Reset 2FA in Gitea Web-GUI for Administrators #6218

New Issue

GiteaMirror · 2025-11-02T06:48:48-06:00

GiteaMirror commented

2025-11-02 06:48:48 -06:00

Originally created by @vv01f on GitHub (Oct 27, 2020).

Gitea version (or commit ref):
Git version: 1.12.1 (but still relevant)
Operating system: Linux 3.10.0-…x86_64, systemd
connected issues: 5788 (was closed, thus I coulndt comment)
Database: here MySQL, although not relevant for the issue
Can you reproduce the bug at https://try.gitea.io: No, have no rights, but expected to have the option with url /admin/users/$uid for each user that indeed has 2FA activated

Description

Users loose their credential and can be authenticated on another way withing the community.
Now 2FA cannot be reset by users on their own, but not every helpdesk has rights and knowledge to access the db.
It would be very helpful to have this integrated in the GUI, a simple checkbox "drop 2fa" would do the job.
Rights should be considered to have higher escalation to enable limited access.

Solution for now

Escalation to Administrator(s) with DB-access, have them walk in DB with cli tools or scripts.

Gitea DB walk

connect to host
identify DBMS und credentials or lookup in gitea/custom/conf/app.ini with section [database]
start DBMS, here MySQL mysql
connect to db connect db_name db_hostname_or_ip
list tables in the db and collect necessary information … show tables;
at the end leave DBMS quit;
disconnect

reset 2FA

carefully double check user data for not getting the wrong person:

select * from user where lower_name="username"

check if there indeed is 2fa active

select count(*) from two_factor where uid=(select id from user where lower_name="username" limit 1);

now delete the row in 2fa-table two_factor

delete from two_factor where uid=(select id from user where lower_name="username" limit 1);

Query OK, 1 row affected.

select * from two_factor where uid=(select id from user where lower_name="username" limit 1);

Empty set

Afterwards the user can login without 2FA and set 2FA again. Ideally remind them to backup the scanned data from QR Code.

Originally created by @vv01f on GitHub (Oct 27, 2020). - Gitea version (or commit ref): - Git version: 1.12.1 (but still relevant) - Operating system: Linux 3.10.0-…x86_64, systemd - connected issues: [5788](https://github.com/go-gitea/gitea/issues/5788) (was closed, thus I coulndt comment) - Database: here MySQL, although not relevant for the issue - Can you reproduce the bug at https://try.gitea.io: No, have no rights, but expected to have the option with url /admin/users/$uid for each user that indeed has 2FA activated ## Description Users loose their credential and can be authenticated on another way withing the community. Now 2FA cannot be reset by users on their own, but not every helpdesk has rights and knowledge to access the db. It would be very helpful to have this integrated in the GUI, a simple checkbox "drop 2fa" would do the job. Rights should be considered to have higher escalation to enable limited access. ## Solution for now Escalation to Administrator(s) with DB-access, have them walk in DB with cli tools or scripts. ### Gitea DB walk * connect to host * identify DBMS und credentials or lookup in `gitea/custom/conf/app.ini` with section `[database]` * start DBMS, here MySQL `mysql` * connect to db `connect db_name db_hostname_or_ip` * list tables in the db and collect necessary information … `show tables;` * at the end leave DBMS `quit;` * disconnect ### reset 2FA carefully double check user data for not getting the wrong person: `select * from user where lower_name="username"` check if there indeed is 2fa active `select count(*) from two_factor where uid=(select id from user where lower_name="username" limit 1);` now delete the row in 2fa-table `two_factor` `delete from two_factor where uid=(select id from user where lower_name="username" limit 1);` > Query OK, 1 row affected. `select * from two_factor where uid=(select id from user where lower_name="username" limit 1);` > Empty set Afterwards the user can login without 2FA and set 2FA again. Ideally remind them to backup the scanned data from QR Code.

GiteaMirror added the type/proposal label 2025-11-02 06:48:48 -06:00

GiteaMirror closed this issue

2025-11-02 06:48:48 -06:00

GiteaMirror commented

2025-11-02 06:48:49 -06:00

@6543 commented on GitHub (May 7, 2021):

@vv01f closed by #14243 and released with v1.14

@6543 commented on GitHub (May 7, 2021): @vv01f closed by #14243 and released with v1.14

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#6218