Enforce two-factor auth UX issues

[schiessle]

It is really great that we have the possibility to enforce two factor auth with Nextcloud 15, thanks to everyone who made this happen!

I tested it last week with @MariusBluem and we found some (small) issues we want to document for improvements.

1. I think the settings could need some more spacing, the "Limit to groups" part looks quite squeezed together:

Also it was not obvious to me what this settings mean. If I don't do anything, will it be enforced for everyone? What happens if I explicitly enforce it for groupA and not for groupB and a user is in both groups?

2. Another thing which confuses me is that I can enforce two factor auth even if no single two factor out method is enabled. I think it would make sense to check that at least one is enabled (u2f, totp,...) and otherwise disable the checkbox. -> Warn/check if any 2FA provider is active before enforcing 2FA #12267

3. OK, I enabled it now, logged out and tried to login again, which lead to this screen

As I'm the admin I'm now logged out.
Also I don't understand why I should contact the admin now and what they are supposed to do. What I would expect is that Nextcloud tells me that two-factor auth is required for this account and ask me to scan a Qr code, insert my Nitrokey, whatever. Basically offering a way to complete the setup by myself. I don't think it scales for large installation if everyone has to contact the admin now to do something manually. -> #12268

[schiessle]

cc @ChristophWurst

[nextcloud-bot]

GitMate.io thinks possibly related issues are #6673 (Issue because enforcing security header), #11317 (Two Factor Auth Preventing User First Login (Default Install)), #11455 (Add ability to enforce two-factor authentication), #10634 (Two factor authetication is enforced even if no provider is active), and #1415 (Two-factor auth: Exclude internal networks).

[MariusBluem]

Thanks @schiessle 😸

Also it was not obvious to me what this settings mean. If I don't do anything, will it be enforced for everyone? What happens if I explicitly enforce it for groupA and not for groupB and a user is in both groups?

Should be (and at least it behaves like this in my testing) that the user has enforced twofactor if he is in one of this groups ... and I think that makes most sense :)

Another thing which confuses me is that I can enforce two factor auth even if no single two factor out method is enabled. I think it would make sense to check that at least one is enabled (u2f, totp,...) and otherwise disable the checkbox.

We could solve this by showing an overview about the users 2FA status in the user-settings (see GitHub organization-settings) ... GitHub is a positive example of 2FA mandatory settings & behavior.

Also I don't understand why I should contact the admin now and what they are supposed to do.

He should do sudo -u www-data php occ twofactor:disable <username> 😅

What I would expect is that Nextcloud tells me that two-factor auth is required for this account and ask me to scan a Qr code, insert my Nitrokey, whatever.

⬆ Like GitHub does ... if we want to have it more easy (for now) I could think of blocking those restriction for groups in which not everybody has 2FA enabled already.

[ChristophWurst]

Also it was not obvious to me what this settings mean. If I don't do anything, will it be enforced for everyone? What happens if I explicitly enforce it for groupA and not for groupB and a user is in both groups?

• Will add more explanatory text for this as well as documentation, ref https://github.com/orgs/nextcloud/projects/17#card-13042458

Another thing which confuses me is that I can enforce two factor auth even if no single two factor out method is enabled. I think it would make sense to check that at least one is enabled (u2f, totp,...) and otherwise disable the checkbox.

• I will open an enhancement ticket for this. -> Warn/check if any 2FA provider is active before enforcing 2FA #12267

As I'm the admin I'm now logged out.
Also I don't understand why I should contact the admin now and what they are supposed to do.

• This screen is targeted for users when the admin enforced 2FA but individuals had not set up a provider before. This is what we created https://apps.nextcloud.com/apps/twofactor_admin for.

• For admins that lock themselves out … well. Should we check if the user enforcing 2FA has 2FA enabled? We could only do that on the web UI though. I can open a ticket for that. -> Allow enforcing 2FA only if current admin has 2FA enabled #12269

What I would expect is that Nextcloud tells me that two-factor auth is required for this account and ask me to scan a Qr code, insert my Nitrokey, whatever. Basically offering a way to complete the setup by myself. I don't think it scales for large installation if everyone has to contact the admin now to do something manually.

• This was discussed in [Mandatory 2FA] Spec: How to handle existing users #11021.

---

We could solve this by showing an overview about the users 2FA status in the user-settings (see GitHub organization-settings) ... GitHub is a positive example of 2FA mandatory settings & behavior.

• Possible but a bit expensive to query right now. I will create an enhancement ticket for this. -> Show 2FA state in user settings #12270

He should do sudo -u www-data php occ twofactor:disable <username> sweat_smile

• No, see [Mandatory 2FA] Spec: OCP API changes #11018

⬆ Like GitHub does ... if we want to have it more easy (for now) I could think of blocking those restriction for groups in which not everybody has 2FA enabled already.

• Nope
  

[ChristophWurst]

As I'm the admin I'm now logged out.

Btw, the admin interface even warned you: If they do not have a two-factor provider configured, they will be unable to log into the system. 🙈

[MorrisJobke]

@ChristophWurst @schiessle What is left here? Are all remaining issues opened as separate tickets? So we can close this one here.

[ChristophWurst]

I think so, yes.

[te-online]

Just wanted to say, great improvements on this feature! 🎉 I trapped myself into forcing 2fa, while it was not configured for my admin account, so @schiessle was not the only one... 😬 Edit: Or least, that work has started on the improvements, is what I wanted to say 😁