Allow admin to extend the duration of the 2FA session token

Description

GitLab currently requires a 2FA code for each sign in.

We are considering enforcing 2FA, but forcing users to enter a code every time they log in would likely be rejected.

Proposal

Make it possible to extend the duration of the session token for an hour or a day.

Preferably, GitLab would retain and honor the 2FA authentication for a pre-defined period of time, regardless of login state. This would allow a user to close the browser or log out of GitLab and login again only using ID and PW if they did so within that time period. An example of this functionality is AWS. I enter 2FA digits once per day. This would be too long in my mind, but it is an example of the functionality I seek.

Links / references

Possibly related / complementary feature proposal: https://gitlab.com/gitlab-org/gitlab-ce/issues/25351

ZD ticket: https://gitlab.zendesk.com/agent/tickets/67901

Edited Sep 02, 2020 by 🤖 GitLab Bot 🤖
Assignee Loading
Time tracking Loading