Add remember me for MFA

combined/cmd/config.go

@@ -138,6 +138,7 @@ type AuthConfig struct {
 	SignKeyRefreshEnabled           bool              `yaml:"signKeyRefreshEnabled"`
 	MfaSessionMaxLifetime           string            `yaml:"mfaSessionMaxLifetime"`
 	MfaSessionIdleTimeout           string            `yaml:"mfaSessionIdleTimeout"`
+	MfaSessionRememberMe            bool              `yaml:"mfaSessionRememberMe"`
 	Storage                         AuthStorageConfig `yaml:"storage"`
 	DashboardRedirectURIs           []string          `yaml:"dashboardRedirectURIs"`
 	CLIRedirectURIs                 []string          `yaml:"cliRedirectURIs"`
@@ -590,6 +591,7 @@ func (c *CombinedConfig) buildEmbeddedIdPConfig(mgmt ManagementConfig) (*idp.Emb
 		SignKeyRefreshEnabled: mgmt.Auth.SignKeyRefreshEnabled,
 		MfaSessionMaxLifetime: mgmt.Auth.MfaSessionMaxLifetime,
 		MfaSessionIdleTimeout: mgmt.Auth.MfaSessionIdleTimeout,
+		MfaSessionRememberMe:  mgmt.Auth.MfaSessionRememberMe,
 		Storage: idp.EmbeddedStorageConfig{
 			Type: authStorageType,
 			Config: idp.EmbeddedStorageTypeConfig{

combined/config.yaml.example

@@ -89,6 +89,7 @@ server:
     # MFA session settings (applies when TOTP is enabled for an account)
     # mfaSessionMaxLifetime: "24h"  # Max duration for an MFA session from creation
     # mfaSessionIdleTimeout: "1h"   # MFA session expires after this idle period
+    # mfaSessionRememberMe: false   # Pre-check "remember me" on login so the MFA session persists across tabs/restarts
     # OAuth2 redirect URIs for dashboard
     dashboardRedirectURIs:
       - "https://app.example.com/nb-auth"