diff --git a/src/app/Http/Controllers/API/V4/Admin/UsersController.php b/src/app/Http/Controllers/API/V4/Admin/UsersController.php
index f96c0a6d..7175ae1f 100644
--- a/src/app/Http/Controllers/API/V4/Admin/UsersController.php
+++ b/src/app/Http/Controllers/API/V4/Admin/UsersController.php
@@ -1,168 +1,199 @@
 <?php
 
 namespace App\Http\Controllers\API\V4\Admin;
 
 use App\Domain;
+use App\Sku;
 use App\User;
 use App\UserAlias;
 use App\UserSetting;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Validator;
 
 class UsersController extends \App\Http\Controllers\API\V4\UsersController
 {
     /**
      * Searching of user accounts.
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function index()
     {
         $search = trim(request()->input('search'));
         $owner = trim(request()->input('owner'));
         $result = collect([]);
 
         if ($owner) {
             if ($owner = User::find($owner)) {
                 $result = $owner->users(false)->orderBy('email')->get();
             }
         } elseif (strpos($search, '@')) {
             // Search by email
             $user = User::where('email', $search)->first();
             if ($user) {
                 $result->push($user);
             } else {
                 // Search by an alias
                 $user_ids = UserAlias::where('alias', $search)->get()->pluck('user_id');
                 if ($user_ids->isEmpty()) {
                     // Search by an external email
                     $user_ids = UserSetting::where('key', 'external_email')
                         ->where('value', $search)->get()->pluck('user_id');
                 }
 
                 if (!$user_ids->isEmpty()) {
                     $result = User::whereIn('id', $user_ids)->orderBy('email')->get();
                 }
             }
         } elseif (is_numeric($search)) {
             // Search by user ID
             if ($user = User::find($search)) {
                 $result->push($user);
             }
         } elseif (!empty($search)) {
             // Search by domain
             if ($domain = Domain::where('namespace', $search)->first()) {
                 if ($wallet = $domain->wallet()) {
                     $result->push($wallet->owner);
                 }
             }
         }
 
         // Process the result
         $result = $result->map(function ($user) {
             $data = $user->toArray();
             $data = array_merge($data, self::userStatuses($user));
             return $data;
         });
 
         $result = [
             'list' => $result,
             'count' => count($result),
             'message' => \trans('app.search-foundxusers', ['x' => count($result)]),
         ];
 
         return response()->json($result);
     }
 
+    /**
+     * Reset 2-Factor Authentication for the user
+     *
+     * @param \Illuminate\Http\Request $request The API request.
+     * @params string                  $id      User identifier
+     *
+     * @return \Illuminate\Http\JsonResponse The response
+     */
+    public function reset2FA(Request $request, $id)
+    {
+        $user = User::find($id);
+
+        if (empty($user)) {
+            return $this->errorResponse(404);
+        }
+
+        $sku = Sku::where('title', '2fa')->first();
+
+        // Note: we do select first, so the observer can delete
+        //       2FA preferences from Roundcube database, so don't
+        //       be tempted to replace first() with delete() below
+        $entitlement = $user->entitlements()->where('sku_id', $sku->id)->first();
+        $entitlement->delete();
+
+        return response()->json([
+                'status' => 'success',
+                'message' => __('app.user-reset-2fa-success'),
+        ]);
+    }
+
     /**
      * Suspend the user
      *
      * @param \Illuminate\Http\Request $request The API request.
      * @params string                  $id      User identifier
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function suspend(Request $request, $id)
     {
         $user = User::find($id);
 
         if (empty($user)) {
             return $this->errorResponse(404);
         }
 
         $user->suspend();
 
         return response()->json([
                 'status' => 'success',
                 'message' => __('app.user-suspend-success'),
         ]);
     }
 
     /**
      * Un-Suspend the user
      *
      * @param \Illuminate\Http\Request $request The API request.
      * @params string                  $id      User identifier
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function unsuspend(Request $request, $id)
     {
         $user = User::find($id);
 
         if (empty($user)) {
             return $this->errorResponse(404);
         }
 
         $user->unsuspend();
 
         return response()->json([
                 'status' => 'success',
                 'message' => __('app.user-unsuspend-success'),
         ]);
     }
 
     /**
      * Update user data.
      *
      * @param \Illuminate\Http\Request $request The API request.
      * @params string                  $id      User identifier
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function update(Request $request, $id)
     {
         $user = User::find($id);
 
         if (empty($user)) {
             return $this->errorResponse(404);
         }
 
         // For now admins can change only user external email address
 
         $rules = [];
 
         if (array_key_exists('external_email', $request->input())) {
             $rules['external_email'] = 'email';
         }
 
         // Validate input
         $v = Validator::make($request->all(), $rules);
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
         }
 
         // Update user settings
         $settings = $request->only(array_keys($rules));
 
         if (!empty($settings)) {
             $user->setSettings($settings);
         }
 
         return response()->json([
                 'status' => 'success',
                 'message' => __('app.user-update-success'),
         ]);
     }
 }
diff --git a/src/resources/lang/en/app.php b/src/resources/lang/en/app.php
index 71dfa809..d1c0ab90 100644
--- a/src/resources/lang/en/app.php
+++ b/src/resources/lang/en/app.php
@@ -1,53 +1,54 @@
 <?php
 
 return [
 
     /*
     |--------------------------------------------------------------------------
     | Application Language Lines
     |--------------------------------------------------------------------------
     |
     | The following language lines are used in the application.
     */
 
     'mandate-delete-success' => 'The auto-payment has been removed.',
     'mandate-update-success' => 'The auto-payment has been updated.',
 
     'planbutton' => 'Choose :plan',
 
     'process-user-new' => 'Registering a user...',
     'process-user-ldap-ready' => 'Creating a user...',
     'process-user-imap-ready' => 'Creating a mailbox...',
     'process-domain-new' => 'Registering a custom domain...',
     'process-domain-ldap-ready' => 'Creating a custom domain...',
     'process-domain-verified' => 'Verifying a custom domain...',
     'process-domain-confirmed' => 'Verifying an ownership of a custom domain...',
     'process-success' => 'Setup process finished successfully.',
     'process-error-user-ldap-ready' => 'Failed to create a user.',
     'process-error-user-imap-ready' => 'Failed to verify that a mailbox exists.',
     'process-error-domain-ldap-ready' => 'Failed to create a domain.',
     'process-error-domain-verified' => 'Failed to verify a domain.',
     'process-error-domain-confirmed' => 'Failed to verify an ownership of a domain.',
 
     'domain-verify-success' => 'Domain verified successfully.',
     'domain-verify-error' => 'Domain ownership verification failed.',
 
     'user-update-success' => 'User data updated successfully.',
     'user-create-success' => 'User created successfully.',
     'user-delete-success' => 'User deleted successfully.',
     'user-suspend-success' => 'User suspended successfully.',
     'user-unsuspend-success' => 'User unsuspended successfully.',
+    'user-reset-2fa-success' => '2-Factor authentication reset successfully.',
 
     'search-foundxdomains' => ':x domains have been found.',
     'search-foundxusers' => ':x user accounts have been found.',
 
     'wallet-award-success' => 'The bonus has been added to the wallet successfully.',
     'wallet-penalty-success' => 'The penalty has been added to the wallet successfully.',
     'wallet-update-success' => 'User wallet updated successfully.',
 
