFV5#-8|xW%EmHaqZEd=F`Q@tcpoPfYRN?R8X_c zVCAk67ZwybcRb3OXeGKi%*}|0Kx1Wk0)?-4qt=#ROvh@O#5vp3a__8RaT@~W3n^uQ zx`p86M#oq`xP~Uy+S`o6z|F2XjN#`*dQ%p|ZuJS^_55QJWILijumNk%*lm{kP(ovg z6?b!Sc2Htyqsdi9Q|r#h_a*^))sFgNj`gMBW>M4$YIS@2%c@#?ko!odvnS|=PQsAQ zc33+rs~8@6cS8aLgsB1m{V=8Q>_vq$3lMwCDC_KgVYycc_F)IHL?TM!XrM57b>F+ccJ;b_5YPOJWo zb8@S#=O-vf0IO0q?I6p{{BldqTY+3QIUgS}Jy6odNFkjjFb7xJ+-~AQc5^k5kWaAX zAdx-g?J%$!4`;_H%$nQ6!Q5~Bb0szD z?AJ5CJMj4x=oj$4$Ta(Vt)1Luu@yTRU|F7S4ALEog3fCXjx#ebYxQAiZ$z@?VRcs? zzKaF^!G?U${E<`pr>F@(6^NGTfuicqknkCTJv_Q5{j7C8Uy+j>F!QKz8J`IT@um}`4)L#eCkN4XK6g074diA?*)+l<HqVSKkQ*2!DsJ8d)wN-|(YxR= zSl9%Y9a>ja`~9lYBi1gkP#aoG@swqwXGq7e29DCclEx!loo8HZjz^a6I?!uP{^pXW zouI$Jm1>Fya9^5`P9)I}GiDtfody?8KVH{llmvh3$`l_T{~|j*;M|^%vtp+Ve19T} znPO3}6%)xltrec0N7>aDRAuf075b(#sJ+K6pfW{s81R9x`Qp6Kaqe`hCuzhF2pNkE zshG~1SHWI_Ke|cQEGbA-ZfoTqJvUmq&*M-({k&P25{Rb{B4*B!I!=t}`QAEzn#^F_ zAj=jPD*8E{SbsuPchdD{$wFU69UmTYgb8Tgl;{d%6w32QaQV1AzjN7mkPp3{{-k4; zd^zqMbyYY-XKr-foR%0TEaS8&qdJ@Py;IFHX-A0bKGAry80P*_+FP zjr-0+haTH#&dV(~IoKyu9m6i}Zm13$(-pld;;u}$6s63uhT!d zW{j2AKRxtW^kHvIUD#VDqhS_`9TTL}dsHcN6Nd8Ehuo5m1{*IoQ11QG^~U?}Fs}TEAE1LAx-R-F6PZeem>kKcrphg2pXCin zVMUy3FU~&u?d2Qww|YZqe~iCh&1%8R=N71M5nxR8Bh&#AyW0p?r*}w;DQ6OmT)EEk ztt>-H_zbaQvk#E@wjxXOQ#E@v(=KFRrEBnQ&8ld262)R?G!r^6QJOQ@#&wF_Kb+g` zyZ{@e=gZ4tG?7|nt-0vuyu=cj=MM33@6xT(kcQs`_eeP^SyVV`Ip(qyA#{bIPjAL< z)OVf>Y+MiKJPOB{CyK^@;FtAZK zD7n_%(zASBu4<@J1Ra_@Ej7;4LLWVRs%bk-F7zoaD7N~#i5kWvXxvVgGaP=IHh=B< z(zTzz{j}>TjOl4YSG~i$G5A;9F=TQF5^w;u#p?{12f7=;%U)#`gX?gr@p*%%QbeGgT z?>fWE?QnhY^e7D?ebOrVmF5*al{}ov|1{^nSvX(qD#;U4ZO-WIXwuzO*w;G~k?Q`q z5Q+N%`3MD2Blcz3mxZ(Upzj7CZ%L{)u&z;KhL-C?bK@vBtBpX?YGYcXm}g_6U%0c-gqu z?Lb8etMWrN;zgsFejg^Il`OX=E*2)&j|N97Z{oTfY$2aYjVe7|Mkb&lN@S4gULWG? zvnb%(SRlcfF@sFEaYMm+k73aZc_c9BuU$?9C)xqslXc^WStVtwmG=>>a|UO21JZU~ zyHCwFRr@_-KCYYnqlKX{GpZ3&EVS`%jYID}@sRgbBW4V{am&{>CCuka+KAm;RkiZu z6EZkO`7f1~Sxhwr`LV}#`R|3~8_Tg~<+rQ}SmJ3r6ZIevTJC6E)yRvO*1Vv2wA~wX zIT0?ZH5i?}^T_Biwy4WNA0&7$E_S{sj@2*G>ebGRRT1W%mea8c>tazodaRt-^@{$( zW3w~fC*x((p^8VDOEXwt3^G`A6O^Cp0rQz&4-k#Teq>yJnlImye4M>pNR1nf(Z3kJ z=@wnIUf`15_2#_SUK$U>8y)y;bFjfyYt65%L%2X~MHJZC>xf0TYxFp0`OR1H+W)~b z8~#@v((RS6@V0{JRlK~xU+zpPf;F$H47l#vyE+8bX0PF9m&4zhA*Oo`AviMpGuTKLHOD|2yvIZyO0tPB9pdZd?;#M_8jCGq`C}ae z?S3Dm?-hTv$+~UARlGyp=RdY8dz;VX3+Nho^>x?MG7|Fx7agxdD<=kDo&sccS3fo)_#S>? z_DL@2Vu-_v{KI8-Ma`QCJpMuntr}C?doirHSNi?;0`0xRtghSj5%8=PsOMHzHU>8n z0vvVkyrPeNkP>;fy69D4k2nLFKYN{Diws!10m0lYTtoTvQiWMvo^M-tUZL$QTzt5S zzoh1G0X$ztCvkD_`2(KhsA%3a8fvb69p;o=-QeL}w!7~o{}S_Y2N99YT00@%oa(+ibv;N7OOp-+%8 zDzN=7GP~Q|&?tbNPd!o}x+w}ZWL5fhk{_pBz59*#bg_iXvszwyQ?&ZWoqcq8S6kjP zX1=Ck^U9ZHGuRjrEcjS0Dd=?ZSrx>F$kL6myp8CKI&bl?%v`GTbHeBnYf%ZkNM3@) zbnXqu{gchZ@KQ-S4Bw^pouAufcNx;&-bhM_0Nlid@W94{J0cu~Wi`javtV{n6z$xt zb7kh?-es+uAa^0U+=Wx*kZD5Xyt3z~>DjM^Ur(mhWd1TVSd}c3wN-8`b`s4FJ1yjsc6nv% z!x(1M=}pqSuOFnn9eDDxKL{53xQHRQtb-30b0feTY(sWzMo8K_+kZtU9n*K26e56) z2%sRo%0BxHlqLq+8v!r6Rux!&B}lg%=yLkXivVfaL>H9%__YAM&0uR5qOB= z>~Gvg`jB*rV!@XnOoWyfNak^U?|Go9E<@alOA?-hGBTrU#*~bpf-L3sqBFeCiTo|C zk#2`H6^`G&H#vS8`R7wIRV2|>vNf_kNv%_t$AjJCz1`iq88cK@UnzI&AVVH`%|%UZ zdqsP0=VIClzXIJ~eZ8V!2Q{8-mYP;tUlbvjDK;gzQm76LTbBg|p{p;iQ+8-IV?zDy zL4!^^i10cM>qBSx)F(4;f)WfWE_1df*3*bQ#p43J=-fgr&Pt1#@npGvWWgWF zpIAbZF*ZxPCceMjbKN{Y#p$O$rX?=Nr{Shgk%Ju~l;Dt{LOTqG&L5vYY};h%V4?}R z95EhxnJK?fhsWv6Y1e3%e`5=CwjTledf3L@HJV7cIlWgGIKj|bH{7mPxTH0^Jxl7&XQ+uOkSD~a@e6SVuJMbB_0J;nFo6TN=3 z8MUzaLbpHnyi*2X)$R)2+30eJ0+*5qlBHcEVmf?1iVogZl>e>LiL971EoPbOHBI44Q3v-|`QC78*=@6O|8G^Xu3wTGeiTR6U0XrKH(Htdbv0#jR z=3pTr9GgEi0&X6ewrkB+HP|W{x2vwg{B6)a_FOMn9U7hT`#h1iS59D}rAktrR%kZN z8hA=G!TP=7=E0&!_R|D5Xw-OTZOy28_{Q(G)g5;8%z5Y|cRIZI_Rq|5W7$J@`^N2Z zOY#kZcHy+~X5tKiTDkEdsxP_~8$q?*f}plXJSALTbEI86a!Ct{VDMK(-*u|+*uWQx zv$n}e?!`me_ZL$0wj|>w`f@>^-aG~f5SVu*b-9O9;U@gWZ$68g4jnJ@uM_F* zK)1w+Qe59x{?a1j2{d28nc0jwyn%w5E#j9dU2i|?c5_3LQr?$IHkZ(5!%pJN(g+wg z=h$LP*R#i#`*;jkF(_%zL$1f2@@xq4;`(MNEG<%|BK@wfhns|U96+y7MF1IiUOOUo ztu5e)=uhU?5W-=qU|=lSXDdUbe{ z?wz8nA&Xk$z!2z?YE5SL@2AG4?N?h-yF2vu^w-CtQDzVEcEu%~SoNV`>iHuYY;{!w zv$ZbR=QqR;s=Yzt9OiYWt~%b*WmAWWO<}m^CsAchErKv(D>TQf{Q`A#Tc)-drTEbx znO{eYc3Jv0M}*KmDX?3gR_W116z5yw(T!A=>T-Jry+u5b^q23Q;YXwIbjo(1yGasH zbEgx2cDGdwiSlOUS6ZV%Vjm7DZ-cOk&tAuwdFac>(Js4P^;iFn7|B~0VAhBYtm8fQu-C)n)(%JH`J+v-tSnOHI3%Nd+`OQtTRIfADoA6!vUz4x6&EBOD?p61_CA^UgB6NE-Xjr8b z+96mWyIjR%2k&>9>}S9S9N<;2a%qFU8jW1lB1WcTVq54Q@K;rAuGh>p47F11oNw$b zSKUzqohYPze;=YoKwK!`cOX;yEmQOjNn@~PV8{s@@nA5`31#%p8~Ly@nXzjsX4_fm zUsuZdbfGNO$B5v&`m}hkYO#Cf0v*X}d;!6C0v6%iRTO31V^mA7sFet97$g3qD3WuC4Q3#@5e% zKbSP9sqbZQhGSB?%F;=&L zQZYL==}4L0R%_>S`r7O>PsM=|48OGYP)gmXA*x5m70piUwqVUxF<9_sD<%N^7~XKI zWTTRDnO_iNRZ125khqs#`ZeVxX8Oem(smClb7#dyO>4RokwWG1mkdBXNF&I^ZcX|a zBc*Vo>6e*@{BQ}k-!fP@TB0Jmlno4z>-8gl3R~IeYD~N~YoVPR8DXf~b#p+teGQZFkpv;z4)Et;9R(xaA)aYu>Y(@hTsJD36)`RxM>5ik?7o#?iksow)T(vL>;5Nx1+mW)gr0+ z`&R$D6m9psYyheR#~W+t}bxLKIMX@_Rth`pytM2kGTkODy_t0AnqxIP(N z#)9>;wypb)T`KC$Ju6?WbKUe<$4TV;>~K_yTu0ow)&hKO$%bb+mv!RGe#)B*CeZHP z8kA@=-l*)M`V|-uv+?GoQ>BVFcj^c&)R`>Sm} zDxu8)I|yfxdJ_ioH)Rx%dl?g=uRl0E*ro^%BMt9xc4gBY6pZCLka6h3fmnN0JGFgP zkGwTB9n0J=39$P3_`Uj4jYS?m*k-CU&o@-AGxR3Fzn>VxB4(oC_jEpYe|>%FOd4AkgX&bhmbAaa}-mz`%+b|Bkpj*p9+Kc+TKwl z!_ivE0PGGM1M1~*#R$~|z6M@86<)ath`kbgaW&vyqcokPrnG?<`+LmzqnQOebAv2Z z%>J3Y*%CjSiOL*4F{6GdtU#^X9w%?P$xbcEgwuxn4X|4auv8v9yM%}`yrBHu?cJ~Q zQE`!vl149*afG?iTo7Jz`hru;Td~4U`>TAy?V_T*x3oI%1EUQUYc}jt$k*F=Z52f* zGpH@zyJ6z;arr1g$JO5L3jk!g{Th>2XN>Aw5TH{CnKQQ4=O9d(lLqoRJPa+`G~JK8 znT{x+!~j;<@@SQ@U3

