Enable 2FA for Password Reset

This feature allows you to enforce Two-Factor Authentication (2FA) during the password reset flow, adding an extra layer of security when users reset their passwords.

This ensures that even if someone gains access to a password reset link, they still cannot change the password without completing 2FA.

Prerequisites
Before enabling 2FA for password reset, ensure:

• The 2FA module is installed and activated.
• Navigate to: /admin/config/people/miniorange_2fa/login_settings

Enable the following settings:

• Activate Two-Factor Authentication
• Enforce 2FA to End Users

Enable 2FA for Password Reset

Follow these steps to configure the feature:

1. Navigate to 2FA Policy for End Users tab
2. Go to: /admin/config/people/miniorange_2fa/login_settings
3. Expand the General 2FA Settings section
4. Enable: Enable Two-Factor Authentication for Password Reset
5. Click on Save Settings

User Experience

1. Open a new browser or private window
2. Navigate to the Drupal login page
3. Click on Reset your password

Password Reset Flow:

1. Enter Username / Email address
2. Click on Submit
   • Password reset link will be sent to the registered email
3. Open the email and click on the reset link
4. The system will prompt for 2FA verification
5. Complete the authentication (OTP / Authenticator, etc.)
6. Click on Login
7. Enter: New Password and Confirm Password
   • Click on Save
     Password is successfully reset only after completing 2FA.

How It Works

• Adds a second verification layer to the password reset process
• Prevents unauthorized users from misusing reset links
• Ensures only verified users can change account credentials