     'wallet-notice-date' => 'With your current subscriptions your account balance will last until about :date (:days).',
     'wallet-notice-nocredit' => 'You are out of credit, top up your balance now.',
     'wallet-notice-today' => 'You will run out of credit today, top up your balance now.',
     'wallet-notice-trial' => 'You are in your free trial period.',
     'wallet-notice-trial-end' => 'Your free trial is about to end, top up to continue.',
 ];
diff --git a/src/resources/vue/Admin/User.vue b/src/resources/vue/Admin/User.vue
index e2678d28..27431022 100644
--- a/src/resources/vue/Admin/User.vue
+++ b/src/resources/vue/Admin/User.vue
@@ -1,597 +1,643 @@
 <template>
     <div class="container">
         <div class="card" id="user-info">
             <div class="card-body">
                 <h1 class="card-title">{{ user.email }}</h1>
                 <div class="card-text">
                     <form class="read-only short">
                         <div v-if="user.wallet.user_id != user.id" class="form-group row plaintext">
                             <label for="manager" class="col-sm-4 col-form-label">Managed by</label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" id="manager">
                                     <router-link :to="{ path: '/user/' + user.wallet.user_id }">{{ user.wallet.user_email }}</router-link>
                                 </span>
                             </div>
                         </div>
                         <div class="form-group row plaintext">
                             <label for="userid" class="col-sm-4 col-form-label">ID <span class="text-muted">(Created at)</span></label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" id="userid">
                                     {{ user.id }} <span class="text-muted">({{ user.created_at }})</span>
                                 </span>
                             </div>
                         </div>
                         <div class="form-group row plaintext">
                             <label for="status" class="col-sm-4 col-form-label">Status</label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" id="status">
                                     <span :class="$root.userStatusClass(user)">{{ $root.userStatusText(user) }}</span>
                                 </span>
                             </div>
                         </div>
                         <div class="form-group row plaintext" v-if="user.first_name">
                             <label for="first_name" class="col-sm-4 col-form-label">First name</label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" id="first_name">{{ user.first_name }}</span>
                             </div>
                         </div>
                         <div class="form-group row plaintext" v-if="user.last_name">
                             <label for="last_name" class="col-sm-4 col-form-label">Last name</label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" id="last_name">{{ user.last_name }}</span>
                             </div>
                         </div>
                         <div class="form-group row plaintext" v-if="user.organization">
                             <label for="organization" class="col-sm-4 col-form-label">Organization</label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" id="organization">{{ user.organization }}</span>
                             </div>
                         </div>
                         <div class="form-group row plaintext" v-if="user.phone">
                             <label for="phone" class="col-sm-4 col-form-label">Phone</label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" id="phone">{{ user.phone }}</span>
                             </div>
                         </div>
                         <div class="form-group row plaintext">
                             <label for="external_email" class="col-sm-4 col-form-label">External email</label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" id="external_email">
                                     <a v-if="user.external_email" :href="'mailto:' + user.external_email">{{ user.external_email }}</a>
                                     <button type="button" class="btn btn-secondary btn-sm" @click="emailEdit">Edit</button>
                                 </span>
                             </div>
                         </div>
                         <div class="form-group row plaintext" v-if="user.billing_address">
                             <label for="billing_address" class="col-sm-4 col-form-label">Address</label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" style="white-space:pre" id="billing_address">{{ user.billing_address }}</span>
                             </div>
                         </div>
                         <div class="form-group row plaintext">
                             <label for="country" class="col-sm-4 col-form-label">Country</label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" id="country">{{ user.country }}</span>
                             </div>
                         </div>
                     </form>
                     <div class="mt-2">
                         <button v-if="!user.isSuspended" id="button-suspend" class="btn btn-warning" type="button" @click="suspendUser">Suspend</button>
                         <button v-if="user.isSuspended" id="button-unsuspend" class="btn btn-warning" type="button" @click="unsuspendUser">Unsuspend</button>
                     </div>
                 </div>
             </div>
         </div>
         <ul class="nav nav-tabs mt-3" role="tablist">
             <li class="nav-item">
                 <a class="nav-link active" id="tab-finances" href="#user-finances" role="tab" aria-controls="user-finances" aria-selected="true">
                     Finances
                 </a>
             </li>
             <li class="nav-item">
                 <a class="nav-link" id="tab-aliases" href="#user-aliases" role="tab" aria-controls="user-aliases" aria-selected="false">
                     Aliases ({{ user.aliases.length }})
                 </a>
             </li>
             <li class="nav-item">
                 <a class="nav-link" id="tab-subscriptions" href="#user-subscriptions" role="tab" aria-controls="user-subscriptions" aria-selected="false">
                     Subscriptions ({{ skus.length }})
                 </a>
             </li>
             <li class="nav-item">
                 <a class="nav-link" id="tab-domains" href="#user-domains" role="tab" aria-controls="user-domains" aria-selected="false">
                     Domains ({{ domains.length }})
                 </a>
             </li>
             <li class="nav-item">
                 <a class="nav-link" id="tab-users" href="#user-users" role="tab" aria-controls="user-users" aria-selected="false">
                     Users ({{ users.length }})
                 </a>
             </li>
         </ul>
         <div class="tab-content">
             <div class="tab-pane show active" id="user-finances" role="tabpanel" aria-labelledby="tab-finances">
                 <div class="card-body">
                     <h2 class="card-title">Account balance <span :class="wallet.balance < 0 ? 'text-danger' : 'text-success'"><strong>{{ $root.price(wallet.balance) }}</strong></span></h2>
                     <div class="card-text">
                         <form class="read-only short">
                             <div class="form-group row">
                                 <label class="col-sm-4 col-form-label">Discount</label>
                                 <div class="col-sm-8">
                                     <span class="form-control-plaintext" id="discount">
                                         <span>{{ wallet.discount ? (wallet.discount + '% - ' + wallet.discount_description) : 'none' }}</span>
                                         <button type="button" class="btn btn-secondary btn-sm" @click="discountEdit">Edit</button>
                                     </span>
                                 </div>
                             </div>
                             <div class="form-group row" v-if="wallet.mandate && wallet.mandate.id">
                                 <label class="col-sm-4 col-form-label">Auto-payment</label>
                                 <div class="col-sm-8">
                                     <span class="form-control-plaintext" id="autopayment">
                                         Fill up by <b>{{ wallet.mandate.amount }} CHF</b>
                                         when under <b>{{ wallet.mandate.balance }} CHF</b>
                                         using {{ wallet.mandate.method }}<span v-if="wallet.mandate.isDisabled"> (disabled)</span>.
                                     </span>
                                 </div>
                             </div>
                             <div class="form-group row" v-if="wallet.providerLink">
                                 <label class="col-sm-4 col-form-label">{{ capitalize(wallet.provider) }} ID</label>
                                 <div class="col-sm-8">
                                     <span class="form-control-plaintext" v-html="wallet.providerLink"></span>
                                 </div>
                             </div>
                         </form>
                         <div class="mt-2">
                             <button id="button-award" class="btn btn-success" type="button" @click="awardDialog">Add bonus</button>
                             <button id="button-penalty" class="btn btn-danger" type="button" @click="penalizeDialog">Add penalty</button>
                         </div>
                     </div>
                     <h2 class="card-title mt-4">Transactions</h2>
                     <transaction-log v-if="wallet.id && !walletReload" class="card-text" :wallet-id="wallet.id" :is-admin="true"></transaction-log>
                 </div>
             </div>
             <div class="tab-pane" id="user-aliases" role="tabpanel" aria-labelledby="tab-aliases">
                 <div class="card-body">
                     <div class="card-text">
                         <table class="table table-sm table-hover">
                             <thead class="thead-light">
                                 <tr>
                                     <th scope="col">Email address</th>
                                 </tr>
                             </thead>
                             <tbody>
                                 <tr v-for="(alias, index) in user.aliases" :id="'alias' + index" :key="index">
                                     <td>{{ alias }}</td>
                                 </tr>
                             </tbody>
                             <tfoot class="table-fake-body">
                                 <tr>
                                     <td>This user has no email aliases.</td>
                                 </tr>
                             </tfoot>
                         </table>
                     </div>
                 </div>
             </div>
             <div class="tab-pane" id="user-subscriptions" role="tabpanel" aria-labelledby="tab-subscriptions">
                 <div class="card-body">
                     <div class="card-text">
-                        <table class="table table-sm table-hover">
+                        <table class="table table-sm table-hover mb-0">
                             <thead class="thead-light">
                                 <tr>
                                     <th scope="col">Subscription</th>
                                     <th scope="col">Price</th>
                                 </tr>
                             </thead>
                             <tbody>
-                                <tr v-for="(sku, sku_id) in skus" :id="'sku' + sku_id" :key="sku_id">
+                                <tr v-for="(sku, sku_id) in skus" :id="'sku' + sku.id" :key="sku_id">
                                     <td>{{ sku.name }}</td>
                                     <td>{{ sku.price }}</td>
                                 </tr>
                             </tbody>
                             <tfoot class="table-fake-body">
                                 <tr>
                                     <td colspan="2">This user has no subscriptions.</td>
                                 </tr>
                             </tfoot>
                         </table>
                         <small v-if="discount > 0" class="hint">
                             <hr class="m-0">
                             &sup1; applied discount: {{ discount }}% - {{ discount_description }}
                         </small>
+                        <div class="mt-2">
+                            <button type="button" class="btn btn-danger" id="reset2fa" v-if="has2FA" @click="reset2FADialog">Reset 2-Factor Auth</button>
+                        </div>
                     </div>
                 </div>
             </div>
             <div class="tab-pane" id="user-domains" role="tabpanel" aria-labelledby="tab-domains">
                 <div class="card-body">
                     <div class="card-text">
                         <table class="table table-sm table-hover">
                             <thead class="thead-light">
                                 <tr>
                                     <th scope="col">Name</th>
                                 </tr>
                             </thead>
                             <tbody>
                                 <tr v-for="domain in domains" :id="'domain' + domain.id" :key="domain.id" @click="$root.clickRecord">
                                     <td>
                                         <svg-icon icon="globe" :class="$root.domainStatusClass(domain)" :title="$root.domainStatusText(domain)"></svg-icon>
                                         <router-link :to="{ path: '/domain/' + domain.id }">{{ domain.namespace }}</router-link>
                                     </td>
                                 </tr>
                             </tbody>
                             <tfoot class="table-fake-body">
                                 <tr>
                                     <td>There are no domains in this account.</td>
                                 </tr>
                             </tfoot>
                         </table>
                     </div>
                 </div>
             </div>
             <div class="tab-pane" id="user-users" role="tabpanel" aria-labelledby="tab-users">
                 <div class="card-body">
                     <div class="card-text">
                         <table class="table table-sm table-hover">
                             <thead class="thead-light">
                                 <tr>
                                     <th scope="col">Primary Email</th>
                                 </tr>
                             </thead>
                             <tbody>
                                 <tr v-for="item in users" :id="'user' + item.id" :key="item.id" @click="$root.clickRecord">
                                     <td>
                                         <svg-icon icon="user" :class="$root.userStatusClass(item)" :title="$root.userStatusText(item)"></svg-icon>
                                         <router-link :to="{ path: '/user/' + item.id }">{{ item.email }}</router-link>
                                     </td>
                                 </tr>
                             </tbody>
                             <tfoot class="table-fake-body">
                                 <tr>
                                     <td>There are no users in this account.</td>
                                 </tr>
                             </tfoot>
                         </table>
                     </div>
                 </div>
             </div>
         </div>
 
