Add two-factor authentication

[MikeAlhayek]

Fix #13703

[MikeAlhayek]

@jtkech you may me interested in reviewing this one. If you have time, a review is much appreciated. Hopefully @sebastienros can do a review during triage tomorrow.

[hishamco]

I did a quick review, suggesting few changes, I will revise the PR again

Great work Mike!!

[hishamco]

BTW can we make the Token length a textbox instead of forcing user to select 6 or 8 digits?

[hishamco]

@MikeAlhayek could you please provide a screenshot for asking for the token and possibly how to recover the missing token? Also it would be nice if you can demo it in the OC steering meeting

[MikeAlhayek]

It was demonstrated yesterday during the meeting :).

[MikeAlhayek]

BTW can we make the Token length a textbox instead of forcing user to select 6 or 8 digits?

No. The specification of the Authenticator apps only support 6 or 8.

[hishamco]

I expect something like that :) unfortunately, I didn't attend last few meetings

[sebastienros]

Looking at aspnetcore I don't think the user id/name is ever logged.
Example: https://github.com/dotnet/aspnetcore/blob/8aa4a527c5d0393c6d8cfc4b7f05224aae93d3f4/src/Identity/UI/src/Areas/Identity/Pages/V5/Account/Logout.cshtml.cs

[MikeAlhayek]

I think I was looking at a code that was generated using the code generator. Either way, it be good news is that we don't log that private info also.