Warn/check if any 2FA provider is active before enforcing 2FA
Open
Nobody has claimed this yet.
1. to develop
enhancement
feature: authentication
security
- Dominant language
- PHP
- Stars
- 36.9k
- Forks
- 5.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 713
Description
From https://github.com/nextcloud/server/issues/12249
Another thing which confuses me is that I can enforce two factor auth even if no single two factor out method is enabled. I think it would make sense to check that at least one is enabled (u2f, totp,...) and otherwise disable the checkbox.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files or tests are named in the issue. Start by tracing the 2FA enforcement setting and how enabled providers such as U2F and TOTP are detected; the change is done when enforcement cannot be enabled, or warns the administrator, when no provider is active, while remaining available when at least one is enabled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100