I’m pleased to make Jacaranda2FA 1.00.00 available to the DNN community for public testing.

Jacaranda2FA is a two-factor authentication provider developed specifically for DNN Platform. The aim has been to add practical 2FA while leaving DNN responsible for its existing username/password validation and final authenticated login.

Version 1.00.00 has been tested successfully on DNN Platform 10.3.2 and 10.3.3, including a clean DNN installation using the default skin and a production-style Development Site with a Bootstrap 5 theme.

Features

Jacaranda2FA currently supports:

• TOTP authenticator apps
  • Microsoft Authenticator
  • Google Authenticator
  • other compatible TOTP applications should also work
• Email one-time verification codes
• One-time recovery codes
• Trusted/remembered browsers
• Role-based 2FA enforcement
  • all users
  • Administrators and SuperUsers
  • selected DNN roles
• Account Security module allowing users to:
  • enrol an authenticator
  • replace or remove an authenticator
  • generate new recovery codes
  • view and revoke trusted browsers
• Persistent second-factor throttling
• TOTP replay protection
• configurable OTP expiry, retry and resend limits
• configurable trusted-browser lifetime and limits
• security audit logging
• responsive login and verification screens

How authentication works

Jacaranda2FA does not replace DNN’s password system.

The basic process is:

DNN validates username/password → Jacaranda2FA verifies the second factor → DNN completes the login.

Jacaranda2FA does not directly create or manipulate DNN’s normal authentication cookie.

Security work

Before reaching 1.00.00, the extension went through a dedicated security-hardening pass. This included:

• persistent throttling across repeated 2FA challenges
• stricter challenge expiry
• recent password confirmation before sensitive Account Security changes
• protected TOTP enrolment secrets
• one-time recovery-code handling
• transactional recovery-code replacement
• HTTPS-only trusted-browser issuance
• Secure trusted-browser cookies
• protection against TOTP replay
• no-store handling when displaying authenticator secrets and new recovery codes

Important note about DNN authentication providers

Jacaranda2FA can enforce 2FA only for authentication paths that actually pass through Jacaranda2FA.

If DNN Normal Login or another independent authentication provider remains enabled, that provider may offer another route into the site without Jacaranda2FA.

During testing I have successfully run Jacaranda2FA as the sole enabled authentication provider, including successful login by both registered users and SuperUsers.

Administrators should nevertheless keep an existing SuperUser session open when first changing authentication-provider settings and make sure recovery codes or another usable second factor are available.

Public testing

This is the first public test release, so I would encourage anyone interested in trying it to begin on a development or staging DNN installation rather than immediately deploying it to a production site.

Testing and feedback across different DNN environments, themes, SMTP configurations, browsers and hosting setups would be very welcome.

Jacaranda2FA 1.00.00 has so far been tested with:

• DNN 10.3.2
• DNN 10.3.3
• default DNN skin
• Bootstrap 5 custom skin
• Microsoft Authenticator
• Google Authenticator
• email OTP
• recovery codes
• trusted browsers
• registered users
• SuperUsers
• Jacaranda2FA operating without DNN Normal Login enabled

If you find a normal bug or compatibility problem, please report it through the project.

If you discover something that may represent an exploitable security vulnerability, please report it privately rather than publishing the details immediately.

Jacaranda2FA 1.00.00 is released under the MIT Licence.

I hope this can become a useful contribution to the DNN community, and I’d particularly appreciate feedback from other DNN administrators and developers who are willing to give the first public release a thorough workout.