goauthentik / goauthentik/authentik

Allow to send password recovery links using SMS

Open
#9,161 3 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

**Password recovery to email may not always be a good idea**

In organizations where corporate email is linked to the IdP, the password recovery email is useless

Of course, we can use an alternate email address for password recovery, but if it's a user's private email, organization has no control over it and user may not take security seriously.
Also, in many organizations, it may not be acceptable by the organization security policy to send password recovery links to external email addresses

**Describe the solution you'd like**

It would be really useful to have something similar to the email stage (sending messages based on templates, etc.) but sending an SMS message instead.
The phone number could be read from the users attributes (just as many of us are doing now with alternate email address for password recovery)

That would allow to:
* Send recovery link to SMS from the admin console (the same way we can send email now)
* Create a recovery flow that users can access directly and, instead of sending email to alternate email address, sends the recovery link to user's phone in SMS message

This functionality could also by used for users' enrollment (first login): Admin creates users, sets phone number, and sends recovery SMS (or just tell the user to recover password to his phone number)

This would be more secure than alternate email address because (normally) phones are more secure than email. And also, in a context of an organization, the organization may have control over user's phone used for password recovery

**Describe alternatives you've considered**

In users that already had enrolled for SMS MFA, we can create a flow that allows for password recovery asking for 2 MFA methods (i.e SMS and TOTP)

For user's enrollment (first login), we are creating user, creating a recovery link, and sending it vie SMS from an external service (using a script that creates the recovery link using authentik API

But it could be much more easy and useful to have the functionality directly in authentik

**Additional context**
Add any other context or screenshots about the feature request here.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.