         <div id="discount-dialog" class="modal" tabindex="-1" role="dialog">
             <div class="modal-dialog" role="document">
                 <div class="modal-content">
                     <div class="modal-header">
                         <h5 class="modal-title">Account discount</h5>
                         <button type="button" class="close" data-dismiss="modal" aria-label="Close">
                             <span aria-hidden="true">&times;</span>
                         </button>
                     </div>
                     <div class="modal-body">
                         <p class="form-group">
                             <select v-model="wallet.discount_id" class="custom-select">
                                 <option value="">- none -</option>
                                 <option v-for="item in discounts" :value="item.id" :key="item.id">{{ item.label }}</option>
                             </select>
                         </p>
                     </div>
                     <div class="modal-footer">
                         <button type="button" class="btn btn-secondary modal-cancel" data-dismiss="modal">Cancel</button>
                         <button type="button" class="btn btn-primary modal-action" @click="submitDiscount()">
                             <svg-icon icon="check"></svg-icon> Submit
                         </button>
                     </div>
                 </div>
             </div>
         </div>
 
         <div id="email-dialog" class="modal" tabindex="-1" role="dialog">
             <div class="modal-dialog" role="document">
                 <div class="modal-content">
                     <div class="modal-header">
                         <h5 class="modal-title">External email</h5>
                         <button type="button" class="close" data-dismiss="modal" aria-label="Close">
                             <span aria-hidden="true">&times;</span>
                         </button>
                     </div>
                     <div class="modal-body">
                         <p class="form-group">
                             <input v-model="external_email" name="external_email" class="form-control">
                         </p>
                     </div>
                     <div class="modal-footer">
                         <button type="button" class="btn btn-secondary modal-cancel" data-dismiss="modal">Cancel</button>
                         <button type="button" class="btn btn-primary modal-action" @click="submitEmail()">
                             <svg-icon icon="check"></svg-icon> Submit
                         </button>
                     </div>
                 </div>
             </div>
         </div>
 
         <div id="oneoff-dialog" class="modal" tabindex="-1" role="dialog">
             <div class="modal-dialog" role="document">
                 <div class="modal-content">
                     <div class="modal-header">
                         <h5 class="modal-title">{{ oneoff_negative ? 'Add a penalty to the wallet' : 'Add a bonus to the wallet' }}</h5>
                         <button type="button" class="close" data-dismiss="modal" aria-label="Close">
                             <span aria-hidden="true">&times;</span>
                         </button>
                     </div>
                     <div class="modal-body">
                         <form data-validation-prefix="oneoff_">
                             <div class="form-group">
                                 <label for="oneoff_amount" class="col-form-label">Amount</label>
                                 <div class="input-group">
                                     <input type="text" class="form-control" id="oneoff_amount" v-model="oneoff_amount" required>
                                     <span class="input-group-append">
                                         <span class="input-group-text">{{ oneoff_currency }}</span>
                                     </span>
                                 </div>
                             </div>
                             <div class="form-group">
                                 <label for="oneoff_description" class="col-form-label">Description</label>
                                 <input class="form-control" id="oneoff_description" v-model="oneoff_description" required>
                             </div>
                         </form>
                     </div>
                     <div class="modal-footer">
                         <button type="button" class="btn btn-secondary modal-cancel" data-dismiss="modal">Cancel</button>
                         <button type="button" class="btn btn-primary modal-action" @click="submitOneOff()">
                             <svg-icon icon="check"></svg-icon> Submit
                         </button>
                     </div>
                 </div>
             </div>
         </div>
+
+        <div id="reset-2fa-dialog" class="modal" tabindex="-1" role="dialog">
+            <div class="modal-dialog" role="document">
+                <div class="modal-content">
+                    <div class="modal-header">
+                        <h5 class="modal-title">2-Factor Authentication Reset</h5>
+                        <button type="button" class="close" data-dismiss="modal" aria-label="Close">
+                            <span aria-hidden="true">&times;</span>
+                        </button>
+                    </div>
+                    <div class="modal-body">
+                        <p>This will remove 2-Factor Authentication entitlement as well
+                            as the user-configured factors.</p>
+                        <p>Please, make sure to confirm the user identity properly.</p>
+                    </div>
+                    <div class="modal-footer">
+                        <button type="button" class="btn btn-secondary modal-cancel" data-dismiss="modal">Cancel</button>
+                        <button type="button" class="btn btn-danger modal-action" @click="reset2FA()">Reset</button>
+                    </div>
+                </div>
+            </div>
+        </div>
     </div>
 </template>
 
 <script>
     import TransactionLog from '../Widgets/TransactionLog'
 
     export default {
         beforeRouteUpdate (to, from, next) {
             // An event called when the route that renders this component has changed,
             // but this component is reused in the new route.
             // Required to handle links from /user/XXX to /user/YYY
             next()
             this.$parent.routerReload()
         },
         components: {
             TransactionLog
         },
         data() {
             return {
                 oneoff_amount: '',
                 oneoff_currency: 'CHF',
                 oneoff_description: '',
                 oneoff_negative: false,
                 discount: 0,
                 discount_description: '',
                 discounts: [],
                 external_email: '',
+                has2FA: false,
                 wallet: {},
                 walletReload: false,
                 domains: [],
                 skus: [],
+                sku2FA: null,
                 users: [],
                 user: {
                     aliases: [],
                     wallet: {},
                     skus: {},
                 }
             }
         },
         created() {
             const user_id = this.$route.params.user
 
             this.$root.startLoading()
 
             axios.get('/api/v4/users/' + user_id)
                 .then(response => {
                     this.$root.stopLoading()
 
                     this.user = response.data
 
                     const financesTab = '#user-finances'
                     const keys = ['first_name', 'last_name', 'external_email', 'billing_address', 'phone', 'organization']
                     const country = this.user.settings.country
 
                     if (country) {
                         this.user.country = window.config.countries[country][1]
                     }
 
                     keys.forEach(key => { this.user[key] = this.user.settings[key] })
 
                     this.discount = this.user.wallet.discount
                     this.discount_description = this.user.wallet.discount_description
 
                     // TODO: currencies, multi-wallets, accounts
                     // Get more info about the wallet (e.g. payment provider related)
                     this.$root.addLoader(financesTab)
                     axios.get('/api/v4/wallets/' + this.user.wallets[0].id)
                         .then(response => {
                             this.$root.removeLoader(financesTab)
                             this.wallet = response.data
                         })
                         .catch(error => {
                             this.$root.removeLoader(financesTab)
                         })
 
                     // Create subscriptions list
                     axios.get('/api/v4/skus')
                         .then(response => {
                             // "merge" SKUs with user entitlement-SKUs
                             response.data.forEach(sku => {
                                 if (sku.id in this.user.skus) {
                                     let count = this.user.skus[sku.id].count
                                     let item = {
                                         id: sku.id,
                                         name: sku.name,
                                         cost: sku.cost,
                                         units: count - sku.units_free,
                                         price: this.$root.priceLabel(sku.cost, count - sku.units_free, this.discount)
                                     }
 
