authgear / authgear/authgear-server
[Login] Should require to setup selected Authenticators when 2FA Requirements set to "Mandatory"
- Dominant language
- Go
- Stars
- 2k
- Forks
- 125
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 32
Description
ux/major
**Describe the bug**
When the admin set the 2FA Requirements to "Mandatory", the user is optional to set up the selected Authenticator if he already has 1 active authenticator.
**Authgear Version**
- Version: staging-2022-06-27.0
**To Reproduce**
Steps to reproduce the behavior:
1. Log in to admin portal
2. Select a project
3. Go to Authentication > Authenticators
4. Scroll to 2FA
5. Set 2FA Requirements to "Mandatory" > Add a new Authenticators
6. Go to user portal > Sign in
7. Proceed to 2FA
8. See not require the user to set up the mandatory authenticator
**Expected behavior**
Should require the user to set up mandatory authenticators
**Screenshots**
https://user-images.githubusercontent.com/93981572/176600613-570f49e5-0bf7-4843-8c71-3ad5f633b488.mp4
**Client Env:**
- Device: Chrome on win11
Contributor guide
Research direction
Start by reproducing the flow through the admin portal's Authentication > Authenticators 2FA settings and the user portal sign-in flow. Trace how mandatory authenticators are checked when a user already has one active authenticator. Done means every authenticator selected as mandatory is required during sign-in, including when another authenticator is already active.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100