Two factor default

[tcobbfis]

I have a requirement that all users use two factor auth. Currently it's up to the individual user to enable two factor after they have their account. Even if two factor is marked as required in the admin, it's still up to the individual user to go in and enable it for the requirement to apply to them. Is there a way to enable two factor by default when adding a new user? Will I have to replace the user module?

[hishamco]

There could be an option in the admin to make it compulsory for everyone to use 2FA or optional

I'm not sure if there's a reason why it doesn't support this

/cc @MikeAlhayek

[MikeAlhayek]

We have an option "Require two-factor authentication". If this is set, then when the user login, they will be required to enable two factor authentication.

you can also require-two factor authentication for a specific role only if you want.

[tcobbfis]

I selected the 2fa from security in the top menu (to get the last screenshot). I could still edit content or whatever without setting up 2fa.

[MikeAlhayek]

That's not the expected behavior. You should not be able to bypass the 2FA page if it is required. I'll try to reproduce the issue.

[tcobbfis]

I noticed that if you click "add", you are required to use 2fa on your next signin. It doesn't matter if you enter a setup code or not. So I altered the user creation as seen below. I believe it will provide a workable "patch".

[MikeAlhayek]

@tcobbfis indeed this is a bug in the code! I'll submit a fix. Meanwhile, if you want to fix this issue in your project register the following service

services.AddScoped<IUserClaimsProvider, TwoFactorAuthenticationClaimsProvider>();