Optional Enrollment in MFA

[david15]

Hello,

I hesitate to post this, as looking through the list of similar questions they all appear to be closed or terminate without resolution.

In-App management of MFA with auth0-spa-js

Hi All, Looking for help in implementing OTP MFA in a React application that is using the auth0–spa-js SDK with an express/node backend. My goal is to have the MFA be optional for authenticated users to turn on in a user settings page. I understand that I can control whether MFA authentication flow occurs for users with a meta-data property, and this is my current approach. But how do I go about letting the user toggle MFA on, such that it triggers an OTP check and lets them setup their key in…

React auth0-js MFA

Hi All, I was wondering if anyone had any example code of getting an optional MFA enrolment process working with a React application. Essentially, what I am trying to get working is a custom signup/login process (currently working, but with no multi-factor) that will then give the user an option of adding multi-factor to their account, or for certain user roles (maintained in a custom third party DB), forcing it. I am having a lot of trouble finding anything I can use for React to get the enro…

How to implement optional MFA?

I am creating an angular2 application where I’d like to implement “optional” MFA. By this, I mean I want users to be able to authenticate manually, but able to somehow activate MFA in their user profile. How should I go about this? I am mostly interested in Guardian’s SMS authentication method. I am using the Lock widget.

I’ve looked at custom rules, I’d rather not modify the Auth0MfaWidget and lose the new experience, but even then, I can’t see a way to allow users to opt in/out of MFA. Is there a recommended way to do this?

And, when someone does enroll in MFA via an enrollment ticket, is there a way to redirect them after the enrollment other than editing the Auth0MfaWidget? I’ve added console logs to my rule and am using the WebTask Logs, after login the rule is executed so I could redirect a user but the rule is not executed after MFA enrollment (via ticket).

On this page it’s pretty clear that the art shows “redirecting” after the MFA enrollment process

Effortless Multifactor Authentication (MFA) | Okta

but on this blog post, the response seems pretty clear that there’s no redirection support for MFA enrollment tickets

Success Redirect after User MFA enrollment using ticket

Hi, I am doing Create Custom Enrollment Tickets and following the post body from the sample here Auth0 Management API v2 I got it working till the part that I get email > click on link > mfa widget > enroll mfa But once that is done, it wont redirect anywhere or close the window. [guardian_auth] and then it time out after sometime to [orchard_guardian_auth] Question: Is there a parameter or way I can ask it to show success after last step or provide a redirect url with the “enrollment ti…

I feel as though I might be missing something obvious, any help would be greatly appreciated.

Thanks!

[david15]

Additionally, I’ve been through maybe all of the mfa docs, including the following

Customize Multi-Factor Authentication Pages

Which then says I can customize the full HTML content as described in the following

Customize MFA with Classic Universal Login

However, this makes it clear that internationalization and a number of other features are not available in this, which leads me further to believe that it isn’t the way to go.

[martini]

@david15

I can’t see a way to allow users to opt in/out of MFA. Is there a recommended way to do this

I would also be interested in the answer to this.

[erik.griffin]

Could someone from Auth0 give an official response on this? Is there no way to decide when a User enrolls in MFA? A use-case involves only enrolling users in MFA once they reach a certain stage of the onboarding process- rather than immediately when they create an account. However it seems like once MFA is turned on, it’s required for all users immediately. Is that the case?

[mschoenbaechler]

Is there any update?

We would like to encourage the user to setup MFA in order to use more services without forcing him to do so. However, like described above, there is no straight forward solution to start an MFA process for an already registered user.

There is a possible workaround:
Use custom rule to enforce MFA when, for example, a user has a certain role assgined. The role can be assigned (or removed) by the management API.

Is this the recommended way of doing it?