authgear / authgear/authgear-server

[Login] Should require to setup selected Authenticators when 2FA Requirements set to "Mandatory"

Open
#2,181 0 comments 0 reactions 0 assignees View on GitHub
bug/trivial reported by qa
Dominant language
Go
Stars
2k
Forks
125
Avg merge
2d 17h
Merged PRs (30d)
32

Description

ux/major

**Describe the bug**
When the admin set the 2FA Requirements to "Mandatory", the user is optional to set up the selected Authenticator if he already has 1 active authenticator.

**Authgear Version**
- Version: staging-2022-06-27.0

**To Reproduce**
Steps to reproduce the behavior:
1. Log in to admin portal
2. Select a project
3. Go to Authentication > Authenticators
4. Scroll to 2FA
5. Set 2FA Requirements to "Mandatory" > Add a new Authenticators
6. Go to user portal > Sign in
7. Proceed to 2FA
8. See not require the user to set up the mandatory authenticator

**Expected behavior**
Should require the user to set up mandatory authenticators

**Screenshots**

https://user-images.githubusercontent.com/93981572/176600613-570f49e5-0bf7-4843-8c71-3ad5f633b488.mp4

**Client Env:**
- Device: Chrome on win11

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the flow through the admin portal's Authentication > Authenticators 2FA settings and the user portal sign-in flow. Trace how mandatory authenticators are checked when a user already has one active authenticator. Done means every authenticator selected as mandatory is required during sign-in, including when another authenticator is already active.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.