e~m16&%_nryFWuMHtWS(jF*Gij*ptRaU7ppGL%mWZiCBQ zY6$xlRU8hdiUq&I6)~BHSX;@ zZ2DE{c-R`g75r0~A0mU#vR)k5UNEU@B)q8EQ)RWth+eWLvs4L-$i=D59?x~er^S2H zJ-+oAbE>|clhPg_C!W$FrV}*B$f$$IU8FJ@(_j`NMr<*ztr~qZ_8U`2$Bo)}E}#o# zT~hl<+iiOwF%hcj@Jg*o+jGF#xNR}9qGFqMyZhacs;tI2-+TLZX*d<25 zGJAF#nzr=sMKy>0F>GG84PyL8-zF2VDbyQp2LJ45YoGK>_S~-KQ-ol|Fu4hPUhj14 z?>{j8qHkCD97}I}5W`SmxTqe7(~UmLu?gt227J;#yCYW>yojTe0}!mDf@W;B*LDKl|JMuZNGlGcq7Bhr|5MTK_AHe3625#0$Pa@ za8lor4qd@1Y!-Zy?r4t@$=Lv#oE?=u0B;u1YtSU1HC`4HVQmy;YFyC?Sg0SfiRa&?*E}x86S`jnLN;@w_*wUC^ zg43hh#VC0T`+RzYWPh!0+=!KiX%l6hOLL=DM|iU-d=dEc2_;e9I_6_26@J4fU>>#> znNB%{9jW)h=k{Hp=g};lvGphH-@un(Uh`Qdj878WNO7vS3a9{j4sPOdwwSPHc2vNE z4qm#I+*(SQ7y?YAX=QsLMvq9!RYI&ygXNkvkX7vQGl3QXhMNrKiGJ4g>Iw&1z<8ltoyQwhcN`47Dpk3VE>W!sw z&curnzM(7l*u^hEE>d*j@kd31fxIZ)+vjkCBwXoRIJD1;)}R*Y@%WLvCin08zCITr z>zg*HP6o}Atly@&8C%Ep$`~XQZ4eApatB7*oMPDfIvyt65wbOPh4%^`GA!)dQ z_JoeevD;$RJir+-&A%Mdu$*Ig<5kC*e-U-k&)cA;9xjCJ(2UBN49(8!-w7mz)%~^n_Ew40Z#^6? zm)3}J^G+r&498TI;;6cyqTeM?U%X8*39t_J$0|o}qjC|{XUQw<`t?JeEnC|;TbI%s z`UzimHQw2TO$QtS9^nVX%+C@3qCI*EJ>OL$C-daC|0%KI&)+K1PCI}WtJtr3C9yN0 zdSfi#8(-y{Qz-$rm zVPbE2I_fMB58snNK9Jx;aG%{F;e{ww829&Gobrw~Q6@tx4h%d}C()rQL&uir-JOdI zSB$2N+h>~D0tFbFr>`qi;~kB^FmBTlma_z?&-EQwA+V%QZRv+H0YV?Tn?7uebrd>^S<7EAUzoNUx}qk0zD$`FZV(B$kYul`DO$)augAPRa{H+&n-=p=XiyVOd1L zFa*GzZ=;!RX3s6NqpCrLYywP>^1zY~$#aMS+D1~qpXPmYyWIHlJ~%X|*XCRS!iuL- z@0LV(Wqd+2v!6d;DA8iIM5krt8@i}T!RCF@*6pYk9tOwk~ATT%k%6Sr9tP4FNc zsrCE&V?moZ?(2%;z=#q}&!r@O%a;M&RO+^c^GZO-(oPt|4zK-V-Ii*ka0SU{U{@kM zpoP1`BAnpBP#5m%p!j-PfZqMNCMeqSloCPQr>+cN=fIF+Ve?^V*!8XJR5dEYeVxhs zmLKg`)H_hUhQTcS+MsQ1)LpjWt8gv|sICfcN$ESDOKg!^Ue;JcqUMIeoQ>Af&DTl< zo8(l~8+O}f2*`-5W0s#^TdR#j9HnfKl#eOxLDnHP_h_VbWW?BPw}Sly;|}-vQ_R$W z*-O3QHli}cLYx7$#1|+`82S!qM7D6h^|Ls;ipx%L=sgX&s$SP zk|s)K)!q|)MI-UIlQ63Gszc=UQCV)y3)PN&!vIoM*urcLiv7|d)HE`aVEv}#Y^&@@ z8J>6i4aB3JP~AlQ#4DXUWBY(||G0M*vB+p^HJ?4;MP5)ne(5k#CVjLi$lwi&6*`7b zI>wM6=?WWTRut!<_m;s3xj5((<)lT0$o*i%!3o$??4ZDxX}z%J9wE!i8D%A_+OqQt zbSjVF2uzm$CcvY6e`Un3RkN{(+90WF;&suP*`A&M1=hh&kOKv*SiTQ6-)nrvN{9f# zNf4O+Yt@6Sp+H7cV)tWSIe#?Gm8{BH*Lds~;95xQkU1+jK)MGMeDAQ86BdF ziM(-Wp*<2N7Sy&!|J_y%=WO^7gn7l$#}}<%7C+~U<~Un%a6dpem+bMTjb<^e{4;; z?I(uSN|ByW$|K~WX}IZdp#nwUw&8b8oW;*K0PEFraO6M&GQgNaRLC{SMg;J9*{j2mqwu@&k*f)qCpg@01bMAJYlDLwmQ~>qCz-&IxICpM!J5+C zoep2R9>4_5Y?C2Z;)fNH@(8eHKRi1^OPZ)%56pg^Cae3n*b!zYM@6r3sZS6W55N`K zS)54gS`jwv>NeX|WJdcuMQzUoxH>Z7I0iyHZMbDIlVOD8402HmR}N?qRNkF_GIEp< zzIqLAnDKW-ST~Sk5k&Cas5bw!EO)#pw$Qk<{l-^5(sxBJnUI`NA?K?HW1z3RVt6-% z4TLlOMzh2EBcw9D&BPqDJ&#-+m&E#``~oQzSNCxgc1wJk*LV?x+g>1UOguFCCQ3D` zj@z8($RSk|nT6AIa}TNdj`5R#F)HOb|K-pHEbQRrx>5XLs1B}@LrlJ$Uy?(CZ_exZ zF!;A(Z;cCtIOf=h35+Q-f}KW1?C^X}y~6zT8hWZ5-(bwQV-X6r;@IqJ&z`09Yj__f zmL_~2I&%x+jb}B4TyY+6HgX)Vi+rC#cbOXmbYDsm@I8)bgec4?M>MNEfe<;Wf26{)`{Hc``|LHqp&iCS0Y9=t) zXWm`aOEyr%W6%C}lVm19b3bC{y~{#+kCcf}+z^B@zF@C|_0Ed>hmDItEJh>avgT8O zfN=Fh*))YtH$r$JL{{Zi#w*%%Y|y{igpfL~KW>i92wHP|WwJjU@2W5{-S7E%Eiak& zybT_PO)biE*E^a0{zjFrz<7IE4*>LYKxo0M?q1I&)eCW$VUO84Y@S-aGCzJl8v9$b z#7+!bRQaG|`7l=7VWe|6quA*goL|A&r@e!r3f!WH|oQqbw)^|tW*LI#r9scNu~D>`4y^6ztK^@tvgcx05JvI zRzlA9)$fW&MAs&6=cBH=VG%EDZkLw6Io%hKM$m^m0&yKQ9e+QKA9pIwmtVX9+#_K=&*nT2y?j6guKx1>f16f$9^v_G?&a@6ot6KM zK2O8^j~z|l@d8duVOiHEXQX5#@Cz%G#us#6KTKLpyrLPwmO^4B_B~=H5ki*Vs#<%o zVan+gt+=6p4%a`(FB~^{rWBz7CiRsKpYeH|FK9U<>Iw8#r)|`T5brg7?^*a~U!I3_ zte*Y;3;s;g{23_vCjkFA40)cm`2&Bg{}i+#%X$YEs?YO1(Dz{H zespk8QjVyj+5xTlRPaNN!Q?r7^0bm9cTHg-t6!3fb7=!{G^4JW0Hv$HO=e;+QYLk} zvGudbp_edTY1g+CLpoA4f~4wvEt$`=*47*)c}l{uZ1lTHLP6NtnmVvIt_^Pc z5)*Yzlzu5qqchm2INy{<4ZQHIK&+58bF;?;n*r{k%9)y>OGU`^uK6iATZtl(fjeG) z=J^i>L2+DBXxo>#^TG0lnPsc|+8{Sl;0ss;9$=ArJROtc(HK@N#;XaY`* zG^9Kbj}=+5;G)zw*Coa`$Pt^?Y0Ls<)U}tC@)YEvSf^jYxaQvu^%ubM&4S%nlhcyE zrWB_*E~(r7+^}^urB^O`KC=m92!}{HKSk<2qX9IeF>9jvlLYQ=UDhYugE_UgE?%SoRj~In!8cA`$mD?Rr6NI!E`hImHp5y$oLEnNs-E> zvE~q|e5@&D6H$;){&p|VaI?)HkFfwO?fT`b=l} znk6F06Og5|JRE3APXcn_S45V&Vq%*@N5Jxs%Nrc~s&YtH-rOh&0ml|Tc!R;v>D4l1 z-ST>jA(QXx3vg?mE->+uh2GV-qMIjCSL>+9*_tLd_&UZg)=@&l@q%hpZK3Jg0uhXy z0<@*6<1&j6!z2>Yk{@C2=d{6oyNwqIjI=G+P>vHGs8)$a2Dk1iSoO`+;oRimipr5E zuy*1twuyH+Y2mUg&@)FzfSV0(xz+1*+85JDaAEZ(<{6-fvweyN95;9(`WviAMS#7kJMCc{sehl~Nn;I&Vrkk^>#sS;7*^XIyZ z`o@fK;Hq4;rVN7l7};$5qssL?=!*RWAkH=cT0IY!LKm-LPkx-7MN|4);iP~sd#~dC!b