                                     if (sku.range) {
                                         item.name += ' ' + count + ' ' + sku.range.unit
                                     }
 
                                     this.skus.push(item)
+
+                                    if (sku.title == '2fa') {
+                                        this.has2FA = true
+                                        this.sku2FA = sku.id
+                                    }
                                 }
                             })
                         })
 
                     // Fetch users
                     // TODO: Multiple wallets
                     axios.get('/api/v4/users?owner=' + user_id)
                         .then(response => {
                             this.users = response.data.list.filter(user => {
                                 return user.id != user_id;
                             })
                         })
 
                     // Fetch domains
                     axios.get('/api/v4/domains?owner=' + user_id)
                         .then(response => {
                             this.domains = response.data.list
                         })
                 })
                 .catch(this.$root.errorHandler)
         },
         mounted() {
             $(this.$el).find('ul.nav-tabs a').on('click', e => {
                 e.preventDefault()
                 $(e.target).tab('show')
             })
         },
         methods: {
             capitalize(str) {
                 return str.charAt(0).toUpperCase() + str.slice(1)
             },
             awardDialog() {
                 this.oneOffDialog(false)
             },
             discountEdit() {
                 $('#discount-dialog')
                     .on('shown.bs.modal', e => {
                         $(e.target).find('select').focus()
                         // Note: Vue v-model is strict, convert null to a string
                         this.wallet.discount_id = this.wallet_discount_id || ''
                     })
                     .modal()
 
                 if (!this.discounts.length) {
                     // Fetch discounts
                     axios.get('/api/v4/discounts')
                         .then(response => {
                             this.discounts = response.data.list
                         })
                 }
             },
             emailEdit() {
                 this.external_email = this.user.external_email
                 this.$root.clearFormValidation($('#email-dialog'))
 
                 $('#email-dialog')
                     .on('shown.bs.modal', e => {
                         $(e.target).find('input').focus()
                     })
                     .modal()
             },
             oneOffDialog(negative) {
                 this.oneoff_negative = negative
                 this.dialog = $('#oneoff-dialog').on('shown.bs.modal', event => {
                     this.$root.clearFormValidation(event.target)
                     $(event.target).find('#oneoff_amount').focus()
                 }).modal()
             },
             penalizeDialog() {
                 this.oneOffDialog(true)
             },
             reload() {
                 // this is to reload transaction log
                 this.walletReload = true
                 this.$nextTick(() => { this.walletReload = false })
             },
+            reset2FA() {
+                $('#reset-2fa-dialog').modal('hide')
+                axios.post('/api/v4/users/' + this.user.id + '/reset2FA')
+                    .then(response => {
+                        if (response.data.status == 'success') {
+                            this.$toast.success(response.data.message)
+                            this.skus = this.skus.filter(sku => sku.id != this.sku2FA)
+                            this.has2FA = false
+                        }
+                    })
+            },
+            reset2FADialog() {
+                $('#reset-2fa-dialog').modal()
+            },
             submitDiscount() {
                 $('#discount-dialog').modal('hide')
 
                 axios.put('/api/v4/wallets/' + this.user.wallets[0].id, { discount: this.wallet.discount_id })
                     .then(response => {
                         if (response.data.status == 'success') {
                             this.$toast.success(response.data.message)
                             this.wallet = Object.assign({}, this.wallet, response.data)
 
                             // Update prices in Subscriptions tab
                             if (this.user.wallet.id == response.data.id) {
                                 this.discount = this.wallet.discount
                                 this.discount_description = this.wallet.discount_description
 
                                 this.skus.forEach(sku => {
                                     sku.price = this.$root.priceLabel(sku.cost, sku.units, this.discount)
                                 })
                             }
                         }
                     })
             },
             submitEmail() {
                 axios.put('/api/v4/users/' + this.user.id, { external_email: this.external_email })
                     .then(response => {
                         if (response.data.status == 'success') {
                             $('#email-dialog').modal('hide')
                             this.$toast.success(response.data.message)
                             this.user.external_email = this.external_email
                             this.external_email = null // required because of Vue
                         }
                     })
             },
             submitOneOff() {
                 let wallet_id = this.user.wallets[0].id
                 let post = {
                     amount: this.oneoff_amount,
                     description: this.oneoff_description
                 }
 
                 if (this.oneoff_negative && /^\d+(\.?\d+)?$/.test(post.amount)) {
                     post.amount *= -1
                 }
 
                 // TODO: We maybe should use system currency not wallet currency,
                 //       or have a selector so the operator does not have to calculate
                 //       exchange rates
 
                 this.$root.clearFormValidation(this.dialog)
 
                 axios.post('/api/v4/wallets/' + wallet_id + '/one-off', post)
                     .then(response => {
                         if (response.data.status == 'success') {
                             this.dialog.modal('hide')
                             this.$toast.success(response.data.message)
                             this.wallet = Object.assign({}, this.wallet, {balance: response.data.balance})
                             this.oneoff_amount = ''
                             this.oneoff_description = ''
                             this.reload()
                         }
                     })
             },
             suspendUser() {
                 axios.post('/api/v4/users/' + this.user.id + '/suspend', {})
                     .then(response => {
                         if (response.data.status == 'success') {
                             this.$toast.success(response.data.message)
                             this.user = Object.assign({}, this.user, { isSuspended: true })
                         }
                     })
             },
             unsuspendUser() {
                 axios.post('/api/v4/users/' + this.user.id + '/unsuspend', {})
                     .then(response => {
                         if (response.data.status == 'success') {
                             this.$toast.success(response.data.message)
                             this.user = Object.assign({}, this.user, { isSuspended: false })
                         }
                     })
             }
         }
     }
 </script>
diff --git a/src/routes/api.php b/src/routes/api.php
index d53906d2..239f0357 100644
--- a/src/routes/api.php
+++ b/src/routes/api.php
@@ -1,113 +1,114 @@
 <?php
 
 use Illuminate\Http\Request;
 
 /*
 |--------------------------------------------------------------------------
 | API Routes
 |--------------------------------------------------------------------------
 |
 | Here is where you can register API routes for your application. These
 | routes are loaded by the RouteServiceProvider within a group which
 | is assigned the "api" middleware group. Enjoy building your API!
 |
 */
 
 Route::group(
     [
         'middleware' => 'api',
         'prefix' => 'auth'
     ],
     function ($router) {
         Route::post('login', 'API\AuthController@login');
 
         Route::group(
             ['middleware' => 'auth:api'],
             function ($router) {
                 Route::get('info', 'API\AuthController@info');
                 Route::post('logout', 'API\AuthController@logout');
                 Route::post('refresh', 'API\AuthController@refresh');
             }
         );
     }
 );
 
 Route::group(
     [
         'domain' => \config('app.domain'),
         'middleware' => 'api',
         'prefix' => 'auth'
     ],
     function ($router) {
         Route::post('password-reset/init', 'API\PasswordResetController@init');
         Route::post('password-reset/verify', 'API\PasswordResetController@verify');
         Route::post('password-reset', 'API\PasswordResetController@reset');
 
         Route::get('signup/plans', 'API\SignupController@plans');
         Route::post('signup/init', 'API\SignupController@init');
         Route::post('signup/verify', 'API\SignupController@verify');
         Route::post('signup', 'API\SignupController@signup');
     }
 );
 
 Route::group(
     [
         'domain' => \config('app.domain'),
         'middleware' => 'auth:api',
         'prefix' => 'v4'
     ],
     function () {
         Route::apiResource('domains', API\V4\DomainsController::class);
         Route::get('domains/{id}/confirm', 'API\V4\DomainsController@confirm');
         Route::get('domains/{id}/status', 'API\V4\DomainsController@status');
 
         Route::apiResource('entitlements', API\V4\EntitlementsController::class);
         Route::apiResource('packages', API\V4\PackagesController::class);
         Route::apiResource('skus', API\V4\SkusController::class);
         Route::apiResource('users', API\V4\UsersController::class);
         Route::get('users/{id}/status', 'API\V4\UsersController@status');
 
         Route::apiResource('wallets', API\V4\WalletsController::class);
         Route::get('wallets/{id}/transactions', 'API\V4\WalletsController@transactions');
         Route::get('wallets/{id}/receipts', 'API\V4\WalletsController@receipts');
         Route::get('wallets/{id}/receipts/{receipt}', 'API\V4\WalletsController@receiptDownload');
 
         Route::post('payments', 'API\V4\PaymentsController@store');
         Route::get('payments/mandate', 'API\V4\PaymentsController@mandate');
         Route::post('payments/mandate', 'API\V4\PaymentsController@mandateCreate');
         Route::put('payments/mandate', 'API\V4\PaymentsController@mandateUpdate');
         Route::delete('payments/mandate', 'API\V4\PaymentsController@mandateDelete');
     }
 );
 
