OneDB v2.10.0

Release Date: June 2026
Release Type: Feature Release
Branch: 2.10.0

New Features

Policy-Based Multi-Factor Authentication

OneDB v2.10.0 introduces built-in Multi-Factor Authentication (MFA) using local TOTP authenticator apps. MFA can be used with Google Authenticator, Microsoft Authenticator, Authy, 1Password, and other compatible authenticator applications.

Administrators can configure MFA protection through Site Configuration using the following policies:

  • Disabled
  • Optional
  • Required for Administrators
  • Required for All Users

When MFA is required, applicable users complete enrollment after password authentication. Users scan a QR code with their authenticator app, or use the displayed manual setup key, then verify their first authentication code before MFA is enabled.

Recovery Codes

MFA enrollment now generates one-time recovery codes for account recovery. Recovery codes are displayed only during enrollment and are stored as hashed values. Each code can be used once to complete MFA verification when access to the authenticator app is unavailable.

MFA Administration and Visibility

User Management now shows MFA status, including enrolled and enrollment-required states. Administrators can reset MFA for a user when necessary without resetting that user’s password.

OneDB also records MFA-related audit events for enrollment, successful and failed verification attempts, recovery-code use, MFA policy changes, and administrator MFA resets.

Enhancements

  • Added encrypted storage for TOTP secrets.
  • Added QR-code enrollment and manual setup key fallback.
  • Added MFA verification and recovery-code sign-in flows for enrolled users.
  • Updated MFA enrollment, verification, recovery, and recovery-code pages to follow the existing OneDB authentication interface.
  • Added policy-aware behavior so MFA can be disabled globally without removing a user’s existing MFA enrollment data.

Bug Fixes

  • Fixed MFA database compatibility for existing installations by migrating encrypted TOTP secret and recovery-code storage fields to PostgreSQL TEXT columns.
  • Fixed audit trail constraint handling so MFA audit actions are accepted while preserving legacy audit actions.
  • Fixed recovery-code page behavior to maintain one-time recovery-code visibility and align the page with the OneDB authentication experience.

Security Updates

  • TOTP secrets are encrypted before storage.
  • Recovery codes are stored as hashes and cannot be viewed again after enrollment.
  • MFA enrollment, recovery, policy changes, and administrative resets are recorded in the audit trail.
  • MFA administrator reset clears the user’s MFA enrollment without exposing secrets, recovery codes, OTP values, or provisioning information.

Notes

  • MFA uses local TOTP verification and does not require internet connectivity.
  • “Required for Administrators” applies to all users assigned to the OneDB Admin group.
  • Existing users are not automatically enrolled when MFA is enabled. Applicable users are guided through enrollment based on the selected MFA policy.