Init 2 factor authentication for user model

app/models/user.rb

@@ -57,6 +57,9 @@ require 'carrierwave/orm/activerecord'
 require 'file_size_validator'
 
 class User < ActiveRecord::Base
+  devise :two_factor_authenticatable,
+         :otp_secret_encryption_key => File.read(Rails.root.join('.secret')).chomp
+
   include Sortable
   include Gitlab::ConfigHelper
   include TokenAuthenticatable
@@ -70,7 +73,7 @@ class User < ActiveRecord::Base
   default_value_for :hide_no_password, false
   default_value_for :theme_id, gitlab_config.default_theme
 
-  devise :database_authenticatable, :lockable, :async,
+  devise :lockable, :async,
          :recoverable, :rememberable, :trackable, :validatable, :omniauthable, :confirmable, :registerable
 
   attr_accessor :force_random_password

app/views/devise/sessions/_new_base.html.haml

 = form_for(resource, as: resource_name, url: session_path(resource_name)) do |f|
   = f.text_field :login, class: "form-control top", placeholder: "Username or Email", autofocus: "autofocus"
-  = f.password_field :password, class: "form-control bottom", placeholder: "Password"
+  = f.password_field :password, class: "form-control middle", placeholder: "Password"
+  = f.text_field :otp_attempt, class: 'form-control bottom', placeholder: 'Two-factor authentication token'
   - if devise_mapping.rememberable?
     .remember-me.checkbox
       %label{for: "user_remember_me"}

config/initializers/devise.rb

 # Use this hook to configure devise mailer, warden hooks and so forth. The first
 # four configuration values can also be set straight in your models.
 Devise.setup do |config|
+  config.warden do |manager|
+    manager.default_strategies(:scope => :user).unshift :two_factor_authenticatable
+  end
+
   # ==> Mailer Configuration
   # Configure the class responsible to send e-mails.
   config.mailer = "DeviseMailer"

db/migrate/20150327223628_add_devise_two_factor_to_users.rb

+class AddDeviseTwoFactorToUsers < ActiveRecord::Migration
+  def change
+    add_column :users, :encrypted_otp_secret, :string
+    add_column :users, :encrypted_otp_secret_iv, :string
+    add_column :users, :encrypted_otp_secret_salt, :string
+    add_column :users, :otp_required_for_login, :boolean
+  end
+end