goauthentik / goauthentik/authentik
Disable autoselect 2FA method or choose based on policy
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 644
Description
**Describe your question**
Since Authentik version 2024.10 the 2FA method to use is automatically selected based on which one was last used (https://github.com/goauthentik/authentik/pull/11087).
As I'm accessing services protected by Authentik on both desktop and mobile devices this becomes an inconvenience as the different devices use/support different 2FA methods. On Desktop I use mostly WebAuthn with the key stored in Bitwarden and on mobile I use DUO push. Every time I login on a different device, I have to cancel the 2FA and select another one.
Would there be a way to disable this behavior and always show the picker or change which 2FA method is used based on desktop/mobile use?
**Relevant info**
Desktop (Windows/Mac) with Firefox as browser.
Android mobile device with Firefox as browser.
I tried creating an expression policy bound to the stage to set the `last_used` of the 2FA methods in the `goauthentik.io/stages/authenticator_validate/device_challenges` key under flow context to `null`/`None` but that doesn't seem to have any effect.
```
if 'goauthentik.io/stages/authenticator_validate/device_challenges' in context['flow_plan'].context:
for challenge in context['flow_plan'].context['goauthentik.io/stages/authenticator_validate/device_challenges']:
challenge['last_used'] = None
return True
```
**Version and Deployment (please complete the following information):**
- authentik version: 2024.12.3
- Deployment: Kubernetes, Helm
Contributor guide
Assessment
This issue has not been assessed yet.