RocketChat / RocketChat/Rocket.Chat

Role editing 'Users must use Two Factor Authentication' doesn't work

Open
#24,101 3 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

Role editing 'Users must use Two Factor Authentication' doesn't work

Steps to reproduce:
  1. Go to Administration -> Permissions
  2. Click on any role (top of list) (e.g. user)
  3. In Role Editing enable 'Users must use Two Factor Authentication'
Expected behavior:

If an user has been assigned this role and the 'Users must use Two Factor Authentication' is active for that role we would expect that if that user would login some sort of 2FA setup would take place. And that the user wouldn't be able to continue if 2FA isn't active.

Actual behavior:

Nothing, the user can just login (without 2FA) and go about its business.

Server Setup Information:
  • Version of Rocket.Chat Server: 4.2.2
  • Operating System: ubuntu 18
  • Deployment Method: manual nginx ssl
  • Number of Running Instances: 1
  • DB Replicaset Oplog:
  • NodeJS Version: 12.18.4
  • MongoDB Version: 5.0.5
Client Setup Information
  • Desktop App or Browser Version: Firefox 95.0.2
  • Operating System: Linux
Additional context

Possibly related to #18573

Relevant logs:

Console log from BROWSER:

Exception in defer callback: Error: Can't select in removed DomRange
    $ https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:804
    $ https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:804
    find https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:804
    e https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:997
    withValue https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1
    t https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1
    bindEnvironment https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1
    a https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1
bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js:1:6771

Object { stack: "r@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1:4173\n_livedata_result@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:772:17821\nonMessage@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:772:20132\np@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:999:298611\ne/u/t/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:999:298741\nn.bindEnvironment/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1:8262\npromise callback*n/t.makeCompatible/n.prototype.then@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:728:1083\nt@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:999:298711\nsendMessage@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:772:2229\napply@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:772:9725\ncall@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:772:8246\ne/u/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:997:799825\ne/o.call@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:997:800111\ne/a/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:999:281286\na@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:999:281264\ne/s/</<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:999:74963\nonLogin@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:997:787301\ne/s/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:999:74949\ns@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:999:74927\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:802195\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:788836\ne/e/</<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:789428\nn.bindEnvironment/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1:8262\npromise callback*n/t.makeCompatible/n.prototype.then@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:728:1083\ne/e/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:789404\nn.bindEnvironment/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1:8262\npromise callback*n/t.makeCompatible/n.prototype.then@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:728:1083\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:789031\ne/e/</<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:789428\nn.bindEnvironment/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1:8262\npromise callback*n/t.makeCompatible/n.prototype.then@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:728:1083\ne/e/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:789404\nn.bindEnvironment/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1:8262\npromise callback*n/t.makeCompatible/n.prototype.then@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:728:1083\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:789031\ne/e/</<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:789428\nn.bindEnvironment/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1:8262\npromise callback*n/t.makeCompatible/n.prototype.then@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:728:1083\ne/e/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:789404\nn.bindEnvironment/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1:8262\npromise callback*n/t.makeCompatible/n.prototype.then@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:728:1083\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:789031\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:789447\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:802651\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:822774\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:822625\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:822310\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:800643\ne/e/</<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:797899\ne/e/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:797876\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:805265\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:797848\ne/e/this.unsubscribeFocus<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:807049\ne/e/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:790189\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:790168\ne/e/this.removeEventListener<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:790055\nr@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:790525\n", isClientSafe: true, error: "too-many-requests", reason: "Error, too many requests. Please slow down. You must wait 53 seconds before trying again.", details: {…}, message: "Error, too many requests. Please slow down. You must wait 53 seconds before trying again. [too-many-requests]", errorType: "Meteor.Error" }
bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js:679:803005

SERVER LOG:
At the server side we get a lot of:

{"level":50,"time":"2022-01-04T15:00:29.360Z","pid":2099,"hostname":"myServer","name":"System","msg":"Exception while invoking method license:getModules 'Error, too many requests. Please slow down. You must wait 33 seconds before trying again. [too-many-requests]'"}
{"level":50,"time":"2022-01-04T15:00:33.401Z","pid":2099,"hostname":"myServer","name":"System","msg":"Exception while invoking method license:getModules 'Error, too many requests. Please slow down. You must wait 29 seconds before trying again. [too-many-requests]'"} 

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the behavior through Administration → Permissions, the role editor, and the login flow, while checking the browser and server logs for the reported errors. Done means users assigned a role requiring two-factor authentication are prompted to configure it and cannot continue without it.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.