Redmine

Sudo mode (when enabled) forces the user to enter their password again before being able to perform specific actions.
However, sudo mode does not require the user to re-complete two factor authentication when it is enabled.

I propose a new option for users to force them to enter their password AND complete two factor authentication again in order to access an action which requires sudo mode. This could be an option on the account page, something like "Require two factor authentication in sudo mode" which can be enabled if sudo mode is enabled and the user has two factor authentication enabled.
Going further, it could also be a config option to force users of certain groups (or administrators) to enable this option.