Adding Mandatory 2FA for a Sensitive Admin Portal

This project was an internal admin portal that centralizes important company documents. Because access was high impact, account security and user accountability were critical requirements.

The Challenge

Users were sharing credentials, so identity attribution was weak. Even when actions were recorded, it was hard to be certain which individual actually accessed sensitive files.

The Solution

We enforced mandatory two-factor authentication for all users using TOTP. The login flow became: employee ID + password, followed by a one-time authenticator code before access is granted.

var totp = new Totp(secretBytes);
var isValid = totp.VerifyTotp(inputCode, out long timeStepMatched);

if (!isValid)
{
    return Unauthorized("Invalid authentication code.");
}

Recovery and Usability

To reduce lockout risk, we added recovery secret codes so users can still regain access when they lose their authenticator setup.

Implementation Notes

The implementation was built in .NET using OTP.NET for TOTP generation and validation. 2FA is mandatory for every account, not optional per role.

Results

After rollout, access tracking became more reliable at the individual level. The team gained clearer confidence on who actually accessed each document.

Next Improvements

Future hardening can include stricter retry controls, cooldown policies, and additional audit signals around failed 2FA attempts.