g&UzQm!|&E|SLzl@o7m|B4L&=uHDHyw*)8bCun9!GW0g za}1O7G5fQ*JAl_(w59;`Jl+@avPcAU*cqzkP)vOi1>t#hgTv8Z`2c@j4b8EC}y&%0X_@i2(@mL+)|r|=l-Xe9SB=oA8LU3JO?|2Z|(etas)#ORD<{TLZj^h$9&=G+1a)6^Yu|^B)iXikgEjljcgbR z-FXCG?rPQTtr_of(4HOLgxEAu36=qp%4BFyvbDCKe;oos$-#<-I7c7pzCZL+-*vw> zQ+1hL2@xvuH;engdcn7PrC*V1q@YIbS=P_pj5jIKzKBq;uixv{s4#1#Ni!tFe*~o| zKjVPfWwfh+IRXhGN*c4g8&VVaHSF3Bnp}|uaL>2CRc)3&OVylvGXDcyNvqQ;wIWDR zwaFXIv^r-e$NIX0j} zIqd(iYx_hOtJkgV?H#D8PJ7`YLOdwJscHXeq<=NgKb`e?y7!;W^zW|wk8XP_V(o(R z+_}%O3@{*WR-l(n$kc-8AUo6wq-Won(BHp^{QyF5`qS4*AqlP^Z_m>!X)!BsD>WQA z>=zEcKmex7bNlZM>U0e_76>7g3OxTI&-CYk<*&Kozn@+HcH+;Y%tR+pvo!$IzJUSm z&)6}}dEVN&^po=nqCG!&`>utH7*Z_q+gNz9s3*3f-Pr6KDk2Ii zZcO`{u4a-wZVbrL#X=)bUtZm5|(D;fk;w9F~x_`Yof=}e|u`#rJmoxP$ zl~jNpe(y-4qxI$yJ3l)04IqvODqM+T?^x(~gdh*YTem9#oX*C2xUI=vB;`H<1M@zOWK{g*w0(%67(xgX!uqoZ!E0r zthcVjLh3H1m(_+Pg$Xj$x4V6*$78*`T6wn>6Fn}c^!=QuO>>#7OE$LOa{#NW%H{4t#C`0# zATb`+ZPM4bt1V;hbm5a$DzWz&(Qi z_{TGR0Q|)J13hSe;6E%c{$l$#%inDOX8D_q>u;97HGKg5VX4ix{J5`VG^O{R=h+81 NaZ#{HvCuc~{{sN*^ko15 diff --git a/doc/profile/two_factor_authentication.md b/doc/profile/two_factor_authentication.md index 3f6dfe03d14..60918a0339c 100644 --- a/doc/profile/two_factor_authentication.md +++ b/doc/profile/two_factor_authentication.md @@ -1,143 +1 @@ -# Two-factor Authentication (2FA) - -Two-factor Authentication (2FA) provides an additional level of security to your -GitLab account. Once enabled, in addition to supplying your username and -password to login, you'll be prompted for a code generated by an application on -your phone. - -By enabling 2FA, the only way someone other than you can log into your account -is to know your username and password *and* have access to your phone. - -> **Note:** -When you enable 2FA, don't forget to back up your recovery codes. For your safety, if you -lose your codes for GitLab.com, we can't disable or recover them. - -In addition to a phone application, GitLab supports U2F (universal 2nd factor) devices as -the second factor of authentication. Once enabled, in addition to supplying your username and -password to login, you'll be prompted to activate your U2F device (usually by pressing -a button on it), and it will perform secure authentication on your behalf. - -> **Note:** Support for U2F devices was added in version 8.8 - -The U2F workflow is only supported by Google Chrome at this point, so we _strongly_ recommend -that you set up both methods of two-factor authentication, so you can still access your account -from other browsers. - -> **Note:** GitLab officially only supports [Yubikey] U2F devices. - -## Enabling 2FA - -### Enable 2FA via mobile application - -**In GitLab:** - -1. Log in to your GitLab account. -1. Go to your **Profile Settings**. -1. Go to **Account**. -1. Click **Enable Two-factor Authentication**. - -![Two-factor setup](2fa.png) - -**On your phone:** - -1. Install a compatible application. We recommend [Google Authenticator] -\(proprietary\) or [FreeOTP] \(open source\). -1. In the application, add a new entry in one of two ways: - * Scan the code with your phone's camera to add the entry automatically. - * Enter the details provided to add the entry manually. - -**In GitLab:** - -1. Enter the six-digit pin number from the entry on your phone into the **Pin - code** field. -1. Click **Submit**. - -If the pin you entered was correct, you'll see a message indicating that -Two-Factor Authentication has been enabled, and you'll be presented with a list -of recovery codes. - -### Enable 2FA via U2F device - -**In GitLab:** - -1. Log in to your GitLab account. -1. Go to your **Profile Settings**. -1. Go to **Account**. -1. Click **Enable Two-Factor Authentication**. -1. Plug in your U2F device. -1. Click on **Setup New U2F Device**. -1. A light will start blinking on your device. Activate it by pressing its button. - -You will see a message indicating that your device was successfully set up. -Click on **Register U2F Device** to complete the process. - -![Two-Factor U2F Setup](2fa_u2f_register.png) - -## Recovery Codes - -Should you ever lose access to your phone, you can use one of the ten provided -backup codes to login to your account. We suggest copying or printing them for -storage in a safe place. **Each code can be used only once** to log in to your -account. - -If you lose the recovery codes or just want to generate new ones, you can do so -from the **Profile Settings** > **Account** page where you first enabled 2FA. - -> **Note:** Recovery codes are not generated for U2F devices. - -## Logging in with 2FA Enabled - -Logging in with 2FA enabled is only slightly different than a normal login. -Enter your username and password credentials as you normally would, and you'll -be presented with a second prompt, depending on which type of 2FA you've enabled. - -### Log in via mobile application - -Enter the pin from your phone's application or a recovery code to log in. - -![Two-Factor Authentication on sign in via OTP](2fa_auth.png) - -### Log in via U2F device - -1. Click **Login via U2F Device** -1. A light will start blinking on your device. Activate it by pressing its button. - -You will see a message indicating that your device responded to the authentication request. -Click on **Authenticate via U2F Device** to complete the process. - -![Two-Factor Authentication on sign in via U2F