pgadmin-org / pgadmin-org/pgadmin4
MFA TOTP Authenticator - "Failed to validate the code"
Open
Nobody has claimed this yet.
Bug
- Dominant language
- Python
- Stars
- 3.8k
- Forks
- 891
- Avg merge
- 4d 7h
- Merged PRs (30d)
- 8
Description
When registering for MFA using TOTP code, it gives error "Failed to validate the code".
To Reproduce
Steps to reproduce the behavior:
sudo apt install pgadmin4-web- Create
config_local.pyto force MFA via TOTP.
########################################################################
# Two-factor Authentication Configuration
########################################################################
# Set it to True, to enable the two-factor authentication
MFA_ENABLED = True
# Set it to True, to ask the users to register forcefully for the
# two-authentication methods on logged-in.
MFA_FORCE_REGISTRATION = True
# pgAdmin supports Two-factor authentication by either sending an one-time code
# to an email, or using the TOTP based application like Google Authenticator.
MFA_SUPPORTED_METHODS = ["authenticator"]
########################################################################
- Login via pgadmin4 web & scan TOTP QR code in Google authenticator.
- Enter TOTP code from authenticator.
- Get error message "Failed to validate the code".
- OS: Ubuntu 22.04.5 LTS, Linux-6.8.0-106-generic-x86_64-with-glibc2.35
- pgAdmin version: 9.13
- Mode: Server
- Browser (if running in server mode): Chrome 146.0.0.0
- Package type: DEB
- Python version: 3.10.12
I am accessing /pgadmin4 web via an insecure IP address.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the MFA registration flow using the reported config_local.py settings on the listed Ubuntu and pgAdmin setup. Trace the TOTP validation path reached after scanning the QR code and entering the authenticator code. Done means valid TOTP codes are accepted during registration and the regression is covered by an appropriate test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100