Conditional multi-factor rule removes permissions from JWT

Get Help
, ,
2

I was unable to reproduce this in a lab environment with only that rule enabled; for reference here’s the steps I did:

  1. create a user, API and client application.
  2. enable RBAC in API, set a permission directly to the user and configure user metadata to not request MFA.
  3. login with the user and confirm the permissions are there in the token.
  4. enable MFA in user metadata.
  5. login again with the user.

In the last step I still saw permissions in the access token.

Can you confirm that is the only rule you have enabled in the tenant? If it is not it would be worthwhile to test with all other rules disabled and also provide more information about how you’re performing the login. For example, I used the new universal login experience to complete my test logins.