device](2fa_u2f_authenticate.png) - -## Disabling 2FA - -1. Log in to your GitLab account. -1. Go to your **Profile Settings**. -1. Go to **Account**. -1. Click **Disable**, under **Two-Factor Authentication**. - -This will clear all your two-factor authentication registrations, including mobile -applications and U2F devices. - -## Personal access tokens - -When 2FA is enabled, you can no longer use your normal account password to -authenticate with Git over HTTPS on the command line, you must use a personal -access token instead. - -1. Log in to your GitLab account. -1. Go to your **Profile Settings**. -1. Go to **Access Tokens**. -1. Choose a name and expiry date for the token. -1. Click on **Create Personal Access Token**. -1. Save the personal access token somewhere safe. - -When using git over HTTPS on the command line, enter the personal access token -into the password field. - -## Note to GitLab administrators - -You need to take special care to that 2FA keeps working after -[restoring a GitLab backup](../raketasks/backup_restore.md). - -[Google Authenticator]: https://support.google.com/accounts/answer/1066447?hl=en -[FreeOTP]: https://fedorahosted.org/freeotp/ -[YubiKey]: https://www.yubico.com/products/yubikey-hardware/ +This document was moved to [user/profile/account](../user/profile/account/two_factor_authentication.md). diff --git a/doc/user/account/security.md b/doc/user/account/security.md index 816094bf8d2..9336dee7451 100644 --- a/doc/user/account/security.md +++ b/doc/user/account/security.md @@ -1,3 +1 @@ -# Account Security - -- [Two-Factor Authentication](two_factor_authentication.md) +This document was moved to [profile](../profile/index.md#security). diff --git a/doc/user/account/two_factor_authentication.md b/doc/user/account/two_factor_authentication.md index 881358ed94d..ea2c8307860 100644 --- a/doc/user/account/two_factor_authentication.md +++ b/doc/user/account/two_factor_authentication.md @@ -1,68 +1 @@ -# Two-Factor Authentication - -## Recovery options - -If you lose your code generation device (such as your mobile phone) and you need -to disable two-factor authentication on your account, you have several options. - -### Use a saved recovery code - -When you enabled two-factor authentication for your account, a series of -recovery codes were generated. If you saved those codes somewhere safe, you -may use one to sign in. - -First, enter your username/email and password on the GitLab sign in page. When -prompted for a two-factor code, enter one of the recovery codes you saved -previously. - -> **Note:** Once a particular recovery code has been used, it cannot be used again. - You may still use the other saved recovery codes at a later time. - -### Generate new recovery codes using SSH - -It's not uncommon for users to forget to save the recovery codes when enabling -two-factor authentication. If you have an SSH key added to your GitLab account, -you can generate a new set of recovery codes using SSH. - -Run `ssh git@gitlab.example.com 2fa_recovery_codes`. You will be prompted to -confirm that you wish to generate new codes. If you choose to continue, any -previously saved codes will be invalidated. - -```bash -$ ssh git@gitlab.example.com 2fa_recovery_codes -Are you sure you want to generate new two-factor recovery codes? -Any existing recovery codes you saved will be invalidated. (yes/no) -yes - -Your two-factor authentication recovery codes are: - -119135e5a3ebce8e -11f6v2a498810dcd -3924c7ab2089c902 -e79a3398bfe4f224 -34bd7b74adbc8861 -f061691d5107df1a -169bf32a18e63e7f -b510e7422e81c947 -20dbed24c5e74663 -df9d3b9403b9c9f0 - -During sign in, use one of the codes above when prompted for -your two-factor code. Then, visit your Profile Settings and add -a new device so you do not lose access to your account again. -``` - -Next, go to the GitLab sign in page and enter your username/email and password. -When prompted for a two-factor code, enter one of the recovery codes obtained -from the command line output. - -> **Note:** After signing in, you should immediately visit your **Profile Settings - -> Account** to set up two-factor authentication with a new device. - -### Ask a GitLab administrator to disable two-factor on your account - -If the above two methods are not possible, you may ask a GitLab global -administrator to disable two-factor authentication for your account. Please -be aware that this will temporarily leave your account in a less secure state. -You should sign in and re-enable two-factor authentication as soon as possible -after the administrator disables it. +This document was moved to [profile/account/two_factor_authentication](../profile/account/two_factor_authentication.md). diff --git a/doc/profile/2fa.png b/doc/user/profile/account/img/2fa.png similarity index 100% rename from doc/profile/2fa.png rename to doc/user/profile/account/img/2fa.png diff --git a/doc/profile/2fa_auth.png b/doc/user/profile/account/img/2fa_auth.png similarity index 100% rename from doc/profile/2fa_auth.png rename to doc/user/profile/account/img/2fa_auth.png diff --git a/doc/user/profile/account/img/2fa_u2f_authenticate.png b/doc/user/profile/account/img/2fa_u2f_authenticate.png new file mode 100644 index 0000000000000000000000000000000000000000..ff2e936764d9ce529cac8ee52796d79b89041496 GIT binary patch literal 17582 zcmd74WmubA(?1FYiWMvFPH>kH+=~ULcuR42w-zf>N?Wv$K%qczhvHh?