Add Two Factor authentication with SMS and Email providers

[tatarincev]

Use this article to add 2FA into storefront.
https://docs.microsoft.com/en-us/aspnet/core/security/authentication/2fa?view=aspnetcore-1.1

User cabinet

User stories

• As User I want to enable/disable Two Factor authentication in my cabinet
• As User I want to add / change my phone number only after confirming the code received via SMS

Technical details:

• Extend the current user cabinet "Profile" section in the default theme with two new fields
• Phone number (add, change, remove) and Two Factor Authentication (on/off)
  
  
• Need to add the new storefront API for these requriements:
  POST storefrontapi/account/phonenumber - for add/change phone number (only after verification)
  POST storefrontapi/account/phonenumber/verify - for verify phone number
  DELETE storefrontapi/account/phonenumber - for delete phone number
  POST storefrontapi/account/twofactorauthentification - for on/off 2FA

Login form

User stories:

• As User I want to login in the store only after confirming the code received via SMS if Two factor authentication is enabled in my cabinet.

Technical details:

• Need to extend the AccountController with new methods and logic
  Extend GET Login method with new logic
  See code example:
  https://github.com/aspnet/Docs/blob/master/aspnetcore/security/authentication/2fa/sample/Web2FA/Controllers/AccountController.cs#L75
  Extend POST Login method with new logic to send verification code if 2FA is enabled for user. See code example https://github.com/aspnet/Docs/blob/master/aspnetcore/security/authentication/2fa/sample/Web2FA/Controllers/AccountController.cs#L366
  Add ** POST VerifyCode** method to code verification see example https://github.com/aspnet/Docs/blob/master/aspnetcore/security/authentication/2fa/sample/Web2FA/Controllers/AccountController.cs#L419

SMS providers and configuration

Need to add the two SMS providers (twilo and ASPSMS) as well as in this example but with one exception, I would like to have personal options and configuration for each providers and choose appropriate by checking configuration section.
https://github.com/aspnet/Docs/tree/master/aspnetcore/security/authentication/2fa/sample/Web2FA/Services

[artem-dudarev]

I think sending 2FA codes by SMS or email is a secondary task.
The more important thing is to allow user to generate codes by his own TOTP device or application (e.g. Google Authenticator)
https://docs.microsoft.com/en-us/aspnet/core/security/authentication/identity-enable-qrcodes?view=aspnetcore-2.2

[tatarincev]

Released https://github.com/VirtoCommerce/vc-storefront-core/releases/tag/v4.0.0.0