MFA (google authenticator) Enrollment in Universal Login

Get Help
,
1

I want to Enroll an already logged in user to MFA using Universal Login without them having to login again. In my app, I want users to be able to go to their profile page and select “enroll mfa” if they don’t have it yet.

Is this possible?

Here’s the flow I’ve tried so far:

  1. When “enroll mfa” button is clicked, “enableMfa=1” gets added to user_metadata
  2. I then do a silent auth by redirecting to /authorize with prompt=none
  3. A post-login action reads the user metadata, if it sees ‘enableMfa’ it would do api.authentication.challengeWith({type: ‘otp’});

I did silent auth in step 2 in the hopes that Universal Login would detect existing session and that it would just show the MFA enrollment prompt — unfortunately that was not the case.

3

Hi @wbt

Welcome to the Auth0 Community!

I would recommend to read our documentation regarding enrolling and challenging users using OTP, this knowledge article and this community post.

Let me know if there is anything you might need clarification on or if you have any other questions.

Kind Regards,
Nik