RocketChat / RocketChat/Rocket.Chat
Role Two Factor Authentication
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
-
Enabling "Users must use Two Factor Authentication" makes accounts with this role and no 2fa enabled completely unusable without any warning.
Enabling this setting should not be possible while users with this role do not have 2fa enabled. -
It is not possible to disable this setting once activated. This seems like a bug, otherwise the user should be warned and the checkbox be disabled.
Steps to reproduce:
- Go to
/admin/permissions/admin/edit
Expected behavior:
Actual behavior:
Server Setup Information:
- Version of Rocket.Chat Server: 3.5.2
- Operating System:
- Deployment Method:
- Number of Running Instances:
- DB Replicaset Oplog:
- NodeJS Version:
- MongoDB Version:
Client Setup Information
- Desktop App or Browser Version:
- Operating System:
Additional context
Relevant logs:
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at /admin/permissions/admin/edit and reproduce the two-factor authentication behavior for a role whose users have not enabled 2FA. Review how the role setting is enabled and disabled, then verify that users receive a warning or cannot be left without access and that the setting can be safely reversed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, authorization, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100