Copied from downstream GUAC-1574:
Add support for two-factor authentication to Guacamole, initially providing an implementation supporting Duo, but keeping in mind that future implementations will likely be made for other TFA providers (similar to the MySQL and PostgreSQL authentication backends sharing a common core).
The Duo API makes things considerably simple, and is nicely in line with the authentication system already present in Guacamole. The auth process would be as follows:
- The user attempts to sign into Guacamole as usual.
- The authentication attempt succeeds.
- The Duo authentication extension vetoes the authentication attempt, requesting additional information. This request is part of the Guacamole extension API, and in this case would trigger the Duo prompt to appear.
- The user submits the additional information. This data is forwarded by the Duo API to Guacamole's authentication system, which then issues a new authentication request on behalf of the user with the additional data.
- The Duo authentication extension validates the additional data, allows the authentication attempt to succeed, and the user is in.