-Ccvb%b|Ne z`+4_y|L1%--%fJPl{K?|BWp6b=Z4IcNOiCR76usx0s;b-;wxEA1Oy~70>U#UG^8hq zRxvC0(+jedl&Ta0LRl>4ohix_kLaeUAdOHwNCAIh(4AlDyCEPDG5#S$MNNjICjit& zThCojRRv_`J55YI#{@y(s(=AJGz0q#pwP*fS%TW#9VYV ze?i>s#OU-?)oEm$TrFq>IQcob>BKQ;XlO)T%`HKivhx2?f8xaGtliz6L0nv3US6DD ze4I|MR$M&7!opnKyj;Az98U-iHy=lLQ*RDOH~PPg{9{Mf!p+Rp#@XG*$&u!dUDJ0? z9`0gvbblQE_wjd}7Tz}h_Zd-LMO*IX<^~RjA0Hpz-rnly=v-c2K0G`;K0b2hZt(H(9UL5Rq)%U8 zU!RU3o-QB6FsmaO7Mn*JVPRoMM@Rnt{?5+M&CShc zXJ@~D{knU2oSmKB+}zyX- z!Q9;3oY^xO8JWAgyZ-+Ew6wI#yNA}+*0*op+O_WM>+660`c+p~_x}EVczAeh|K|Am zp{}m3y}eyfP%u6|espxy!^2~Hd;7py7W4D- zF)=ZRg5@S%JA z>c{k{ch|xC*{;Qg*^s_NZPvvb1OyrcMOi6r@7XaXC>U(xVOeaT{= zAw-rdszZs)DlM9&_n;T3%zg$}FES_!_3izb>%O=bIL5bT*m=x2?V@+|koH=UVsq1H zQ-Uvz<_;497w=gL0>U;jg8MTB5F)}4e1u{2|FDvP|F8&9g!f>Czu7;azu5oLfg=1r z=sa2cKXsl={KwC~b^h)4zdBD*{M+qvFWepfz1>j4aAcyHl~uGW(tA6M-DVMy5Ee#R zx-snYS6>L^@DOWqh7Z`#$Md0xp)cvaM&@S~C+?O*5SCNu`p!@Cl@iD#nQ1Y;6I8Ji zyCv9*%aI~3&$jwHiW~M2Zj|ST65C2br}@=1`y$N+4GWWW5Z~KH8x#{)%$R2uD%tmX zU4zPo84~dm{GTy>@CGJyzkX?{yXxIA=nZ z5%s%dLujwg%YqF5m(QzMQYBAAYNYBtnA1b0CRO{HNF8uiKlb}$GzF4L!Z_;eLsV(1 z#q-)Gv*EHZ-%KNx%mpb?7Tuk9%WxBKXmyq=??+u!7se!ZWy7Sbu>s0znOHF~TtfoE z1x%7O>D|igcs4XJ&E!~PdASD*Xe0qY7(c?tyB9G2z5rnQJ^}xNR*pjA-!J2W1b>(i~)QD!|C!Jp+BX+KtC` z`nz-D{o(q(gG`*>d9LjvZEW;oHIB*yo| z#*F96m>?8Gk&(qTPHX{O*@RZ>(6Wl2ck8JLG8csb?_-SsJC|Yy`&(8+fma-v;bhDl z+XU*c5Yzr6Uw5*|S1@gNixkc;XY&&yicNN7@O*v(cMLqJX8R+cv-=Hg)7V{n+n=RY z=dAGi;0s)Mk3DM^c<131KT+Cl5syg|N?rBaPL-p1Lt#KOymFC<1S)YuXzCM2=q6oX zvnuFcq5gy7D}Iym{R~S3(flHpnC*cWeV3KNW*7*jZ=fe|>THv{SQ!z1e)OvOc&uZF>u!^qR+%Mz>1#JcA!W9^KN0nOE#~|w`Sj- z+8zg(m8Zri%gl^vRxu6mr=aXt_BM1+c`a0chgssm1zmSqnZ~;hJ4?o;Dc-4Kwo?kf zPcQ-+zrV;Gd%5dsb<;0*A9ghNETLY7>weToRf1MV#H34*ZAB#&$X3af0WnVxvIdyR~3KlkDd0IXSV2!?7#jVuS1yOVffMjM|R{hE^KU z>WBNcn+tc9$b7yF(IwUuI@2FjqEYBSkfsa-n;=-p%#3PIi#oAqsO3KPjq22ZRH44( zPpO`dvc^A2PQAHzR{C6sB7abP9S&tBsUY)<$F34!Oa{B71=aWZD9z3{kqeD{(G};c zchtKkkctHe#8y?izB8z_oCBYZC~9RW0IJ#fDuQ~_J+tz1inP!Y@Y#OsX5TC!6%U%3 zi1-PjOxm-xD0I4;Mv78yJc{18m{|=a5{clEQD07pCvE04 z#{3@2;sr3%eug0as*qkHllh{XkCYHQw7`3_EvrRCepd{+zV!d#=%#=h;GTJEbn>Bo zas_gnhwqM2fWJRI893#dBAO%Q_LZFJJlEw_UE`8br%Lo9sS1G`#kbw0Zp!u*`q(v$ z3zOB?$VF>S7x~9*c4{e>9S)Vq<1CGKI0>6x&F2J<(cdZAbi$QGHy0@%0^Dyl@o%o5 zQ8EX3yhDZaiK#6Y2H*Zk{X}H(%RRZ3(zZ?ybJ>g(TS|JB|<4QLM|*_PZIfzHRTN>efYuq7N4E+P?a}{Vmla31bpjz^p}#L!G9ReS%QT9R-K+^2K0-2dgmyu*`__ z$5@7$-v=z^-9PVL+wR#+is0~t(U{{_6X8AiCglP2d4G0e;Gra+wZ{dJXqOYmJ=M}n zGqwTjJLeneglC;d&1ORA=%$uxZB;(->-k7e%|lG3{JxF|FQ>49Z=zPWA*?!}YVC8f zXybdZ=A1Apr~adCXZ_RXtO0C)3$&>|q;x>6asaQ!d~RB4U~_jbWNPF+5;>(COz3Q) z@=9kK5uW=x`v$N?cLlY}gu7YM4%Q@?GJr;EU8}aJ`5@$Wbfx)0FInYF-ygpp zHP@U^!dqrI`PWj=py6JYht;GHLX~piC%>(A&VPG{wry%QZV3#yn6Nq&CiBM!28d`F zYzF|9oowZI3gX`2-Bo0nI^PU_YVBh=$n$veM7(}`acEpU)h#&^*>p1hGpk~P7@&K5 zJ{8&I+FuE`7RH8#=Z+QokS)hG#WYxo5<-@z#`~yx)@$4(6f%RBsCJHJo0xgM_EKfq~zIXJOrWahdiLjiTk;I;fMs^{)xQD95HoY9-C zfX?IwE?1GJ&)JdRKQ+wk%b_-nC>o4m_t>-dR3EsT{$)?AdS`o&O=H*HxB25~tNV#w z{GiQdnuLm?7|PjL&sQRMvU0FH!j$|&4j#fZcI< zg8F=rbm)^6#T+`Cd)4Y=&=1kT08o`iBQPCUhL@_UK)3-W z^!C@lYMT5tfUVCWNK5Q6moU8O)Cra=>*3j z=h;}njeOris{H;MRfiQ>C^@#ynQ@GA3p~xlu_O+OzgSl$>qZZGR}{;U^Ym8wCq>ac ztD#U!o6X?BLtUS%et0PG>+(C>BTo&Op|!WhdB|B{P5gfzK?-SfGL^kRQRWsOOdnf z@8lC$ZjvfQxFX@(F^SNiOIAc5vpl>N4->d>2$oO1=t$Wl;*sgwV_s70$8ub@8%cF` ziPQSzaF}1kK~YRNcV*x)=8BDTAJSmsf^Hnq9%&M3opOb?6ac?ysLEIbO^ePZmBNB!!;(81@Vglx5s_=V}o{Y@+163Q~1SVo_h>H0EHNcV6U(-);HtJ z@M>EyX@}eX21$y+I|_*2T+S2=GSlR0S`$*J#r|+0n(K<8T8Tf5!|rq8AKxsLwZPj~ zburn?9Ls4EGv{?FJ_%TN_^Pp+1L?LEj81xkJCQ(*oC+ed-m|ppT#Dxn%FXb)YD_tY z4n1>%It_Vae%;2z!+qWGN;%pV_@eWwVX^tAE4p~wQ#wy1lw!P`dpcuN&Y8weC zK!0e5eK=gcq%Xxr_$+klUh}9hkDt=(Xn(6so1~+qPc@)J-zP?dAfYMJ}1JS;xG&RN+Ez3Pfr#d4eq79*dq# zxtG}?qDuSte$M_rm2vmJnLFOzS3hWFak#d*LO)2Q|&fZ$( zxhmV+#awk`LI+a4Qa2RmI(o>Nm$V1!t4rc-#)>0p6{{jO$8NzdHSle)HquR?6YAJq z{aE`}TS9sKMoX6wq3(GFTP!IyoLKH5w~*4RuDp zyiKshl$Gn4mfe?9xF}6@`)m#qJ7Co(F?}lrXS=A;XQox=;*2M@m`M{ur(RQGOoX5F zxxB;`n0D$DakzE?#`{aDP9M+Xnw^F{8JDaZ3V%ENHu8CG@!CK!jO)Q|+|heLsF$S2 z+c6K&fGwcJ$!o zJwyQ7GcYbPga!@xwERQ=V*gn_9rFLa{9o)}>VJd&KkwA3K_DuJ9}gGzdwr42s7Jm0 zaQv7$i_`9xniaPe(%l$I_?<_6Pap1Y-^`Ulgy%e+BCQsy_X!Wd`!z{A!lbvy6_Igkz6&Atxg-{$AWzeTF&Fg(zgc%ONf4QXcj7_oUqn9# zYce{DCm^>QH8X;Ttg`bG=DtINb7rN^(Fn+1M*cSveKJ1>>=C<2Y=GapC&Oa6(^QExsI=QzF}vqk9b z)g*z*BZI4r9e$Em4Gc&*93?!yyhI~BSidCy>}D`(_<4IZ0iSI3oI_62OfqfIYT2Yh|dCKG6F z?@>>}#M2z!+CI>@68tHCT0izP@2;PJ1Lt56(eqvX*lDZNm*sbhz5-iQ%UFT4b4FYm z$(cfO5(h$)dD$BE%M!$H|3)hF2!