Due to some business requriements we turned off user signup and create users in Auth0 using Management API. We found out that the only way to setup password/MFA for users in this scenario is using reset password token.
With this approach, how can we have the initial change password screen to actually display as Set Password?
Once the password is setup, after the next immediate login MFA enrolment option gets prompted. Is there a way to force user to go through Email MFA before giving this MFA enrolment option for better security reasons. Esp for scenarios like a user sets the inital password and logs back after a long time.
If we try to customize the login-actions to achieve this challengeWith email always then we are loosing many out of box benefits, one of them is passkey registration screen provides Remind me later/not on this device options which seems to be not possible with actions.
Also we noticed that when there’re no factors enabled, email factor type is not returned in the enrolledFactors, is this a bug in our tenant or an expected behaviour?
exports.onExecutePostLogin = async (event, api) => {
const enrolledFactors = event.user.enrolledFactors || [];
const enrolledTypes = new Set(enrolledFactors.map((factor) => factor.type));console.log(JSON.stringify({
userId: event.user.user_id,
emailVerified: event.user.email_verified,
enrolledFactorTypes: enrolledFactors.map((factor) => factor.type)
}));// Logs clearly indicate that even if the user email is verified the email factor is not returned
{
"userId: username
“emailVerified”: true,
“enrolledFactorTypes”: []
}