We are thinking about enabling 2FA with Google Authenficator for all our services.
But the only concern for me now is that users will have to have a dedicated Authenticator's account for every service, let's say:
Maybe there is a better approach?
Something like using a self-hosted TOTP service? Although this, I guess, will require SSO to be enabled between all accounts as well, but SSO is out of the scope of current tasks.
Although there are lots of open standards for authentication, and separating the authentication service from the application service, there are surprisingly few application providers willing to let you use your authentication service. i.e. its simply not possible to to impose your MFA solution on external providers.
That doesn't mean that you can't enforce MFA access on these services though. You just need to provide some proxy capability which can inject credentials into a session and put the MFA login on that proxy service; the users of the service never get to see the token (password, ssh key, certificate, passphrase...). This is catered for by most privileged access management solutions. I work with CyberArk which is very good at this - but also very expensive. There are other options available, but the cost of implementing any of them is likely to be orders of magnitude greater than rolling out your own google auth service.
