Associate MFA factor from own UI: error on factor activation

[dan.woda]

Finally got some time to go through this whole flow, and after some time with postman I have some ideas.

@thijmen96

get an access token for the https://{{auth0-domain}}/mfa audience with scopes enroll read:authenticators remove:authenticators when logging in with Universal Login

How is the user logging in here (I think this is the crux of the issue)? Are users not required to use MFA? They should be getting a MFA required error and a MFA token.

@thijmen96

I enter the secret in Google Authenticator and get the OTP code

After this you would take the MFA token from step 1 and make the request you posted, which would return an access and id token.

@thijmen96

But I don’t have an MFA token. Replacing it with the access token results in an "invalid_grant" error with description "invalid audience" . Now, if the access token is expired, the error changes to "mfa token expired" , so it seems the access token is accepted in this location and I’m this close to clearing this hurdle.

This is likely an unintentional red herring. The API is probably looking at the token expiration before looking at the actual payload, and saying the MFA token is expired, when it isn’t an MFA token at all, but it is expired.