With 2FA disabled, user should be able to remove last OTP token

ubccr / mokey

FreeIPA self-service account management portal

BSD 3-Clause "New" or "Revised" License

190 stars 45 forks source link

With 2FA disabled, user should be able to remove last OTP token #95

Closed dsajdak closed 3 years ago

dsajdak commented 3 years ago

Currently we don't allow user to remove the last token on the account. If 2FA is disabled and the user wants to remove all tokens, they should be able to.

dsajdak commented 3 years ago

Current testing shows this not to be a problem. Will reopen if I can replicate the issue at a later time