I am pleased to announce Jacaranda2FA 01.00.04, the latest tested release of the Jacaranda2FA two-factor authentication provider for DNN Platform.
This release focuses on improving the user experience of the second-factor login screen while also refining the handling of trusted browsers.
Jacaranda2FA 01.00.04 has now been tested successfully on a production DNN site running over HTTPS.
One of the main changes in 01.00.04 is a clearer verification screen.
For users who have an authenticator app configured, the authenticator is now presented as the primary method of verification.
The login screen displays:
directly together as the normal login path.
Less commonly used methods are now grouped beneath:
Other Login Options
This section contains:
The aim is simple: keep the normal authenticator login clear and uncluttered while still making alternative methods readily available when needed.
If email verification becomes active, or a recovery-code attempt needs to be retried, the Other Login Options section automatically opens so the user is not left searching for the active verification method.
Jacaranda2FA also supports trusted browsers.
When a user selects:
Remember this browser for 2FA
and successfully completes two-factor authentication, Jacaranda2FA can remember that browser for the configured period.
On a later login from the same trusted browser:
A trusted browser therefore does not bypass the user's DNN password. It only remembers that the browser has previously completed the second-factor requirement.
Trusted-browser records can also be viewed and revoked through the Jacaranda2FA Account Security module.
There is one important security requirement administrators need to understand.
Remember this browser for 2FA works only when the DNN website is running over HTTPS.
This is intentional.
Jacaranda2FA will not create a trusted-browser token on an ordinary HTTP connection.
If a site is running over HTTP, the user can still:
but Jacaranda2FA will refuse to remember the browser.
The DNN Event Viewer will record the trusted-browser attempt as blocked because the request was not secure.
This behaviour is by design and is not an error.
A remembered-browser token is a security credential.
Although the token is stored securely and the server stores only a hash of it, the browser cookie itself should only ever travel over an encrypted HTTPS connection.
Jacaranda2FA therefore requires HTTPS before issuing the trusted-browser cookie.
Trusted-browser cookies use security protections including:
Allowing these tokens to be created over unencrypted HTTP would weaken the security model, so Jacaranda2FA deliberately refuses to do so.
This is particularly important when testing Jacaranda2FA on a local DNN installation.
A development site running on something such as:
http://localhost
or an HTTP-only IIS binding can test almost all Jacaranda2FA functionality, but it cannot fully test the trusted-browser feature.
To test Remember this browser for 2FA, the test site needs to be available through HTTPS.
This can be done using:
There are no plans to weaken this protection simply to make local HTTP testing easier.
Jacaranda2FA 01.00.04 currently supports:
Standard TOTP authenticator applications are supported.
Testing has included:
The authenticator secret is enrolled through the Jacaranda2FA Account Security module.
A six-digit one-time verification code can be sent to the email address associated with the user's DNN account.
This uses DNN's existing SMTP configuration.
Users can generate one-time recovery codes for situations where their normal authenticator or email method is unavailable.
Each recovery code can be used only once.
Administrators can choose who must use Jacaranda2FA.
Two-factor authentication can be applied to:
This allows administrators to choose an appropriate level of enforcement for their particular DNN site.
Jacaranda2FA includes a separate Account Security module that can be placed on a protected DNN page.
Users can use it to:
Sensitive security changes require recent password confirmation.
The UX changes in 01.00.04 do not change Jacaranda2FA's underlying authentication model.
DNN still validates the username and password.
Only after the password has been accepted does Jacaranda2FA perform the required second-factor verification.
The normal sequence remains:
DNN password validation → Jacaranda2FA second factor → DNN completes authentication
The release retains the security protections developed during earlier versions, including:
There are no database-schema changes in 01.00.04 and no new SQL migration.
Jacaranda2FA has been tested with:
Version 01.00.04 has also been successfully tested on a production HTTPS DNN website, including the trusted-browser functionality.
Jacaranda2FA can enforce 2FA only for authentication attempts that pass through the Jacaranda2FA provider.
If DNN Normal Login or another independent authentication provider remains enabled, that provider may offer another route into the website without invoking Jacaranda2FA.
Administrators who want mandatory 2FA should therefore review all enabled authentication providers.
Jacaranda2FA has been successfully tested operating as the sole enabled DNN login provider.
Jacaranda2FA remains a community-focused project and feedback from other DNN administrators and developers is welcome.
Different DNN installations use different themes, hosting environments, SMTP systems, authentication configurations and security policies, so wider testing continues to be valuable.
If you are testing Jacaranda2FA, I particularly welcome feedback about:
Normal bugs and compatibility problems can be reported through the project.
Potential security vulnerabilities should be reported privately to:
webmaster@forrestitse...>
Please do not include passwords, authenticator secrets, recovery codes, trusted-browser tokens, machine keys or other sensitive credentials in reports.
The latest release represents another step toward making two-factor authentication both practical and understandable for DNN administrators and users.
The most visible changes are a cleaner login experience and better organisation of alternate verification methods, while the underlying security model remains deliberately conservative.
And one rule is worth repeating:
If you want to use “Remember this browser for 2FA”, your DNN site must be running over HTTPS.
That restriction is intentional and is there to protect the trusted-browser credential.
Jacaranda2FA 01.00.04 is now the current tested release.
Trevor W Forrester Forrest IT Services
These Forums are for the discussion of the open source CMS DNN platform and ecosystem.
For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:
Awesome! Simply post in the forums using the link below and we'll get you started.