 Route::group(
     [
         'domain' => \config('app.domain'),
     ],
     function () {
         Route::post('webhooks/payment/{provider}', 'API\V4\PaymentsController@webhook');
     }
 );
 
 Route::group(
     [
         'domain' => 'admin.' . \config('app.domain'),
         'middleware' => ['auth:api', 'admin'],
         'prefix' => 'v4',
     ],
     function () {
         Route::apiResource('domains', API\V4\Admin\DomainsController::class);
         Route::get('domains/{id}/confirm', 'API\V4\Admin\DomainsController@confirm');
 
         Route::apiResource('entitlements', API\V4\Admin\EntitlementsController::class);
         Route::apiResource('packages', API\V4\Admin\PackagesController::class);
         Route::apiResource('skus', API\V4\Admin\SkusController::class);
         Route::apiResource('users', API\V4\Admin\UsersController::class);
+        Route::post('users/{id}/reset2FA', 'API\V4\Admin\UsersController@reset2FA');
         Route::post('users/{id}/suspend', 'API\V4\Admin\UsersController@suspend');
         Route::post('users/{id}/unsuspend', 'API\V4\Admin\UsersController@unsuspend');
         Route::apiResource('wallets', API\V4\Admin\WalletsController::class);
         Route::post('wallets/{id}/one-off', 'API\V4\Admin\WalletsController@oneOff');
         Route::get('wallets/{id}/transactions', 'API\V4\Admin\WalletsController@transactions');
         Route::apiResource('discounts', API\V4\Admin\DiscountsController::class);
     }
 );
diff --git a/src/tests/Browser/Admin/UserTest.php b/src/tests/Browser/Admin/UserTest.php
index dd56b46e..7237aef0 100644
--- a/src/tests/Browser/Admin/UserTest.php
+++ b/src/tests/Browser/Admin/UserTest.php
@@ -1,401 +1,437 @@
 <?php
 
 namespace Tests\Browser\Admin;
 
+use App\Auth\SecondFactor;
 use App\Discount;
+use App\Sku;
 use App\User;
 use Tests\Browser;
 use Tests\Browser\Components\Dialog;
 use Tests\Browser\Components\Toast;
 use Tests\Browser\Pages\Admin\User as UserPage;
 use Tests\Browser\Pages\Dashboard;
 use Tests\Browser\Pages\Home;
 use Tests\TestCaseDusk;
 use Illuminate\Foundation\Testing\DatabaseMigrations;
 
 class UserTest extends TestCaseDusk
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
         self::useAdminUrl();
 
         $john = $this->getTestUser('john@kolab.org');
         $john->setSettings([
                 'phone' => '+48123123123',
                 'external_email' => 'john.doe.external@gmail.com',
         ]);
         if ($john->isSuspended()) {
             User::where('email', $john->email)->update(['status' => $john->status - User::STATUS_SUSPENDED]);
         }
         $wallet = $john->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->save();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $john->setSettings([
                 'phone' => null,
                 'external_email' => 'john.doe.external@gmail.com',
         ]);
         if ($john->isSuspended()) {
             User::where('email', $john->email)->update(['status' => $john->status - User::STATUS_SUSPENDED]);
         }
         $wallet = $john->wallets()->first();
         $wallet->discount()->dissociate();
         $wallet->save();
 
         parent::tearDown();
     }
 
     /**
      * Test user info page (unauthenticated)
      */
     public function testUserUnauth(): void
     {
         // Test that the page requires authentication
         $this->browse(function (Browser $browser) {
             $jack = $this->getTestUser('jack@kolab.org');
             $browser->visit('/user/' . $jack->id)->on(new Home());
         });
     }
 
     /**
      * Test user info page
      */
     public function testUserInfo(): void
     {
         $this->browse(function (Browser $browser) {
             $jack = $this->getTestUser('jack@kolab.org');
             $page = new UserPage($jack->id);
 
             $browser->visit(new Home())
                 ->submitLogon('jeroen@jeroen.jeroen', 'jeroen', true)
                 ->on(new Dashboard())
                 ->visit($page)
                 ->on($page);
 
             // Assert main info box content
             $browser->assertSeeIn('@user-info .card-title', $jack->email)
                 ->with('@user-info form', function (Browser $browser) use ($jack) {
                     $browser->assertElementsCount('.row', 7)
                         ->assertSeeIn('.row:nth-child(1) label', 'Managed by')
                         ->assertSeeIn('.row:nth-child(1) #manager a', 'john@kolab.org')
                         ->assertSeeIn('.row:nth-child(2) label', 'ID (Created at)')
                         ->assertSeeIn('.row:nth-child(2) #userid', "{$jack->id} ({$jack->created_at})")
                         ->assertSeeIn('.row:nth-child(3) label', 'Status')
                         ->assertSeeIn('.row:nth-child(3) #status span.text-success', 'Active')
                         ->assertSeeIn('.row:nth-child(4) label', 'First name')
                         ->assertSeeIn('.row:nth-child(4) #first_name', 'Jack')
                         ->assertSeeIn('.row:nth-child(5) label', 'Last name')
                         ->assertSeeIn('.row:nth-child(5) #last_name', 'Daniels')
                         ->assertSeeIn('.row:nth-child(6) label', 'External email')
                         ->assertMissing('.row:nth-child(6) #external_email a')
                         ->assertSeeIn('.row:nth-child(7) label', 'Country')
                         ->assertSeeIn('.row:nth-child(7) #country', 'United States of America');
                 });
 
             // Some tabs are loaded in background, wait a second
             $browser->pause(500)
                 ->assertElementsCount('@nav a', 5);
 
             // Note: Finances tab is tested in UserFinancesTest.php
             $browser->assertSeeIn('@nav #tab-finances', 'Finances');
 
             // Assert Aliases tab
             $browser->assertSeeIn('@nav #tab-aliases', 'Aliases (1)')
                 ->click('@nav #tab-aliases')
                 ->whenAvailable('@user-aliases', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 1)
                         ->assertSeeIn('table tbody tr:first-child td:first-child', 'jack.daniels@kolab.org')
                         ->assertMissing('table tfoot');
                 });
 
             // Assert Subscriptions tab
             $browser->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (3)')
                 ->click('@nav #tab-subscriptions')
                 ->with('@user-subscriptions', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 3)
                         ->assertSeeIn('table tbody tr:nth-child(1) td:first-child', 'User Mailbox')
                         ->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '4,44 CHF')
                         ->assertSeeIn('table tbody tr:nth-child(2) td:first-child', 'Storage Quota 2 GB')
                         ->assertSeeIn('table tbody tr:nth-child(2) td:last-child', '0,00 CHF')
                         ->assertSeeIn('table tbody tr:nth-child(3) td:first-child', 'Groupware Features')
                         ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '5,55 CHF')
-                        ->assertMissing('table tfoot');
+                        ->assertMissing('table tfoot')
+                        ->assertMissing('#reset2fa');
                 });
 
             // Assert Domains tab
             $browser->assertSeeIn('@nav #tab-domains', 'Domains (0)')
                 ->click('@nav #tab-domains')
                 ->with('@user-domains', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 0)
                         ->assertSeeIn('table tfoot tr td', 'There are no domains in this account.');
                 });
 
             // Assert Users tab
             $browser->assertSeeIn('@nav #tab-users', 'Users (0)')
                 ->click('@nav #tab-users')
                 ->with('@user-users', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 0)
                         ->assertSeeIn('table tfoot tr td', 'There are no users in this account.');
                 });
         });
     }
 
     /**
      * Test user info page (continue)
      *
      * @depends testUserInfo
      */
     public function testUserInfo2(): void
     {
         $this->browse(function (Browser $browser) {
             $john = $this->getTestUser('john@kolab.org');
             $page = new UserPage($john->id);
             $discount = Discount::where('code', 'TEST')->first();
             $wallet = $john->wallet();
             $wallet->discount()->associate($discount);
             $wallet->debit(2010);
             $wallet->save();
 
             // Click the managed-by link on Jack's page
             $browser->click('@user-info #manager a')
                 ->on($page);
 
             // Assert main info box content
             $browser->assertSeeIn('@user-info .card-title', $john->email)
                 ->with('@user-info form', function (Browser $browser) use ($john) {
                     $ext_email = $john->getSetting('external_email');
 