=@9N4bC$NHNW zUXzb0kCpp4TPTkJzf3JzC3--yE2WNh^GNINaeHPj`D0Saql135$D_U91x}xJZ~2AQ z{aV8T&{3tpy;bOe>kvMhXKl$L?CEMdUz1)^ig`c)jQPE~F7naPz0!MMh`X2duJb`c z_ruEG%X`1x3^%gOTTGS;w6pilbi1=E##c<1!gFn%zoiUjuFz(d!b$Cs)4@6ZA+Kkr z+Hil#eCHnsWBp!DLIB+5NmpwICH2_1kluotr{j?v#wH{9OZ z^L<$hX=Ys-8Qg?JWPXuM{>vPCCBq#n%|xt^%hPwf0(7|B1d3F1m(`IyTHKw;GW>|1 z3YmX1n{#)U0emCSVQAodNAaNiJ@@TVnn$F9SUN{o-04}v(lH>KM&sN2F`Sj@6Z!db zww%WYvam5u5&v(i9YN(aPA>5=hztH-a-$9)z8C;;gy8|bdRx|KVkD66DYFm4*_WN5 zpUz6Dz=SMv?bH4GSLxc<_Hv0HiG&_$19~4i3JjWNb3)F$y_zlWXTSmpgfq_$rc^;> zsDMDBTu+_rZ}b5bF-mq2)+Rd}rrx9{Q*OOB4abe$WOg(T=QZLIHbI+sz~c(@RXQVN zUv6Mg)N#5hxnqU^*xwg7-Nm1^)~Hx>qk{1Mj)yT5zlk9O9ad@SPDidQGVj@84@=1m ziPd(y2}#~scZ$9LElx|M?dTJ7y^9$#t_Mlv)Si@Uw_!j8fE;|1&a)ZlUj@SQAAUMT z#!*FtMN8s52e@7X3X()S5}jh=oHCmjtSQ75)1hM;%*n}3qrIrA3Fj$< z;CL>5{nbEtipll635Pamu&F7;JA7kYOa5^OCC`Zs1E$jy6}kB~L}Uq3_5AugBAQ9b z!f!zC2WoKK*O=RBA9{%Eb1)?txX}eTF~FU(#C1E3wW2*`C$3YWpRk3E{hNY?E!_m2 zmj)3$CzVDExcd1<>!D@fx!WraT0)){ob<=oM!Q`bdi}O`jZ*|NKl>Nq?D)|n6mul@ z(a|xK3=wp=XkQo|$=M?kWa*H>@d-3hdbCBZ*LYtq7_VWlf;t#%>sDNIvEk)LyjK;zK1KpG95!xq+rk#=Ck>eH|2{i6KQC(3 zMIvu8LIqMyF?Ej;bz5aR4F8-2wg@`lFTtLb+7_~@{o}ZO_ec5LoCMO3fNx;+g)1c8 z0wWsKm#F3gI6Kiu0ra~dP$RsZ0iAv-KgceFhvjx>9o%du(7pWRN(wM7obnjkOTbD* zwh=tPA!TNlf7YP}aBu5^Zm)NGegoG~nbQ6^GbY(1bU|yQ&*69<;o+veO>T zgO4`?#P$$Umj+s3nX@Vz_Ol&>#xejsT72A{mFtgAX;>VjeX7R-$9ao35p-KF&L@qn zuhA}p!8HP`!7Q)Py(>{S`AbjzRV+r{&eqG(Q=<bH#&6DhHB1OO&FW zE8Mt1foJyO!S>{Zq_;!nENu=LpWM9WcwhD%R>jG<;_DTIG$TJvuYE7_9t-@0=tXSO zan#M0YqjcmTA%IOXfib5o;fxQhhO`rpJH;XUmW_E!AY+y7!n^<+ ziRFG+~FD=o&1>qp9m5IfFZ(29% z-X{KwLJ!_yt-%&wueu@?-6AEbh)xOxDf!!J#hW;v=iqfwpatpv^Sq}c7i z`&!}M0lc>EBKJCCRn-1r&N$o1T~pfpuEOuF@NKz<=Y*EK6f&t2<19^^61UKoKLg*t zoeZ0K-Lko|wOONpDe>x#d}vb7Y2(@zmvbjXqillz%Nma*qL=2{EsttxWlLK|X{UtP zBQ_GJT*-p;b7p3+D^C1vLK}F()i}aiL!fOtRQdF4(5v;#Y7w5y`pO1ljNy#5;U!yI60na{c%evFy zLL5ru+;r}-D zm-+t@{x3r#k$)-uWBuQT(0(CRi0(Ezc5u>P`bc7IppE49Y4lD{Nf4OX-@+J)^&1r8 zsFis?C#2eunH_f+?s`@dKBQ0Ginf{aQZ{B3dptJ2`bK&8ZLqfJN+oH8#bVBQ!_;o~ zQ;hNLII|hO1e-8VYYzMCKsAbKf|5m}iB#qhA~jNx2UPbI=_F_6y1<4EZd9{RSYD*i zD}MHSX@z{xbH@>u_VwSeJ>^|p4xgAZ4b=xaGxBz}tx3v^v19_>oo%WCTB6v+l;XUz z5)L)vSFks`--HL4d=Ckr-pFlf7!o6`9*ZsC2Gs0lT{lv>0%wRG2tgL0x~{qGIG65G zyv#9<3L5TJ#)KJR|#J}q-Z)JxWWN!qWaI5Ymy}VYA6!OR8Ft5`6 z^joDY&9Ge5T{;ZI?))7suwSfw!)O7Dx81E#5`#oULUv%b*;bf8JYBq%B43k#BBt+*?F^SUnkFVQB(1tZfEg1v0b6 zOcxYuu3jlIvr03a+CM9)o_wKgrW*GBM|cjsr+1Yg!*fi1V%5`*F%4zAZ0ApeuM(?0 zKrSam{L2?jLCHxH=!ntZgyu5eUnAvFlcdORgIgyIY0X&Qh345N(|hYEdU8R-rzcT` z3DdJt&_odm45wg`b35xOM)tSc@v#+^&blQeeyv+;Jf|upahxKPg~%4#%%jyBKe<Kt48`mjX+1K)he%0Do!yUYm40w!PL`nS;Fb5M$BTMA`0a|^ z__^TJcSgd%3cvZbCXnjxt_3NbvG%%z=OA2&=G*|LX-?Ri{o zi8DxVd~}Bhu~hqVt#ub;yWhNv#Kk2~5##Eq!X}ag%vOx_-MWWj2X$l2o!g^1AC?sk z9lDYZKug$gIJlt0U#~vSfQoxn@CY^vO~=qlv)evhe+=*QBbjIJ5jZMQ^-A>6@lgvU zO-`=|P2-0*MhWo_0?FzGoJH`&dxgDQB*e$Jf7eD_^l-f2+UF4%Ga{QdA%S)_7?$pn zh4m>mN)l#`B?D%31=u6rOolohFrl-4G39-)}I8pvGJvTH7{L|E}AX2}L zH^V6XP2}di%+K&_)v{yt=YDnh!e!VPJ6>E+!OYnhQDh{m%&EvEd$VGp)>ghtRSN1Z z?g01T2y-dD7P8J^aIlF~J61-V6?v)5&pTJU9C~P0){j~t*}&gD6?ujyh-zOuTE*P( zGhbRq8KS-kX#og@>1riWx&zHCyI`f&rzAHawp? zNS1o&Uah3d%x{0d@s&Z%N1P!{WY2y5!#h#xw0`p~0^-I#K}MVqazv^Pj;Xf1ll~Pi zRU7BF*ZBUw5*My^K2oKeU}2bqC~KjGY1L)@rh8TxTruhE?p!`vQ@CG4&19xb^_qtu z6dw&tR;i-skubeTh7D`!i+~VpxROB96k5^kqu3crUGZhG^2;Qy5#@sAS$67pTZe17 zTf*BE1Dw-ErthSJ73TIPu&9Ux=kH#Nz}VOlU^}X<1JH@OoOZ zZ_8kx|A?24snJA4u08S~dnjFf?GZ+ZmakKbBIEUd8LKw2_F#te4h!SGvP=MAztyy1 zlFJ$ZL@qcOeWT>9TKX2KO0F(O`XeEu@g8Mq5y)NZ6JSK3W#dWy5lI=9BSQ2-Vl8Xjz=SG`cJ?34`%iJfwP+!g(|ao2qw0cnlQao)@{tFn}=Xjj1!pRc(vDL&lpCG-76JvNkC$r1&A znyRYJn<#xg6BCLbH=0rtMdnM1w}^8@f(~QSKrsqk-uu;b$e&?Rxzh*Pv|98LB@dSA zmh+@bj2E(2mZA0~b*ls!VnC)XdCyrXz+Z9^6?!LmeAu0z&E?ng!V{*!Z6}6C!cPlJr~*7a zn2;~On{y|{1bldSADef~ObzVrx)IbcPe=TI^}+SRh_842gGDv0ib9N0W4Kw$I7M&= zyc5c5WMo^`CZ&7N-ue+0#!JTRX~=vOn`|?Y`;HU1+VX(I#FOZ|-2}$We%Bng%4ISH zSv~W+@>LQIdtr~=ZT#7ZZ%mmoV&sb=T%kY46T`WWwNI+ZWF+7?Oz_(yjp5$r6dj+m z@&r3*{sQSot9=*HO~9h>E%N4K?x2xL3%acr@w`!^Z=*el3_HzyOJ|!p@AE?X8U~Ll8qc3E zeR&n*R3eekSzgZ1bHI*a_zkD~XuS558Nd4%9W=oaOpG{13jwO!MGAggW>@}8NEb^OfrL!u&oQ#gLS15&6uG0cn*P=26V2T2C4pV5sy8~ywJS4Q=UN`lN>21 z#qDq|Wa$};vP>gQ6N7tmirb@D8WksmwRWjE!+8z)jU8Eukyg};G}sF+TUP+}o!~2d zGPQN4wkh$x#1CUwV+WI6kQZ_bc=_Xl1?G^(G0tY|Z(maA##Lh}HaNwv9ITlfY;u)W z73KizLYR7Fz_21g%nw5gMZC%E)1u%i4HdInZaqx~)oQ@u$WtJ2<+VV&$E3-O}?UrTv%aNx1y9rz!|{04+^=QE>3M9FCR{rPl|TiL#O7^*50VuUfB&gYjVlsKwk@2k97*Wf?9{L z(1+|kn2$^P^OE4k;$DBwN2D$2RgR-41e+ zl;FrI@k@T-@y*;ii;<4YtIruQnmTSTr+k{mj4mWV_7*FfshUIK%L38#*C0xM_GW0| zwo}yEC!EtaSm1A^$sSVv{u?)^o_9WGKvBV&6pMxGwv{tYCwHmCyptiyp(u)!bM7{t zNdn;Y0zeh|XWSn&8fj9l0QIx4S@1?ddO z&nIcYY(uBSz7(6$4_MXgWl&7LPpz!|*p?z>!Y(Zh0Ssb-?WjS z|8@iDQ4Jj?C;gejMaa65sm7DQAV&N})8=-g%hMGg1`{?FW!}jTl+x;y-~n~2{5X4! ztbOMTw9s*Jlp7EsgUAN0UvxYB?tf(P33-hTu;~k?@+`IUiJT1?BwKh@_d_cw20{kB z=Y`CwOlO;GX6&rvLynLq9S|ZY?v5PF=TQm+BF`Y;u1T=Hbv|@+{f6u^V2(-n5}@;YSet8+5y~YG#)1SAf`^SovtQ-h3bUWOw;vnoN_QtPQG8XQ)x$1(u1m8pP)$+`AGhA@M%V1>(lL#aA@AB6RG%vvp z!c=af+mc3RmAGABokzo;7gX_}!Gi4-YkIz_xCDJ)r)UO?-noW#Dn# zRJJtPJkZXqnKSkz?VkUnQ+P3bAOShJqUA@4FpN({@MS9VY!kP0wvZ^W zJDnf2hC9={q-ARu3c6rs_Ip@Mj{sa==FP9@_;Cy6ecZ~yxl@s<^Q{77)}7r=3Hsyy z0m7TNAI7@k>CzsScSa9x^~DQpwt~z7z%WmwX5#9uwOl9jXwPYZ`0f3snYmNrOQey6 zBeP%b3S6?U_pZ|S6W(|ZXMa^L-p#Kn^fQ*|N%>8ZPUL}tF`Bypd;FF>Y^EcFYw=Yi z$n|_mfW%j&|9++Uy5S(dt3|6R{^IC>7;M7Kq>}d4&BIW@K&pksIc{WodD(jHo~vz) zFJE{$dTZsVlGO{#e@Wu1bqTT$Pyg(vaxhmT9l3!z9Vm4F$n>+x;R)^T3Ebdd z1Jb6ZB+lEFm%P)DzDUj2nTWPGnN!