2FA is just something you know and something you have. I have a Yubikey with a RSA authorisation key (+enc and signing keys too, but that's irrelevant) in it that I've hooked ssh-agent and GPG to. It is the only key accepted by my servers. Obviously, disable password login. The key has a password, which is the something I know.
But that doesn't help if I want that 2FA key to access their mail, Gitlab instance, AWS servers, etc. What do I do when someone leaves and I want to be able to revoke it and take over their repositories and accounts?
If I'm a 1000 person company, I've got resources to spend on my corporate 2FA infrastructure.
What do I do when it's 10 people? 20 people? 50 people?
When the company I was working for was small, we had ssh 2fa via duo security, and used g suite, with mandatory 2fa, and got as much as possible set to do SSO via g suite. G suite isn't great, but there are/were a lot of hooks to login with it, so that was nice; and these days, it has a sane way to force 2fa (when I did it, setting the org to mandatory 2fa meant your new users couldn't login, because they hadn't set up 2fa because they couldn't login; thanks google).
We self-hosted git though (using gitolite for access control), running servers was a core competency for the team, so having a little baby server on the side that just dealt with text files for 50-100 people wasn't a big deal. It was running on a mac mini at the CEOs house until he forgot to pay his cable bill once and we couldn't push code for a day.
SSO probably involving SAML tied to a central “source of auth truth” like LDAP or G Suite or an AD/office365. when someone leaves you kill them in 1 place and access is removed everywhere. bonus points if you tie in a higher layer 3rd party auth API offering like onelogin/centrify/etc that your internal apps can use.
edit to add costs: a small company can do this for 3-5 bucks/user/month. that kind of cost is doable for a small shop, and worth it.
> you kill them in 1 place and access is removed everywhere
But how do I now take over their repositories and email, for example?
> edit to add costs: a small company can do this for 3-5 bucks/user/month. that kind of cost is doable for a small shop, and worth it.
Do you have a concrete reference? I really don't want to use a Google-based system. Microsoft could be an answer even if I reflexively cringe at that--they at least seem to be able to deal with businesses properly.
I'm really not averse to paying money for this, but it needs to be seamless enough that we can use it from the CEO to the receptionist.