                     $browser->assertElementsCount('.row', 9)
                         ->assertSeeIn('.row:nth-child(1) label', 'ID (Created at)')
                         ->assertSeeIn('.row:nth-child(1) #userid', "{$john->id} ({$john->created_at})")
                         ->assertSeeIn('.row:nth-child(2) label', 'Status')
                         ->assertSeeIn('.row:nth-child(2) #status span.text-success', 'Active')
                         ->assertSeeIn('.row:nth-child(3) label', 'First name')
                         ->assertSeeIn('.row:nth-child(3) #first_name', 'John')
                         ->assertSeeIn('.row:nth-child(4) label', 'Last name')
                         ->assertSeeIn('.row:nth-child(4) #last_name', 'Doe')
                         ->assertSeeIn('.row:nth-child(5) label', 'Organization')
                         ->assertSeeIn('.row:nth-child(5) #organization', 'Kolab Developers')
                         ->assertSeeIn('.row:nth-child(6) label', 'Phone')
                         ->assertSeeIn('.row:nth-child(6) #phone', $john->getSetting('phone'))
                         ->assertSeeIn('.row:nth-child(7) label', 'External email')
                         ->assertSeeIn('.row:nth-child(7) #external_email a', $ext_email)
                         ->assertAttribute('.row:nth-child(7) #external_email a', 'href', "mailto:$ext_email")
                         ->assertSeeIn('.row:nth-child(8) label', 'Address')
                         ->assertSeeIn('.row:nth-child(8) #billing_address', $john->getSetting('billing_address'))
                         ->assertSeeIn('.row:nth-child(9) label', 'Country')
                         ->assertSeeIn('.row:nth-child(9) #country', 'United States of America');
                 });
 
             // Some tabs are loaded in background, wait a second
             $browser->pause(500)
                 ->assertElementsCount('@nav a', 5);
 
             // Note: Finances tab is tested in UserFinancesTest.php
             $browser->assertSeeIn('@nav #tab-finances', 'Finances');
 
             // Assert Aliases tab
             $browser->assertSeeIn('@nav #tab-aliases', 'Aliases (1)')
                 ->click('@nav #tab-aliases')
                 ->whenAvailable('@user-aliases', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 1)
                         ->assertSeeIn('table tbody tr:first-child td:first-child', 'john.doe@kolab.org')
                         ->assertMissing('table tfoot');
                 });
 
             // Assert Subscriptions tab
             $browser->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (3)')
                 ->click('@nav #tab-subscriptions')
                 ->with('@user-subscriptions', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 3)
                         ->assertSeeIn('table tbody tr:nth-child(1) td:first-child', 'User Mailbox')
                         ->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '3,99 CHF/month¹')
                         ->assertSeeIn('table tbody tr:nth-child(2) td:first-child', 'Storage Quota 2 GB')
                         ->assertSeeIn('table tbody tr:nth-child(2) td:last-child', '0,00 CHF/month¹')
                         ->assertSeeIn('table tbody tr:nth-child(3) td:first-child', 'Groupware Features')
                         ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,99 CHF/month¹')
                         ->assertMissing('table tfoot')
                         ->assertSeeIn('table + .hint', '¹ applied discount: 10% - Test voucher');
                 });
 
             // Assert Domains tab
             $browser->assertSeeIn('@nav #tab-domains', 'Domains (1)')
                 ->click('@nav #tab-domains')
                 ->with('@user-domains table', function (Browser $browser) {
                     $browser->assertElementsCount('tbody tr', 1)
                         ->assertSeeIn('tbody tr:nth-child(1) td:first-child a', 'kolab.org')
                         ->assertVisible('tbody tr:nth-child(1) td:first-child svg.text-success')
                         ->assertMissing('tfoot');
                 });
 
             // Assert Users tab
             $browser->assertSeeIn('@nav #tab-users', 'Users (3)')
                 ->click('@nav #tab-users')
                 ->with('@user-users table', function (Browser $browser) {
                     $browser->assertElementsCount('tbody tr', 3)
                         ->assertSeeIn('tbody tr:nth-child(1) td:first-child a', 'jack@kolab.org')
                         ->assertVisible('tbody tr:nth-child(1) td:first-child svg.text-success')
                         ->assertSeeIn('tbody tr:nth-child(2) td:first-child a', 'joe@kolab.org')
                         ->assertVisible('tbody tr:nth-child(2) td:first-child svg.text-success')
                         ->assertSeeIn('tbody tr:nth-child(3) td:first-child a', 'ned@kolab.org')
                         ->assertVisible('tbody tr:nth-child(3) td:first-child svg.text-success')
                         ->assertMissing('tfoot');
                 });
         });
 
         // Now we go to Ned's info page, he's a controller on John's wallet
         $this->browse(function (Browser $browser) {
             $ned = $this->getTestUser('ned@kolab.org');
             $page = new UserPage($ned->id);
 
             $browser->click('@user-users tbody tr:nth-child(3) td:first-child a')
                 ->on($page);
 
             // Assert main info box content
             $browser->assertSeeIn('@user-info .card-title', $ned->email)
                 ->with('@user-info form', function (Browser $browser) use ($ned) {
                     $browser->assertSeeIn('.row:nth-child(2) label', 'ID (Created at)')
                         ->assertSeeIn('.row:nth-child(2) #userid', "{$ned->id} ({$ned->created_at})");
                 });
 
             // Some tabs are loaded in background, wait a second
             $browser->pause(500)
                 ->assertElementsCount('@nav a', 5);
 
             // Note: Finances tab is tested in UserFinancesTest.php
             $browser->assertSeeIn('@nav #tab-finances', 'Finances');
 
             // Assert Aliases tab
             $browser->assertSeeIn('@nav #tab-aliases', 'Aliases (0)')
                 ->click('@nav #tab-aliases')
                 ->whenAvailable('@user-aliases', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 0)
                         ->assertSeeIn('table tfoot tr td', 'This user has no email aliases.');
                 });
 
             // Assert Subscriptions tab, we expect John's discount here
             $browser->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (5)')
                 ->click('@nav #tab-subscriptions')
                 ->with('@user-subscriptions', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 5)
                         ->assertSeeIn('table tbody tr:nth-child(1) td:first-child', 'User Mailbox')
                         ->assertSeeIn('table tbody tr:nth-child(1) td:last-child', '3,99 CHF/month¹')
                         ->assertSeeIn('table tbody tr:nth-child(2) td:first-child', 'Storage Quota 2 GB')
                         ->assertSeeIn('table tbody tr:nth-child(2) td:last-child', '0,00 CHF/month¹')
                         ->assertSeeIn('table tbody tr:nth-child(3) td:first-child', 'Groupware Features')
                         ->assertSeeIn('table tbody tr:nth-child(3) td:last-child', '4,99 CHF/month¹')
                         ->assertSeeIn('table tbody tr:nth-child(4) td:first-child', 'Activesync')
                         ->assertSeeIn('table tbody tr:nth-child(4) td:last-child', '0,90 CHF/month¹')
                         ->assertSeeIn('table tbody tr:nth-child(5) td:first-child', '2-Factor Authentication')
                         ->assertSeeIn('table tbody tr:nth-child(5) td:last-child', '0,00 CHF/month¹')
                         ->assertMissing('table tfoot')
-                        ->assertSeeIn('table + .hint', '¹ applied discount: 10% - Test voucher');
+                        ->assertSeeIn('table + .hint', '¹ applied discount: 10% - Test voucher')
+                        ->assertSeeIn('#reset2fa', 'Reset 2-Factor Auth');
                 });
 
             // We don't expect John's domains here
             $browser->assertSeeIn('@nav #tab-domains', 'Domains (0)')
                 ->click('@nav #tab-domains')
                 ->with('@user-domains', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 0)
                         ->assertSeeIn('table tfoot tr td', 'There are no domains in this account.');
                 });
 
             // We don't expect John's users here
             $browser->assertSeeIn('@nav #tab-users', 'Users (0)')
                 ->click('@nav #tab-users')
                 ->with('@user-users', function (Browser $browser) {
                     $browser->assertElementsCount('table tbody tr', 0)
                         ->assertSeeIn('table tfoot tr td', 'There are no users in this account.');
                 });
         });
     }
 
     /**
      * Test editing an external email
      *
      * @depends testUserInfo2
      */
     public function testExternalEmail(): void
     {
         $this->browse(function (Browser $browser) {
             $john = $this->getTestUser('john@kolab.org');
 
