# Multifactor authentication with custom login and Duo throwing 403 MFA required

**URL:** <https://community.auth0.com/t/multifactor-authentication-with-custom-login-and-duo-throwing-403-mfa-required/6321>\
**Category:** Get Help\
**Tags:** username-password-co, mfa-duo, custom-login, login, mfa\
**Created:** [April 22, 2017, 3:39am UTC](https://community.auth0.com/t/multifactor-authentication-with-custom-login-and-duo-throwing-403-mfa-required/6321 "2017-04-22T03:39:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kelsey.stemm](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@kelsey.stemm](https://community.auth0.com/u/kelsey.stemm)\
**Post date:** [April 22, 2017, 3:39am UTC](https://community.auth0.com/t/multifactor-authentication-with-custom-login-and-duo-throwing-403-mfa-required/6321/1 "2017-04-22T03:39:50Z")

</div>

Tech: Angular2 with custom login (following docs) and Duo

We are able to login with Google + Duo. Using username/password, instead of going to Duo, we receive a 403 with {error:“mfa\_required”,error\_description:“Multifactor authentication required”}. Why is it that Google social will redirect to Duo and the U/P flow won’t? What other calls need to be made within the U/P flow for Duo to function?

---

<div class="post-metadata">

**Author:** ![jmangelo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jmangelo/32/7923_2.png) [@jmangelo](https://community.auth0.com/u/jmangelo)\
**Post date:** [May 22, 2017, 8:22pm UTC](https://community.auth0.com/t/multifactor-authentication-with-custom-login-and-duo-throwing-403-mfa-required/6321/2 "2017-05-22T20:22:03Z")

</div>

The custom login approach for username/password, based on the information you provided, is using a non-redirect based approach which leads to the behavior in question. More specifically it may be using the resource owner password grant (assuming Auth0.js v8 and the method `webAuth.client.login()` is being used) and as such no redirect happens. Also note that according to this [documentation](https://auth0.com/docs/api-auth/tutorials/multifactor-resource-owner-password#prerequisites) Duo is not supported for the resource owner password grant endpoint.

---

<div class="post-metadata">

**Author:** ![blaine.muri](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@blaine.muri](https://community.auth0.com/u/blaine.muri)\
**Post date:** [February 27, 2018, 1:43am UTC](https://community.auth0.com/t/multifactor-authentication-with-custom-login-and-duo-throwing-403-mfa-required/6321/3 "2018-02-27T01:43:52Z")

</div>

How would one enable MFA in this situation then? I have the same scenario where I’m trying to login using Auth0.js v8 login. Would I call a different api endpoint in order to login? And then would the redirect happen correctly? If not, would I have to set my own redirect?

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 2, 2018, 5:53am UTC](https://community.auth0.com/t/multifactor-authentication-with-custom-login-and-duo-throwing-403-mfa-required/6321/4 "2018-03-02T05:53:25Z")

</div>