features/verification/
Every setting of features/verification/ and its per-provider settings.
features/verification/ holds verification's settings.yml, commands.yml and messages.yml. Verification explains how players use it.
settings.yml
Takesa positive duration
Default"2m"
Affectshow long a player has to answer a verification prompt
Too short, and slow players lose their prompt; too long, and an unanswered prompt stays open longer than needed.
Takesa positive duration
Default"10m"
Affectshow long a player has to confirm the setup of a method
Advanced
Takestrue or false
Defaulttrue
Affectswhether a method the player just set up is chosen for the provider they are logged in through
With false, players choose it themselves with /2fa use.
totp
The built-in authenticator app method. See Authenticator apps.
Takesa string
Default"Authenticator App"
Affectsthe method's name in messages
A blank name shows totp.
Takesa string
Default"{player}@{providerId}"
Affectsthe account name authenticator apps show
{player} is the player's username and {providerId} the provider they set it up through.
Advanced
Takesan integer
Default6
Affectshow many digits a code has
Apps that are already set up keep their digits, so a change locks out players until they set the app up again.
Advanced
Takesa positive duration
Default"30s"
Affectshow often codes change
Like digits, a change does not reach apps that are already set up.
Advanced
Takesan integer
Default1
Affectshow many earlier codes are still accepted, for phones whose clock runs slow and for slow typing
More windows forgive more, but also accept codes for longer.
Advanced
Takesan integer
Default1
Affectshow many later codes are already accepted, for phones whose clock runs fast
Whatever the windows, each code is accepted once: once a code is accepted, codes of its window and of earlier windows are refused for that account. A player whose app runs ahead and who types a future window's code therefore waits until the window after it before the next code is accepted.
recoveryCodes
Codes a player uses instead of the app when they lose it, shown once when the app is set up.
Advanced
Takesan integer
Default4
Affectsafter how many characters a recovery code is split for reading
defaults
The policy of every provider that does not set its own. See Per-provider policy.
defaults:
enabled: true
required: false
unavailableSelectionPolicy: KEEP_LOCKED
methods:
- id: totp
enabled: true
priority: 100The fields are those of the per-provider settings below.
Per provider
Under features.verification of a provider's entry in providers/providers.yml. Each field the provider leaves out comes from defaults.
Takestrue or false
Defaultinherits defaults.enabled (true)
Affectswhether this provider's players can use verification
Takestrue or false
Defaultinherits defaults.required (false)
Affectswhether this provider's players must use verification
A player without a method is then refused at login.
Takes"CLEAR_SELECTION" or "KEEP_LOCKED"
Defaultinherits defaults.unavailableSelectionPolicy (KEEP_LOCKED)
Affectswhether a player's chosen method is kept when the provider no longer offers it
KEEP_LOCKED keeps it, CLEAR_SELECTION forgets it. Either way, the login is refused while verification is required.
Takesa list of methods
Defaultinherits defaults.methods
Affectswhich methods this provider offers, and in which order
An explicit methods: [] offers none. Each method has:
id: the verification method id, such astotpenabled: whether that method can be usedpriority: ordering when more than one method is availablerequired: this method's ownrequired, instead of the provider'sunavailableSelectionPolicy: this method's own policy, instead of the provider's
commands.yml and messages.yml
The player commands, such as /2fa enroll, and /identica admin 2fa reset have the same fields as those in commands.yml. Recovery codes are shown even when their message is emptied, because they cannot be shown again.