             $browser->visit(new UserPage($john->id))
                 ->waitFor('@user-info #external_email button')
                 ->click('@user-info #external_email button')
                 // Test dialog content, and closing it with Cancel button
                 ->with(new Dialog('#email-dialog'), function (Browser $browser) {
                     $browser->assertSeeIn('@title', 'External email')
                         ->assertFocused('@body input')
                         ->assertValue('@body input', 'john.doe.external@gmail.com')
                         ->assertSeeIn('@button-cancel', 'Cancel')
                         ->assertSeeIn('@button-action', 'Submit')
                         ->click('@button-cancel');
                 })
                 ->assertMissing('#email-dialog')
                 ->click('@user-info #external_email button')
                 // Test email validation error handling, and email update
                 ->with(new Dialog('#email-dialog'), function (Browser $browser) {
                     $browser->type('@body input', 'test')
                         ->click('@button-action')
                         ->waitFor('@body input.is-invalid')
                         ->assertSeeIn(
                             '@body input + .invalid-feedback',
                             'The external email must be a valid email address.'
                         )
                         ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                         ->type('@body input', 'test@test.com')
                         ->click('@button-action');
                 })
                 ->assertToast(Toast::TYPE_SUCCESS, 'User data updated successfully.')
                 ->assertSeeIn('@user-info #external_email a', 'test@test.com')
                 ->click('@user-info #external_email button')
                 ->with(new Dialog('#email-dialog'), function (Browser $browser) {
                     $browser->assertValue('@body input', 'test@test.com')
                         ->assertMissing('@body input.is-invalid')
                         ->assertMissing('@body input + .invalid-feedback')
                         ->click('@button-cancel');
                 })
                 ->assertSeeIn('@user-info #external_email a', 'test@test.com');
 
             // $john->getSetting() may not work here as it uses internal cache
             // read the value form database
             $current_ext_email = $john->settings()->where('key', 'external_email')->first()->value;
             $this->assertSame('test@test.com', $current_ext_email);
         });
     }
 
     /**
      * Test suspending/unsuspending the user
      */
     public function testSuspendAndUnsuspend(): void
     {
         $this->browse(function (Browser $browser) {
             $john = $this->getTestUser('john@kolab.org');
 
             $browser->visit(new UserPage($john->id))
                 ->assertVisible('@user-info #button-suspend')
                 ->assertMissing('@user-info #button-unsuspend')
                 ->click('@user-info #button-suspend')
                 ->assertToast(Toast::TYPE_SUCCESS, 'User suspended successfully.')
                 ->assertSeeIn('@user-info #status span.text-warning', 'Suspended')
                 ->assertMissing('@user-info #button-suspend')
                 ->click('@user-info #button-unsuspend')
                 ->assertToast(Toast::TYPE_SUCCESS, 'User unsuspended successfully.')
                 ->assertSeeIn('@user-info #status span.text-success', 'Active')
                 ->assertVisible('@user-info #button-suspend')
                 ->assertMissing('@user-info #button-unsuspend');
         });
     }
+
+    /**
+     * Test resetting 2FA for the user
+     */
+    public function testReset2FA(): void
+    {
+        $this->browse(function (Browser $browser) {
+            $this->deleteTestUser('userstest1@kolabnow.com');
+            $user = $this->getTestUser('userstest1@kolabnow.com');
+            $sku2fa = Sku::firstOrCreate(['title' => '2fa']);
+            $user->assignSku($sku2fa);
+            SecondFactor::seed('userstest1@kolabnow.com');
+
+            $browser->visit(new UserPage($user->id))
+                ->click('@nav #tab-subscriptions')
+                ->with('@user-subscriptions', function (Browser $browser) use ($sku2fa) {
+                    $browser->waitFor('#reset2fa')
+                        ->assertVisible('#sku' . $sku2fa->id);
+                })
+                ->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (1)')
+                ->click('#reset2fa')
+                ->with(new Dialog('#reset-2fa-dialog'), function (Browser $browser) {
+                    $browser->assertSeeIn('@title', '2-Factor Authentication Reset')
+                        ->assertSeeIn('@button-cancel', 'Cancel')
+                        ->assertSeeIn('@button-action', 'Reset')
+                        ->click('@button-action');
+                })
+                ->assertToast(Toast::TYPE_SUCCESS, '2-Factor authentication reset successfully.')
+                ->assertMissing('#sku' . $sku2fa->id)
+                ->assertSeeIn('@nav #tab-subscriptions', 'Subscriptions (0)');
+        });
+    }
 }
diff --git a/src/tests/Feature/Controller/Admin/UsersTest.php b/src/tests/Feature/Controller/Admin/UsersTest.php
index b9ba51c2..1381d38a 100644
--- a/src/tests/Feature/Controller/Admin/UsersTest.php
+++ b/src/tests/Feature/Controller/Admin/UsersTest.php
@@ -1,254 +1,295 @@
 <?php
 
 namespace Tests\Feature\Controller\Admin;
 
+use App\Auth\SecondFactor;
+use App\Sku;
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class UsersTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
         self::useAdminUrl();
 
         $this->deleteTestUser('UsersControllerTest1@userscontroller.com');
 
         $jack = $this->getTestUser('jack@kolab.org');
         $jack->setSetting('external_email', null);
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('UsersControllerTest1@userscontroller.com');
 
         $jack = $this->getTestUser('jack@kolab.org');
         $jack->setSetting('external_email', null);
 
         parent::tearDown();
     }
 
     /**
      * Test users searching (/api/v4/users)
      */
     public function testIndex(): void
     {
         $user = $this->getTestUser('john@kolab.org');
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
 
         // Non-admin user
         $response = $this->actingAs($user)->get("api/v4/users");
         $response->assertStatus(403);
 
         // Search with no search criteria
         $response = $this->actingAs($admin)->get("api/v4/users");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(0, $json['count']);
         $this->assertSame([], $json['list']);
 
         // Search with no matches expected
         $response = $this->actingAs($admin)->get("api/v4/users?search=abcd1234efgh5678");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(0, $json['count']);
         $this->assertSame([], $json['list']);
 
         // Search by domain
         $response = $this->actingAs($admin)->get("api/v4/users?search=kolab.org");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(1, $json['count']);
         $this->assertCount(1, $json['list']);
         $this->assertSame($user->id, $json['list'][0]['id']);
         $this->assertSame($user->email, $json['list'][0]['email']);
 
         // Search by user ID
         $response = $this->actingAs($admin)->get("api/v4/users?search={$user->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(1, $json['count']);
         $this->assertCount(1, $json['list']);
         $this->assertSame($user->id, $json['list'][0]['id']);
         $this->assertSame($user->email, $json['list'][0]['email']);
 
         // Search by email (primary)
         $response = $this->actingAs($admin)->get("api/v4/users?search=john@kolab.org");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(1, $json['count']);
         $this->assertCount(1, $json['list']);
         $this->assertSame($user->id, $json['list'][0]['id']);
         $this->assertSame($user->email, $json['list'][0]['email']);
 
         // Search by email (alias)
         $response = $this->actingAs($admin)->get("api/v4/users?search=john.doe@kolab.org");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(1, $json['count']);
         $this->assertCount(1, $json['list']);
         $this->assertSame($user->id, $json['list'][0]['id']);
         $this->assertSame($user->email, $json['list'][0]['email']);
 
         // Search by email (external), expect two users in a result
         $jack = $this->getTestUser('jack@kolab.org');
         $jack->setSetting('external_email', 'john.doe.external@gmail.com');
 
         $response = $this->actingAs($admin)->get("api/v4/users?search=john.doe.external@gmail.com");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(2, $json['count']);
         $this->assertCount(2, $json['list']);
 
         $emails = array_column($json['list'], 'email');
 
         $this->assertContains($user->email, $emails);
         $this->assertContains($jack->email, $emails);
 
         // Search by owner
         $response = $this->actingAs($admin)->get("api/v4/users?owner={$user->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(4, $json['count']);
         $this->assertCount(4, $json['list']);
 
         // Search by owner (Ned is a controller on John's wallets,
         // here we expect only users assigned to Ned's wallet(s))
         $ned = $this->getTestUser('ned@kolab.org');
         $response = $this->actingAs($admin)->get("api/v4/users?owner={$ned->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame(0, $json['count']);
         $this->assertCount(0, $json['list']);
     }
 
+    /**
+     * Test reseting 2FA (POST /api/v4/users/<user-id>/reset2FA)
+     */
+    public function testReset2FA(): void
+    {
+        $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
+        $admin = $this->getTestUser('jeroen@jeroen.jeroen');
+
+        $sku2fa = Sku::firstOrCreate(['title' => '2fa']);
+        $user->assignSku($sku2fa);
+        SecondFactor::seed('userscontrollertest1@userscontroller.com');
+
+        // Test unauthorized access to admin API
+        $response = $this->actingAs($user)->post("/api/v4/users/{$user->id}/reset2FA", []);
+        $response->assertStatus(403);
+
+        $entitlements = $user->fresh()->entitlements()->where('sku_id', $sku2fa->id)->get();
+        $this->assertCount(1, $entitlements);
+
+        $sf = new SecondFactor($user);
+        $this->assertCount(1, $sf->factors());
+
+        // Test reseting 2FA
+        $response = $this->actingAs($admin)->post("/api/v4/users/{$user->id}/reset2FA", []);
+        $response->assertStatus(200);
+
+        $json = $response->json();
+
+        $this->assertSame('success', $json['status']);
+        $this->assertSame("2-Factor authentication reset successfully.", $json['message']);
+        $this->assertCount(2, $json);
+
+        $entitlements = $user->fresh()->entitlements()->where('sku_id', $sku2fa->id)->get();
+        $this->assertCount(0, $entitlements);
+
+        $sf = new SecondFactor($user);
+        $this->assertCount(0, $sf->factors());
+    }
+
     /**
      * Test user suspending (POST /api/v4/users/<user-id>/suspend)
      */
     public function testSuspend(): void
     {
         Queue::fake(); // disable jobs
 
