magento / magento/security-package

Allow each admin user to choose which 2fa providers to setup

Open
#273 18 comments 2 reactions 1 assignee View on GitHub

@nathanjosiah is already working on this.

Since Mar 13, 2023.

Component: 2FA enhancement Progress: dev in progress
Dominant language
PHP
Stars
75
Forks
73
PR merge metrics
No merged PRs in 30d

Description

### Preconditions

- Magento 2.4.0
- PHP 7.3 and 7.4

### Steps to reproduce

Enable (and configure) the following 2FA providers:

- Duo
- Google
- U2F.

### Expected result

A user can choose between one of the three 2FA methods.

### Actual result

Magento expects all three 2FA providers to be configured for every user account and it is not possible to pick and choose which provider is used on a per user basis.

- [x] Severity: **S1** _- Affects critical data or functionality and forces users to employ a workaround._

Configuring multiple 2FA providers causes the system to see them all as forced providers, meaning that they have to be configured for each and every user in the system as opposed to allowing a user to choose between one of the enabled providers.

This is a problem, considering that merchants may wish to configure the second factor authentication method on a user or role basis. For example, store administrators may wish to use Duo, whereas employees dealing with order fulfillment (who perhaps don't need to access the admin area out of hours and not have mobile phones on them during their day) may need to use a U2F such as Yubikey or similar.

The current implementation does not allow for this use case, which seems like it should be a very obvious option that should be included.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.