kanidm/server/core/templates/credentials_update_primary.html

<div hx-target="#credentialUpdateDynamicSection">
    <hr class="my-4" />
    <h4>Alternative Authentication Methods</h4>

    <p>
        (% match primary_state %)
            (% when CUCredState::Modifiable %)
                If possible, passkeys should be used instead, as they are phishing and exploit resistant.
            (% when CUCredState::DeleteOnly %)
                If possible, passkeys should be used instead, as they are phishing and exploit resistant.
                <br>Account policy prevents you modifying these credentials, but you may remove them.
            (% when CUCredState::AccessDeny %)
                You do not have access to modify these credentials.
            (% when CUCredState::PolicyDeny %)
                Account policy prevents you from setting these credentials
        (% endmatch %)
    </p>

    (% if matches!(primary_state, CUCredState::Modifiable) %)
        (% match primary %)
            (% when Some(CredentialDetail { uuid, type_: kanidm_proto::internal::CredentialDetailType::Password }) %)
                <h6><b>Password</b></h6>
                <p>
                    <button type="button" class="btn btn-primary" hx-post="/ui/reset/change_password">
                        Change Password
                    </button>
                </p>
                <h6><b>Time-based One Time Password (TOTP)</b></h6>
                <p>TOTPs are 6 digit codes generated on-demand as a second authentication factor.</p>
                <p>
                    <button type="button" class="btn btn-primary" hx-post="/ui/reset/add_totp">
                        Add TOTP
                    </button>
                </p>
                <br/>
                <p>
                    <button type="button" class="btn btn-danger" hx-post="/ui/api/delete_alt_creds" hx-confirm="Delete your Password and any associated MFA?\nNote: this will not remove Passkeys.">
                        Delete Alternative Credentials
                    </button>
                </p>
            (% when Some(CredentialDetail { uuid, type_: kanidm_proto::internal::CredentialDetailType::PasswordMfa(totp_set, _security_key_labels, _backup_codes_remaining)}) %)
                <h6><b>Password</b></h6>
                <p>
                    <button type="button" class="btn btn-primary" hx-post="/ui/reset/change_password">
                        Change Password
                    </button>
                </p>
                <h6><b>Time-based One Time Password (TOTP)</b></h6>
                <p>TOTPs are 6 digit codes generated on-demand as a second authentication factor.</p>
                (% for totp in totp_set %)
                    <button type="button" class="btn btn-warning mb-2" hx-post="/ui/api/remove_totp" hx-vals='{"name": "(( totp ))"}'>
                        Remove totp (( totp ))
                    </button>
                (% endfor %)

                <p>
                    <button type="button" class="btn btn-primary" hx-post="/ui/reset/add_totp">
                        Add TOTP
                    </button>
                </p>
                <br/>
                <p>
                    <button type="button" class="btn btn-danger" hx-post="/ui/api/delete_alt_creds" hx-confirm="Delete your Password and any associated MFA?
                    Note: this will not remove Passkeys.">
                        Delete Alternative Credentials
                    </button>
                </p>
            (% when Some(CredentialDetail { uuid, type_: kanidm_proto::internal::CredentialDetailType::GeneratedPassword }) %)
                <h6><b>Password</b></h6>
                <p>In order to set up alternative authentication methods, you must delete the generated password.</p>
                <button type="button" class="btn btn-danger" hx-post="/ui/api/delete_alt_creds" >
                    Delete Generated Password
                </button>
            (% when Some(CredentialDetail { uuid, type_: kanidm_proto::internal::CredentialDetailType::Passkey(_) }) %)
                <p>Webauthn Only - Will migrate to passkeys in a future update</p>
                <button type="button" class="btn btn-danger" hx-post="/ui/api/delete_alt_creds" hx-confirm="Delete your Password and any associated MFA?
                Note: this will not remove Passkeys.">
                    Delete Alternative Credentials
                </button>
            (% when None %)
                <button type="button" class="btn btn-warning" hx-post="/ui/reset/add_password">
                    Add Password
                </button>
        (% endmatch %)
    (% else if matches!(primary_state, CUCredState::DeleteOnly) %)
        <p>
            <button type="button" class="btn btn-warning" hx-post="/ui/api/delete_alt_creds" hx-confirm="Delete your Password and any associated MFA?
            Note: this will not remove Passkeys.">
                Delete Legacy Credentials
            </button>
        </p>
    (% endif %)
</div>