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
 
         // Test unauthorized access to admin API
         $response = $this->actingAs($user)->post("/api/v4/users/{$user->id}/suspend", []);
         $response->assertStatus(403);
 
         $this->assertFalse($user->isSuspended());
 
         // Test suspending the user
         $response = $this->actingAs($admin)->post("/api/v4/users/{$user->id}/suspend", []);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User suspended successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         $this->assertTrue($user->fresh()->isSuspended());
     }
 
     /**
      * Test user un-suspending (POST /api/v4/users/<user-id>/unsuspend)
      */
     public function testUnsuspend(): void
     {
         Queue::fake(); // disable jobs
 
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
 
         // Test unauthorized access to admin API
         $response = $this->actingAs($user)->post("/api/v4/users/{$user->id}/unsuspend", []);
         $response->assertStatus(403);
 
         $this->assertFalse($user->isSuspended());
         $user->suspend();
         $this->assertTrue($user->isSuspended());
 
         // Test suspending the user
         $response = $this->actingAs($admin)->post("/api/v4/users/{$user->id}/unsuspend", []);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User unsuspended successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         $this->assertFalse($user->fresh()->isSuspended());
     }
 
     /**
      * Test user update (PUT /api/v4/users/<user-id>)
      */
     public function testUpdate(): void
     {
         $user = $this->getTestUser('UsersControllerTest1@userscontroller.com');
         $admin = $this->getTestUser('jeroen@jeroen.jeroen');
 
         // Test unauthorized access to admin API
         $response = $this->actingAs($user)->put("/api/v4/users/{$user->id}", []);
         $response->assertStatus(403);
 
         // Test updatig the user data (empty data)
         $response = $this->actingAs($admin)->put("/api/v4/users/{$user->id}", []);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User data updated successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         // Test error handling
         $post = ['external_email' => 'aaa'];
         $response = $this->actingAs($admin)->put("/api/v4/users/{$user->id}", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("The external email must be a valid email address.", $json['errors']['external_email'][0]);
         $this->assertCount(2, $json);
 
         // Test real update
         $post = ['external_email' => 'modified@test.com'];
         $response = $this->actingAs($admin)->put("/api/v4/users/{$user->id}", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("User data updated successfully.", $json['message']);
         $this->assertCount(2, $json);
         $this->assertSame('modified@test.com', $user->getSetting('external_email'));
     }
 }
diff --git a/src/tests/Feature/EntitlementTest.php b/src/tests/Feature/EntitlementTest.php
index 3886e056..2ac211db 100644
--- a/src/tests/Feature/EntitlementTest.php
+++ b/src/tests/Feature/EntitlementTest.php
@@ -1,168 +1,167 @@
 <?php
 
 namespace Tests\Feature;
 
-use App\Auth\SecondFactor;
 use App\Domain;
 use App\Entitlement;
 use App\Package;
 use App\Sku;
 use App\User;
 use Carbon\Carbon;
 use Tests\TestCase;
 
 class EntitlementTest extends TestCase
 {
 
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('entitlement-test@kolabnow.com');
         $this->deleteTestUser('entitled-user@custom-domain.com');
         $this->deleteTestDomain('custom-domain.com');
     }
 
     public function tearDown(): void
     {
         $this->deleteTestUser('entitlement-test@kolabnow.com');
         $this->deleteTestUser('entitled-user@custom-domain.com');
         $this->deleteTestDomain('custom-domain.com');
 
         parent::tearDown();
     }
 
     public function testCostsPerDay(): void
     {
         // 444
         // 28 days: 15.86
         // 31 days: 14.32
         $user = $this->getTestUser('entitlement-test@kolabnow.com');
         $package = Package::where('title', 'kolab')->first();
         $mailbox = Sku::where('title', 'mailbox')->first();
 
         $user->assignPackage($package);
 
         $entitlement = $user->entitlements->where('sku_id', $mailbox->id)->first();
 
         $costsPerDay = $entitlement->costsPerDay();
 
         $this->assertTrue($costsPerDay < 15.86);
         $this->assertTrue($costsPerDay > 14.32);
     }
 
     /**
      * Tests for User::AddEntitlement()
      */
     public function testUserAddEntitlement(): void
     {
         $packageDomain = Package::where('title', 'domain-hosting')->first();
         $packageKolab = Package::where('title', 'kolab')->first();
 
         $skuDomain = Sku::where('title', 'domain-hosting')->first();
         $skuMailbox = Sku::where('title', 'mailbox')->first();
 
         $owner = $this->getTestUser('entitlement-test@kolabnow.com');
         $user = $this->getTestUser('entitled-user@custom-domain.com');
 
         $domain = $this->getTestDomain(
             'custom-domain.com',
             [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_EXTERNAL,
             ]
         );
 
         $domain->assignPackage($packageDomain, $owner);
 
         $owner->assignPackage($packageKolab);
         $owner->assignPackage($packageKolab, $user);
 
         $wallet = $owner->wallets->first();
 
         $this->assertCount(4, $owner->entitlements()->get());
         $this->assertCount(1, $skuDomain->entitlements()->where('wallet_id', $wallet->id)->get());
         $this->assertCount(2, $skuMailbox->entitlements()->where('wallet_id', $wallet->id)->get());
         $this->assertCount(9, $wallet->entitlements);
 
         $this->backdateEntitlements(
             $owner->entitlements,
             Carbon::now()->subMonthsWithoutOverflow(1)
         );
 
         $wallet->chargeEntitlements();
 
         $this->assertTrue($wallet->fresh()->balance < 0);
     }
 
     public function testAddExistingEntitlement(): void
     {
         $this->markTestIncomplete();
     }
 
     public function testEntitlementFunctions(): void
     {
         $user = $this->getTestUser('entitlement-test@kolabnow.com');
 
         $package = \App\Package::where('title', 'kolab')->first();
 
         $user->assignPackage($package);
 
         $wallet = $user->wallets()->first();
         $this->assertNotNull($wallet);
 
         $sku = \App\Sku::where('title', 'mailbox')->first();
         $this->assertNotNull($sku);
 
         $entitlement = Entitlement::where('wallet_id', $wallet->id)
             ->where('sku_id', $sku->id)->first();
 
         $this->assertNotNull($entitlement);
 
         $eSKU = $entitlement->sku;
         $this->assertSame($sku->id, $eSKU->id);
 
         $eWallet = $entitlement->wallet;
         $this->assertSame($wallet->id, $eWallet->id);
 
         $eEntitleable = $entitlement->entitleable;
         $this->assertEquals($user->id, $eEntitleable->id);
         $this->assertTrue($eEntitleable instanceof \App\User);
     }
 
     public function testBillDeletedEntitlement(): void
     {
         $user = $this->getTestUser('entitlement-test@kolabnow.com');
         $package = \App\Package::where('title', 'kolab')->first();
 
         $storage = \App\Sku::where('title', 'storage')->first();
 
         $user->assignPackage($package);
         // some additional SKUs so we have something to delete.
         $user->assignSku($storage, 4);
 
         // the mailbox, the groupware, the 2 original storage and the additional 4
         $this->assertCount(8, $user->fresh()->entitlements);
 
         $wallet = $user->wallets()->first();
 
         $this->backdateEntitlements($user->entitlements, Carbon::now()->subWeeks(7));
 
         $charge = $wallet->chargeEntitlements();
 
         $this->assertTrue($wallet->balance < 0);
 
         $balance = $wallet->balance;
 
         $user->removeSku($storage, 4);
 
         // we expect the wallet to have been charged.
         $this->assertTrue($wallet->fresh()->balance < $balance);
 
         $transactions = \App\Transaction::where('object_id', $wallet->id)
             ->where('object_type', \App\Wallet::class)->get();
 
         // one round of the monthly invoicing, four sku deletions getting invoiced
         $this->assertCount(5, $transactions);
     }
 }