Add warning to Setup Checks when 2FA is not enabled and when instance is outdated

[jospoortvliet]

Tip

Help move this idea forward

• Use the 👍 reaction to show support for this feature.
• Avoid commenting unless you have relevant information to add; unnecessary comments create noise for subscribers.
• Subscribe to receive notifications about status changes and new comments.

---

Request.
We should add two new warnings to the setup checks:

• there is no 2FA apps configured (or it is not mandatory) in case no external auth (single sign-on) is used
• there is a new minor version available OR the product is out of maintenance window

[come-nc]

• there is a new minor version available OR the product is out of maintenance window

This is already indicated in the admin UI, on the same page as setup checks.
[EDIT] That an update is available I mean, I do not know if there is information about maintenance window.

[come-nc]

Request. We should add two new warnings to the setup checks:

• there is no 2FA apps configured (or it is not mandatory) in case no external auth (single sign-on) is used

How do we decide if SSO is used? In user_saml or user_oidc is enabled it’s enough, or should we somehow detect if users are using it? There can be a mix of SSO and local users in Nextcloud. Sometimes both direct login and SSO are even allowed for the same users.
For 2FA we can detect if a 2FA provider is registered. We can detect if 2FA is enforced, but it may be enforced only for some groups, or excluding some groups. I guess having it partially enforced would be enough to get rid of the warning but wanted to mention it.

[sorbaugh]

In addition to come-nc's important information, also wanted to include @marcoambrosini to align on where it would make more sense and be most beneficial to display the error.

[marcoambrosini]

In the overview section of the admin settings. Don't know if @jospoortvliet means only in security guard or also here: