OpenConext / OpenConext/OpenConext-engineblock
User is shown confusing technical error message when they refuse/can't do MFA (e.g., in eduID)
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 17
- Forks
- 25
- Avg merge
- 4d 1h
- Merged PRs (30d)
- 1
Description
When an IdP is configured (in manage) to require a specific ACCR fot a service, and the MFA login fails for some reason, Engineblock shows this generic error message to the user:
While technically correct, it would be nice if we could make this specific error a bit more readable for regular users. For me it was not entirely clear on first glance that this was an MFA error. Regular users probably have no idea what is happening here.
To reproduce:
- connect an SP to eduID and configure Refeds MFA for this connection
- log into the service but in eduID refuse to install the app or login with a token
- EB shows this error.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the MFA login flow described in the reproduction steps, using an eduID connection configured with Refeds MFA and refusing the app or token login. Locate where Engineblock displays the generic error shown in the issue and make the result understandable to regular users as an MFA failure, then verify the reproduced flow shows the clearer message.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100