RocketChat / RocketChat/Rocket.Chat
MFA Reprompts on SSO login
Open
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
I run Rocketchat in Docker - it is up to date.
I have an OUATH/OpenID connect setup using Keycloak for SSO.
I've noticed that my administrator user is re-prompted for MFA (TOTP) after a successful SSO authentication.
As Keycloak already handles MFA - it would be desirable to not prompt upon redirect back.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the SSO flow in the reported Docker setup using Keycloak and TOTP, then trace the redirect back into Rocket.Chat's authentication flow. Done means a user whose Keycloak login already satisfied MFA is not prompted for Rocket.Chat MFA again, while other MFA cases continue to work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, typescript
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100