Not able to refresh token if mfa is eanbled (Error: mfa_required)

[ydeng]

Hi there

We have enabled multi factor authentication. We are using Authorization Code Flow.
When our angular app uses a refresh token to exchange a new access token, we got an error mfa_required.

{error: “mfa_required”, error_description: “Multifactor authentication required”,…}

We have tried these suggested workaround, they are not working for us.

1. Use Refresh Tokens
2. Configure Silent Authentication
3. Configuring MFA Flow to require MFA once per session with Actions`

The end users have been authenticated with email, password and MFA code when they login, I am not sure that why the token endpoint still requires MFA when we exchange a new access token. Any suggestions or other workaround/solutions? thanks

Cheers
Yanbo

[tyf]

Hi there @ydeng welcome to the community!

You may want to look into writing an Action that utilizes the oauth2-refresh-token property listed under event.transaction here:

Actions Triggers: post-login - Event Object

Some more on what conditional mfa may look like can be found in the following FAQ:

How To Enable MFA for a Subset of Users

Problem Statement By default, once MFA is enabled, it applies to all users in the tenant. Is it possible to enable MFA for specific users? Solution First, ensure the tenant has the Require Multi-factor Auth set to None. Note that this setting will be overridden when MFA is implemented using Rules/Actions. Therefore, using Rules/Actions to conditionally enable MFA for specific users. The MFA challenge can be set up to be based on the user attribute on their profile. Here are the steps: Set th…

Hope this helps!

[sarah1]

It doesn’t help at all. Is there an example solution? Why isn’t this in the documentation?

[tyf]

Hey there @sarah1!

What is your current set up? Are you using refresh tokens or standard silent auth? I’ve just tested using refresh tokens and our react sdk - Users are not required to challenge mfa again on token refresh. This typically happens (speaking to refresh token exchange in particular) when there is a rule/action enforcing mfa.

The more detail you can provide the better!

[sarah1]

We’re working with the angular SDK. We’re using MFA on always but with the “require mfa once per session” rule. I have the AuthModule set up with useRefreshTokens = true and the cacheLocation set to localstorage and enabled offline mode in the dashboard.

I guess I’m using silent auth right now? I’m letting universal login handle the login process, but need to make the access token lifetime super short but don’t want the user to have to log in every minute. So I’m hoping to use refresh tokens but can’t due the the request (that gets made correctly) returns with an mfa_required error.

[tyf]

Thanks for the details!

@sarah1

I have the AuthModule set up with useRefreshTokens = true and the cacheLocation set to localstorage and enabled offline mode in the dashboard.

Are you able to locate a refresh token after auth? I assume you are also including the offline_access scope in the authorize request?

Let us know!