Add docs for 2FA

Author: jrauh01

doc/05-Authentication.md

@@ -8,7 +8,7 @@ or if users are spread over multiple places.
 
 ## Configuration <a id="authentication-configuration"></a>
 
-Navigate into **Configuration > Application > Authentication **.
+Navigate into **Configuration > Application > Access Control Backends**.
 
 Authentication methods are configured in the `/etc/icingaweb2/authentication.ini` file.
 
@@ -291,3 +291,48 @@ asks that backend to authenticate the user with the sAMAccountName "jdoe".
 When the user "jdoe@icinga.com" logs in, Icinga Web 2 walks through all configured authentication backends until it
 finds one which is responsible for that user -- e.g. a MariaDB or MySQL backend (SQL database backends aren't domain-aware). Then
 Icinga Web 2 asks that backend to authenticate the user with the username "jdoe@icinga.com".
+
+## Two-Factor Authentication <a id="two-factor-authentication"></a>
+
+You can secure your user accounts by two-factor authentication (2FA) using time-based one-time passwords (TOTP). If you
+set up an authenticator app it will generate a 6 digit one-time token every 30 seconds based on the shared secret and
+the current time.
+
+### Enabling 2FA <a id="two-factor-authentication-enabling"></a>
+
+Enable 2FA in your account settings. Scan the QR code with your authenticator app or enter the secret manually. Make
+sure to store the QR code or secret on a different device on which the authenticator app is installed. If you lose
+access to the authenticator you can set up a new one without an administrator disabling the old one via the CLI. Then
+enter the token from your authenticator app to verify that it has the correct secret.
+
+If you log in now with username and password, you will be prompted to "enter your 2FA token". This is the token
+generated by the authenticator app. If the token is valid, you will be logged in and redirected.
+
+### Disabling 2FA <a id="two-factor-authentication-disabling"></a>
+
+Disable 2FA by simply clicking the "Disable 2FA" button in your account settings. This will remove the stored secret
+completely.
+
+### Replacing 2FA <a id="two-factor-authentication"></a>
+
+If you need to replace your 2FA, e.g. because your secret has been compromised, simply disable it and reenable it in
+your account settings. You will need to verify the new secret. Don't forget to store the QR code or the secret for
+recovery.
+
+### CLI Commands <a id="two-factor-authentication-cli"></a>
+
+The following CLI commands are available:
+
+```bash
+icingacli twofactor list
+```
+
+List all users with 2FA enabled and when they enabled it.
+
+```bash
+icingacli twofactor disable [<user>]
+```
+
+Disable 2FA for a specific user. Do this if a user has lost access to the device on which the authenticator app is
+installed and hasn't saved the secret to a different device. Make sure to disable it for the correct user, as the
+currently stored secret will be removed completely.