Multifactor authentication prompt is less than 30 days

Help
1

According to the Auth0 documentation, by default: “The user will be able to decide if they want to skip MFA every 30 days when provider is set to other values”. Moreover, it states “In order to let the user skip MFA, a cookie will be stored in the user’s browser” (see Customize Multi-Factor Authentication Pages).

We have had user’s report that they have to perform MFA more frequently than the stated 30 days. Upon investigation, it appears that the auth0 cookie expires only 3 days after visiting the MFA screen. This may be one reason for the reported issue as the cookie expirty is too soon. Is there any possible way to customise the length of time that a user can login without being prompted for MFA?

2

Hi @travis.1

Do you have an MFA rule or are you using the toggle to force MFA to every user? If the former, can you show what the rule looks like?
What is the tenant name and region?

3

Hi @nicolas_sabena,
We have a ‘Multifactor-Guardian-Do-Not-Rename’ rule. We force MFA to every user through this rule (no check for the use_mfa flag):

function (user, context, callback) { var MFA_ACTIVATED = true; if (MFA_ACTIVATED) { context.multifactor = { provider: 'guardian', allowRememberBrowser: true, }; } callback(null, user, context); }

Can you please describe how to find the tenant name and region?

4

The MFA rule looks good.
The tenant name and region can be found at the top-right drop down menu in the dashboard:

image
image1180×250 41.6 KB

5

Hi @nicolas_sabena, our tenant name is “projectgaia” and region is AU - Developer.

6

Hi @travis.1 Apologies for not coming back to you earlier, I missed the reply in my inbox.
I checked your tenant and there’s nothing wrong about it. I also tested the flow you mention and couldn’t reproduce.
Your user said 3 days, which is the default duration of the authentication session. Is it possible that what the user meant was that they need to log in every three days? If that’s the case, this is because of the session duration settings. The MFA session of 30 days is independent of that, and should still work even if the authentication session expires.
Also note that the MFA session is handled with cookies, so if the user clears cookies from your Auth0 domain, they’ll need to do the MFA challenge again.

7

Hi Nicolas, we still have users reporting problems with the MFA length. We are also wondering if it is possible to customise the length of time before needing to do the MFA challenge again (e.g. 6 months).

8

Tagging @nicolas_sabena for visibility!

9

Hi, Was there any resolution this topic? We also have users complaining that it asks for MFA in less then 30 days.

10

Not sure if this was the case then, but I’ve read that the browser cookie for the MFA settings will expire in 7 days the user never logs back into to that device in that time frame. So my understanding is that it will only remember not to prompt for MFA, IF the user is actively using that device.