[DOC] SQSERVICES-1500 Document 2nd Factor Password Challenge Team Feature

changelog.d/4-docs/pr-2329

@@ -0,0 +1 @@
+Documentation for the 2nd factor password challenge feature

docs/src/how-to/install/index.rst

@@ -17,6 +17,7 @@ Installing wire-server
    (production) How to monitor wire-server <monitoring.rst>
    (production) How to see centralized logs for wire-server <logging.rst>
    (production) Other configuration options <configuration-options.rst>
+   Feature settings <team-feature-settings.md>
    sft
    restund
    configure-federation

docs/src/how-to/install/team-feature-settings.md

@@ -0,0 +1,30 @@
+# Feature settings
+
+Features can be enabled or disabled on a team level or server wide. Here we will only cover the server wide configuration.
+
+When a feature's lock status is `unlocked` it means that its settings can be overridden on a team level by team admins. This can be done via the team management app or via the team feature API and is not covered here.
+
+## 2nd factor password challenge
+
+By default Wire enforces a 2nd factor authentication for certain user operations like e.g. activating an account, changing email or password, or deleting an account.
+
+If the `sndFactorPasswordChallenge` feature is enabled, a 6 digit verification code will be send per email to authenticate for additional user operations like e.g. for login, adding a new client, generating SCIM tokens, or deleting a team.
+
+Usually the default is what you want. If you explicitly want to enable additional password challenges, add the following to your Helm overrides in `values/wire-server/values.yaml`:
+
+```yaml
+galley:
+  # ...
+  config:
+    # ...
+    settings:
+      # ...
+      featureFlags:
+        # ...
+        sndFactorPasswordChallenge:
+          defaults:
+            status: enabled
+            lockStatus: locked
+```
+
+Note that the lock status is required but has no effect, as it is currently not supported for team admins to enable or disable `sndFactorPasswordChallenge`. We recommend to set the lock status to `locked`.