goauthentik / goauthentik/authentik

No error message displayed during MFA validator stage when DUO push is denied.

Open
#11,368 0 comments 3 reactions 1 assignee Claimed by @BeryJu View on GitHub
bug bug/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

**Describe the bug**
No error message displayed during MFA validator stage when DUO push is denied. I expect to see a message saying that the duo push has been denied however it just re-sends the push almost instantly.

When DUO locks the account after multiple failed attempts, authentik will continue to attempt to send the push notification indefinitely until the user closes authentik website. Loading spinner and message "Sending duo push notification" continues to show. In some cases I see the error message for a split second and then goes back to sending the push notification again.

With "Risk-based factor selection" enabled and when the account is locked out in DUO, the authentication logs show "denied - push harassment".

With "Risk-based factor selection" disabled in DUO, authentik will retry indefinitely (sending multiple push notifications) until user approves push or DUO locks out the account automatically after 10 failed authentication attempts. Even with this, authentik still shows no error messages and attempts to send push repeatedly.

Authentik logs correctly show that the duo push has been denied.

**To Reproduce**
Steps to reproduce the behavior:
1. Create user on DUO admin, send enrollment email, user enrolls and sets up DUO push.
2. Setup DUO authenticator stage.
3. Import users from DUO.
4. Test DUO push. Approve push works as expected. Deny push shows no error message as described above.

**Expected behavior**
When the user denies the push notification, authentik should return error message indicating that the push has been denied. Authentik should not repeatedly attempt to send the push when the user denies the push.

**Screenshots**
![image](https://github.com/user-attachments/assets/62604cb9-951c-48b6-886f-52be0406e13c)
![image](https://github.com/user-attachments/assets/82c79909-664d-4f6e-ab87-875a3bbcd336)

Every time the loading spinner jumps is when I deny the push on my phone.

https://github.com/user-attachments/assets/eeb7c83f-b3c6-4797-85bb-7aca730eb33c

**Version and Deployment (please complete the following information):**

- authentik version: [2024.8.1](https://goauthentik.io/docs/releases/2024.8)
- Deployment: docker-compose

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.