goauthentik / authentik

The authentication glue you need.
https://goauthentik.io
Other
7.79k stars 598 forks source link

MFA validation required twice #10316

Open merclyn opened 3 days ago

merclyn commented 3 days ago

This issue has been present for a while (6-9 months), and I am not sure if its something we introduced configuring it, or its a bug.

When a user authenticates and its then they are prompted to validate the MFA. Once they enter the correct TOTP code their is no reply on the screen, then the user must wait for a new TOTP code to be available, then when entering that new code they are allowed to login.

We are currectly using 2024.4.2 but we have updated a bunch of times and the issue is still happening.

I have included a log entry showing the TOTP auth twice.


{ "auth_method": "password", "http_request": { "args": { "next": "/" }, "path": "/api/v3/flows/executor/default-authentication-flow/", "method": "POST", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:127.0) Gecko/20100101 Firefox/127.0" }, "auth_method_args": { "mfa_devices": [ { "pk": 6, "app": "authentik_stages_authenticator_totp", "name": "TOTP Authenticator - jacks phone", "model_name": "totpdevice" }, { "pk": 6, "app": "authentik_stages_authenticator_totp", "name": "TOTP Authenticator - jacks phone", "model_name": "totpdevice" } ] } }

BeryJu commented 3 days ago

There's another issue for this somewhere, this happens when the authentication flow has multiple MFA validation stages configured

merclyn commented 3 days ago

This helped me find and fix the issue. Looks like I had another validation stage setup. Thanks for the help.