`LFE1Y?$luwJYNSfw`e`r8=ojw#^ZV!LKUp$u zT%H^azJTed`Vo!~W}>U|rT9QlR1MWj0N?g%fT>gV6&ac-)tf2OQ8?-PRxpx+r?$=m zpI@w#9$K{CL-j!`EwI*l3JyvNJ|+?jQW4&S5~c3VS={PErphQ!zUaw&5Rtp zsCNzBd*9TBcZ|%@>%3EfdFRhrw!4uQ{~!$aUvVJrJ32)GLyh)(g%MgVy^nM zd*#t0XI?tgx~8gxr20|i)LNqs!1SE)qDJ0$3WHTK9@wp#Po=v6#%CYp&zJfmMI)^^ z&1=!n{mZ(Wl^k-Syn5c!H_#=#VODKGqclN za*xqsP|JjPtHi=^HA|bI-rqU%PNfFcXd#jmRh~q;An*H8RXY*fOTPM}e3vR|_bIhi zgs>V+s?10g5Bj|7S7^Cyzi4p`o#)9!Jmb)pg{mY*gzzb?*2ToHOPMd3p=ZI+u6O+U%?l zk*df~l^fR#CC4mdR)C}^{0R#+ol+Dq`!ri+FLVwL^ zJwzoRJCV465fqZYW#^L?u<=yew$xzr&_45awokAy=1X?-SrFf(G3v9X2U&rmgos;v z%RY+aPiW`~aI4n^`Qkj}2!Ip8oWecA&;~`zVFEz;Zfx>F0$fgHhYX^E3w0^~9f2*R_-0-F9sMzgqThuA@h|IvRjUK zrU1Lp`JANlzq>N|2Mt>!=zLf|ONl-JHW{t8YxfqJCJv`eG-JIl6o{GDAh2U2o%1PdvZ`X2)6dNI94N@ywO1w6yfoBQq z`zS4WDcS|EE8nFO8Q7$W?AQ7NyrE6Me~J<9GL~P+t{t$xn!m5*c=~{kgCSX873}=| zzNZ@T!)90l*dQh+G|oB(dAtD{zJ^PW!y*YrJnuAocnnliMC8FT5bxcNP*j*ORd%^G z7pJQ@DlD%PnD7DL86s6t%gDzabApCxz6eXb}<*THh%3 zvpim}RCf2#{C?9LpZQH8QO+;g9=kJhaa<&U-J_G@PdT;sDDviF{~FNC?V%bkr$UD1 zXE5sh26TSO85)edTlEMiPj0fJr&E5WPgjzO+RifA^K+i%-Zc77(_ryqoCsriu^)Rz z4;m1P2p&f^(I7nBrh*l=1{lWwCSJEXb&jPgx2E>p~A}b zh?ux`?lHpUVk%t?Tr=Gbb9Sj>_@6@BZ_C?b@#tbcPEU#)Y??Z|bAA~aIlr~6y|!XJ zYIb$&3Xl5LuxY+Y$fL4A3^?KQz>xOQOV<35YXW`!%C5Y6+r%sCh=jMI2frbC+D`sY zx*Q;rc9_!9cfwRXS%PtG!WvB#8q*v}eR;P0Xka2$`RBUW;8}wab{{rB(en`^UQ%1B z)#{+qer9gn4i&-FH3EI(g)Q1#4ecV;S!td|V=aLfi!$0LSr)$`U)d7zwL@Wk{1|X0 z+P0*eKkjrOdtB?;K9;mg$#pPVa5TG1g*Gsod{wqjC(|YNHJmxZulB&mwD;CSW++?p z;Fe_u=C_d_-IXvJ8D$dc7vAKX8F8@iM<5SXc91HF@jdig8xvf+8*6c)c`Kt0hUZ1>0mO5E3Y8GMEQ zDiZ*(e%dq-@gA}1NLY{=lvQ;xjEvgt{W_2FrxYF-f8JGF^isd;F0McZyeZOU3p1|> zA3;!ZA}*4*QEIeK>9}F>UnzM<6pfGQ*yq@~z*n?yOOXB4{Szf#Sb|;<`tSB#LB-I3 z*US97?m3o!+9de1RurSQD7~3m8{HJ>h^e^qRy7!NN zc!CFFf$JPMlrS;1QVESwpZe=f0x%%_&rQWY4fU`41<2EQ@4ve7UtRe>pg)~=o38^d z=8O?F=9kRje9{W%J|oLQ9@!nHeQM;_%V$jP$lAf%%xBLnpY9Eu-yOiw9(tC9C|iXQ zVFt7?fep!&^~fzZ!|(XlkwfM^r6B;kJ=}E<+MTi*$|M(q{!pfys=1^l)atXfhrUKRrRg>%h|`-Dl-a2 zQ=0dgVl=+lL?+K%0m#V6;8(adUGtAXB#{6_ZZh$bzv^*vb0ipyBQxhrm1UsM%HS)MBAyJ(C4&K`5ET15Z&sv z^;z2Jbz@^Y3jnrZJQR{vW2O2ul$*5FXJdG|^Yo>k*ugJ&$Gc*$5?_7c0ADhZL%(^Y zv6wE~-d^|{H3#qWkRLT_Dl-16`xz-GuCoVfv8;q<5?4X7hSnbg*)`9-sq#myK_u{J*bQM?oo{C*o7b(zgVEqzHy(kefYvouedGKHD5Ip|;E **Note:** +When you enable 2FA, don't forget to back up your recovery codes. + +In addition to a phone application, GitLab supports U2F (universal 2nd factor) devices as +the second factor of authentication. Once enabled, in addition to supplying your username and +password to login, you'll be prompted to activate your U2F device (usually by pressing +a button on it), and it will perform secure authentication on your behalf. + +The U2F workflow is only supported by Google Chrome at this point, so we _strongly_ recommend +that you set up both methods of two-factor authentication, so you can still access your account +from other browsers. + +## Enabling 2FA + +There are two ways to enable two-factor authentication: via a mobile application +or a U2F device. + +### Enable 2FA via mobile application + +**In GitLab:** + +1. Log in to your GitLab account. +1. Go to your **Profile Settings**. +1. Go to **Account**. +1. Click **Enable Two-factor Authentication**. + +![Two-factor setup](img/2fa.png) + +**On your phone:** + +1. Install a compatible application. We recommend [Google Authenticator] +\(proprietary\) or [FreeOTP] \(open source\). +1. In the application, add a new entry in one of two ways: + * Scan the code with your phone's camera to add the entry automatically. + * Enter the details provided to add the entry manually. + +**In GitLab:** + +1. Enter the six-digit pin number from the entry on your phone into the **Pin + code** field. +1. Click **Submit**. + +If the pin you entered was correct, you'll see a message indicating that +Two-Factor Authentication has been enabled, and you'll be presented with a list +of recovery codes. + +### Enable 2FA via U2F device + +> **Notes:** +- GitLab officially only supports [Yubikey] U2F devices. +- Support for U2F devices was added in GitLab 8.8. + +**In GitLab:** + +1. Log in to your GitLab account. +1. Go to your **Profile Settings**. +1. Go to **Account**. +1. Click **Enable Two-Factor Authentication**. +1. Plug in your U2F device. +1. Click on **Setup New U2F Device**. +1. A light will start blinking on your device. Activate it by pressing its button. + +You will see a message indicating that your device was successfully set up. +Click on **Register U2F Device** to complete the process. + +![Two-Factor U2F Setup](img/2fa_u2f_register.png) + +## Recovery Codes + +> **Note:** +Recovery codes are not generated for U2F devices. + +Should you ever lose access to your phone, you can use one of the ten provided +backup codes to login to your account. We suggest copying or