goauthentik / goauthentik/authentik

Disable autoselect 2FA method or choose based on policy

Open
#12,942 5 comments 2 reactions 1 assignee Claimed by @gergosimonyi View on GitHub
enhancement enhancement/under_consideration
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

**Describe your question**
Since Authentik version 2024.10 the 2FA method to use is automatically selected based on which one was last used (https://github.com/goauthentik/authentik/pull/11087).
As I'm accessing services protected by Authentik on both desktop and mobile devices this becomes an inconvenience as the different devices use/support different 2FA methods. On Desktop I use mostly WebAuthn with the key stored in Bitwarden and on mobile I use DUO push. Every time I login on a different device, I have to cancel the 2FA and select another one.

Would there be a way to disable this behavior and always show the picker or change which 2FA method is used based on desktop/mobile use?

**Relevant info**
Desktop (Windows/Mac) with Firefox as browser.
Android mobile device with Firefox as browser.

I tried creating an expression policy bound to the stage to set the `last_used` of the 2FA methods in the `goauthentik.io/stages/authenticator_validate/device_challenges` key under flow context to `null`/`None` but that doesn't seem to have any effect.
```
if 'goauthentik.io/stages/authenticator_validate/device_challenges' in context['flow_plan'].context:

for challenge in context['flow_plan'].context['goauthentik.io/stages/authenticator_validate/device_challenges']:
challenge['last_used'] = None

return True
```

**Version and Deployment (please complete the following information):**

- authentik version: 2024.12.3
- Deployment: Kubernetes, Helm

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.