Add a way to re-encrypt the token
mricon opened this issue · 3 comments
We currently have a way to encrypt the token using totpprov, but not a way to re-encrypt it in case the pincode (password) is changed. It should be a trivial addition and will make password changes by admins less problematic.
Would this be similar to allowing a user to remove their token if need be? I can see how in my environment people may change phones and switch authenticators incorrectly and it would be nice if they could redo their account without much interaction from the admin (me)
No, that's not the same thing, though it's something I definitely need to provide. Please feel free to open another issue to request that feature.
Added decrypt-user-token support, so effectively this is a two-step operation.