Redmine

Currently, the otpauth uri generated by redmine includes the user's email address. But it should be an account name, not an email address.

(1) TOTP gem's document says that the parameter for TOTP#provisioning_uri is "name of the account".

(2) Some TOTP authenticator app displays it as the account name for the service. But you cannot sign in to Redmine with the displayed "account" because what you should enter to the login form is not an email address but a login id.

The issue can be fixed with the following patch.

diff --git a/lib/redmine/twofa/totp.rb b/lib/redmine/twofa/totp.rb
index e304208a2..603661350 100644
--- a/lib/redmine/twofa/totp.rb
+++ b/lib/redmine/twofa/totp.rb
@@ -50,7 +50,7 @@ module Redmine
       end

       def provisioning_uri
-        totp.provisioning_uri(@user.mail)
+        totp.provisioning_uri(@user.login)
       end

       def init_pairing_view_variables