Add LoginTC multi-factor authentication

[jackbuehner]

This PR ads support for LoginTC MFA.

Thank you to the LoginTC team for making this possible. Check them out at https://www.logintc.com/.

Changes

• RAWeb now sends the appropriate requests for Duo MFA.
• The sign in page for the web app can now redirect to the LoginTC MFA page.
• The policy editor now has a policy for configuring LoginTC MFA.
• The list of MFA providers on the wiki has been updated.
• A new LoginTC MFA wiki page with configuration instructions and notes.

Authentication flow

When a user signs in to RAWeb with the LoginTC MFA policy enabled, the following flow occurs:

1. The user enters their username and password in RAWeb's sign-in form.
2. RAWeb verifies that the username and password are correct.
3. RAWeb updates its cache of the user's details (if the user cache is enabled).
4. RAWeb checks if a LoginTC MFA policy is configured for the user's domain. If no policy is found or the user's account is excluded, the user is signed in without further prompts.
5. RAWeb instructs the web client to load the LoginTC authentication prompt.
6. The user completes the LoginTC authentication challenge.
7. LoginTC redirects to RAWeb.
8. If RAWeb receives a successful authentication response from LoginTC, the user is signed in to RAWeb. If the response indicates a failure or is missing, the sign-in attempt is rejected.

Policy editor

Checklist

• Domain-joined device
• Other device
• Username exclusion

Resolves #223

[github-actions]

✅ Deployment successful

Preview URL: https://raweb.app/deploy-preview/pr-231/
Wiki/Docs: https://raweb.app/deploy-preview/pr-231/docs/

Local install
Run as an administrator in PowerShell to install this branch:

iwr -UseBasicParsing install.raweb.app/preview/jackbuehner/logintc | iex

View logs