Two-Factor Authentication Requirement for Packagers
This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee.
Summary
Require all users in the packager group, developers, and associated groups within those group hierarchies, will require Two-Factor Authentication (2FA) enabled via Noggin/FreeIPA to access Fedora services and systems.
Owner
- Name: Steve Milner
- Email: smilner@redhat.com
Current status
- Targeted release: N/A. This is not tied to a release.
- Last updated: 2026-04-14
- [<link to devel-announce post will be added by Wrangler> Announced]
- [<will be assigned by the Wrangler> Discussion thread]
- FESCo issue: <will be assigned by the Wrangler>
- Tracker bug: <will be assigned by the Wrangler>
- Release notes tracker: <will be assigned by the Wrangler>
Detailed Description
To harden the Fedora Project's software supply chain, we will enforce a new 2FA requirement at the identity provider level for Fedora packagers and accounts with Forge commit access. This change will involve:
- FreeIPA Configuration: Updating the Host Based Access Control or group policies within FreeIPA to require a second factor for authentication.
- Noggin Integration: Ensuring the Fedora Account UI correctly handles the enrollment workflow for users who have not yet configured a token.
- Enforcement: Upon the next login attempt after the implementation is deployed, packagers and developers without 2FA will be redirected to an enrollment screen to register a hardware token or a software token application.
Feedback
Benefit to Fedora
- Supply Chain Security: Reduces the risk of account takeovers where malicious actors could inject code into the Fedora build systems or source repositories.
- Modern Standards: Aligns Fedora with industry best practices and other development communities that already require 2FA for maintainers and developers.
Scope
- Proposal owners:
- Configure IPA policies to require 2FA for the packager and forge group(s).
- Coordinate with Infrastructure to ensure Noggin handles the enrollment redirect gracefully.
- Other developers: None.
- Release engineering: No impact on the release process itself, but RelEng members will need to ensure their own accounts are compliant.
- Trademark approval: N/A (not needed for this Change)
- Alignment with the Fedora Strategy: ?
Upgrade/compatibility impact
This change is not tied to a specific Fedora release as it is a change in Fedora’s services. Packagers and developers without 2FA will encounter the requirement the next time they authenticate to a Fedora service (Forge, Koji, Bodhi, Pagure, etc.) after the enforcement date.
Early Testing (Optional)
Do you require 'QA Blueprint': N
How To Test
- New Users: Create a new account, join the packager group, and verify that access to fedpkg or Koji is denied until 2FA is configured in Noggin.
- Existing Users (No 2FA):
- Log in with an account that lacks 2FA; verify the system prompts/forces enrollment if the user is in the packager or developer group.
- Log in with an account that lacks 2FA; verify the system does not prompt/force enrollment if the user is NOT in a packager or developer group.
- Existing Users (With 2FA): Verify that login remains seamless for those who already have tokens configured.
User Experience
Packagers and developers without 2FA will see a one-time setup screen during their next login. The process will support both hardware and software tokens.
Dependencies
- No other Fedora Changes rely on this.
- Internal dependency on Fedora Development to create the IPA/Noggin changes.
- Internal dependency on Fedora Infrastructure to apply the IPA/Noggin changes.
Contingency Plan
- Contingency mechanism: Revert the IPA policy change and noggin patch to allow single-factor (password-only) authentication.
- Contingency deadline: Can be reverted at any time if critical infrastructure access is blocked.
- Blocks release? No.
Documentation
The Fedora Infrastructure documentation and the "Joining the Packager Group" wiki pages will be updated to reflect that 2FA is a prerequisite for maintaining packages. Development documentation would be updated similarly.
Release Notes
Fedora now requires all package maintainers and developers to enable Two-Factor Authentication (2FA) for their accounts. This move increases the security of the Fedora supply chain by protecting against unauthorized access to the build system, package repositories, and source control. Current packagers and developers will be prompted to set up a hardware or software token upon their next login.
