search

canonical / identity-platform-login-ui

Login UI for the Canonical identity broker and identity provider solution
Apache License 2.0
11 stars 8 forks source link

Removing TOTP and trying to sign in shows a security key as an MFA option but doesn't actually work #339

Open lukasSerelis opened 1 month ago

lukasSerelis commented 1 month ago

If you remove the TOTP method from an account that has backup codes set up, it'll show option to enter backup code after correctly inputting email + password, but will also show the "Sign in with security key" as an option. Clicking which, you get taken to the initial login state.

Flow: (pre-reqs - account registered, TOTP unlinked, passwordless sign in set up, backup codes set up) 1) Enter email and password, hits Sign in image

2)Sees screen with backup recovery code entry and sign in with security key option. Click sign in with security key. image

3) Taken to the initial login page. image

The sign in with security key option should not be in that screen to begin with.

syncronize-issues-to-jira[bot] commented 1 month ago

Thank you for reporting us your feedback!

The internal ticket has been created: https://warthogs.atlassian.net/browse/IAM-1163.

This message was autogenerated

natalian98 commented 1 month ago

@edlerd could you hide the "Sign in with security key" button on 2fa screen?

edlerd commented 1 month ago

I cannot reproduce this with the current main branch locally.

I created an account with backup codes, mfa, and passkeys. Then removed mfa. Then started a login with username/password. The backup code screen has no notion of the passkeys for me.

image

Also after setting up mfa again, the 2fa screen has no notion of the passkeys.

image