printing them for +storage in a safe place. **Each code can be used only once** to log in to your +account. + +If you lose the recovery codes or just want to generate new ones, you can do so +from the **Profile settings ➔ Account** page where you first enabled 2FA. + +## Logging in with 2FA Enabled + +Logging in with 2FA enabled is only slightly different than a normal login. +Enter your username and password credentials as you normally would, and you'll +be presented with a second prompt, depending on which type of 2FA you've enabled. + +### Log in via mobile application + +Enter the pin from your phone's application or a recovery code to log in. + +![Two-Factor Authentication on sign in via OTP](img/2fa_auth.png) + +### Log in via U2F device + +1. Click **Login via U2F Device** +1. A light will start blinking on your device. Activate it by pressing its button. + +You will see a message indicating that your device responded to the authentication request. +Click on **Authenticate via U2F Device** to complete the process. + +![Two-Factor Authentication on sign in via U2F device](img/2fa_u2f_authenticate.png) + +## Disabling 2FA + +1. Log in to your GitLab account. +1. Go to your **Profile Settings**. +1. Go to **Account**. +1. Click **Disable**, under **Two-Factor Authentication**. + +This will clear all your two-factor authentication registrations, including mobile +applications and U2F devices. + +## Personal access tokens + +When 2FA is enabled, you can no longer use your normal account password to +authenticate with Git over HTTPS on the command line, you must use a personal +access token instead. + +1. Log in to your GitLab account. +1. Go to your **Profile Settings**. +1. Go to **Access Tokens**. +1. Choose a name and expiry date for the token. +1. Click on **Create Personal Access Token**. +1. Save the personal access token somewhere safe. + +When using Git over HTTPS on the command line, enter the personal access token +into the password field. + +## Recovery options + +If you lose your code generation device (such as your mobile phone) and you need +to disable two-factor authentication on your account, you have several options. + +### Use a saved recovery code + +When you enabled two-factor authentication for your account, a series of +recovery codes were generated. If you saved those codes somewhere safe, you +may use one to sign in. + +First, enter your username/email and password on the GitLab sign in page. When +prompted for a two-factor code, enter one of the recovery codes you saved +previously. + +> **Note:** Once a particular recovery code has been used, it cannot be used again. + You may still use the other saved recovery codes at a later time. + +### Generate new recovery codes using SSH + +It's not uncommon for users to forget to save the recovery codes when enabling +two-factor authentication. If you have an SSH key added to your GitLab account, +you can generate a new set of recovery codes using SSH. + +Run `ssh git@gitlab.example.com 2fa_recovery_codes`. You will be prompted to +confirm that you wish to generate new codes. If you choose to continue, any +previously saved codes will be invalidated. + +```bash +$ ssh git@gitlab.example.com 2fa_recovery_codes +Are you sure you want to generate new two-factor recovery codes? +Any existing recovery codes you saved will be invalidated. (yes/no) +yes + +Your two-factor authentication recovery codes are: + +119135e5a3ebce8e +11f6v2a498810dcd +3924c7ab2089c902 +e79a3398bfe4f224 +34bd7b74adbc8861 +f061691d5107df1a +169bf32a18e63e7f +b510e7422e81c947 +20dbed24c5e74663 +df9d3b9403b9c9f0 + +During sign in, use one of the codes above when prompted for +your two-factor code. Then, visit your Profile Settings and add +a new device so you do not lose access to your account again. +``` + +Next, go to the GitLab sign in page and enter your username/email and password. +When prompted for a two-factor code, enter one of the recovery codes obtained +from the command line output. + +> **Note:** After signing in, you should immediately visit your **Profile Settings + -> Account** to set up two-factor authentication with a new device. + +### Ask a GitLab administrator to disable two-factor on your account + +If the above two methods are not possible, you may ask a GitLab global +administrator to disable two-factor authentication for your account. Please +be aware that this will temporarily leave your account in a less secure state. +You should sign in and re-enable two-factor authentication as soon as possible +after the administrator disables it. + +## Note to GitLab administrators + +You need to take special care to that 2FA keeps working after +[restoring a GitLab backup](../../../raketasks/backup_restore.md). + +[Google Authenticator]: https://support.google.com/accounts/answer/1066447?hl=en +[FreeOTP]: https://fedorahosted.org/freeotp/ +[YubiKey]: https://www.yubico.com/products/yubikey-hardware/