Enforce 2FA on Login for Users who havent setup 2FA

[yodaphone]

I want to enforce users who havent setup their 2FA yet. I have this in config.json but it still doesnt force the user without one to set it up. What am i doing wrong, this is my config.json. i have 2 domains

{
  "$schema": "http://info.meshcentral.com/downloads/meshcentral-config-schema.json",
  "settings": {
    "cert": "control.mydomain.com",
    "_mongoDb": "mongodb://mongodb:27017",
    "_WANonly": true,
    "_LANonly": true,
    "_sessionKey": "MyReallySecretPassword1",
    "port": 443,
    "_aliasPort": 443,
    "redirPort": 80,
    "_redirAliasPort": 80,
    "AgentPong": 300,
    "TLSOffload": false,
    "SelfUpdate": false,
    "AllowFraming": "false",
    "wsCompression": true,
    "agentWsCompression": true,
    "desktopMultiplex": true,
    "InterUserMessaging": [ "user//admin" ],
    "manageAllDeviceGroups": [ "user//admin" ],
    "ManageCrossDomain": ["user//admin"],
    "WebRTC": "false",
    "AutoBackup": {
      "backupPath": "/opt/meshcentral/meshcentral-backups",
      "backupInvervalHours": "24",
      "keepLastDaysBackup": "10",
      "zippassword": "tpM#%LeDfDGW7a"
    }
  },
  "domains": {
    "": {
      "title": "mydomain Central",
      "title2": "TM",
      "TitlePicture": "mzsmall.png",
      "loginPicture": "mzlogo.png",
      "footer": "This is a private server for exclusive use by mydomain Employees. All access is logged. Unauthorized use is Prohibited",
      "minify": true,
      "NewAccounts": "false",
      "_userNameIsEmail": true,
      "certUrl": "https://control.mydomain.com:443",
      "clipboardGet": true,
      "clipboardSet": true,
      "localSessionRecording": true,
      "passwordRequirements": {
        "force2factor": true,
        "_skip2factor": "127.0.0.1,192.168.2.0/24",
        "oldPasswordBan": 5,
        "banCommonPasswords": false,
        "twoFactorTimeout": 300,
        "duo2factor": true
      },
      "sessionRecording": {
          "onlySelectedDeviceGroups": true,
          "index": true,
          "protocols": [1,2,200]
     }
    },
    "client": {
      "dns": "central.client.com",
      "title": "Client Central",
      "title2": "TM",
      "footer": "This is a private server for exclusive use by Client Team. All access is logged. Unauthorized use is Prohibited",
      "minify": true,
      "NewAccounts": "false",
      "_userNameIsEmail": true,
      "certUrl": "https://central.client.com:443",
      "passwordRequirements": {
        "force2factor": true,
        "_skip2factor": "127.0.0.1,192.168.2.0/24",
        "oldPasswordBan": 5,
        "banCommonPasswords": false,
        "twoFactorTimeout": 300,
        "duo2factor": true
      }
    }
  },
  "sendgrid": {
    "from": "[email protected]",
    "apikey": "SG.wvJlE4pyQd-W72A4KZ82vQ.l_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  }
}

[si458]

This should all be correct, what 2fa are u trying to setup?
The duo2factor is an experimental option and not yet released to the public, only the master docker image supports it

[yodaphone]

I've disabled duo. I want to use a TOTP for 2FA. So bitwarden or Authenticator etc.

After I log in I am able to set it up manually, but i want this to be forced on the user if they havent set it up

I turned on email verification with sendgrid but thats a hit an a miss. I dont see any errors in the Trace logs

[si458]

all looks correct again?

you should get a pop up in a notification saying 2fa is required to proceed click here
when the user logs in if they dont have any 2fa setup?

you could try setting minify to false for both or removing the option and restarting and seeing if it works still?

[yodaphone]

now i get it. so 2FA is not enforced during login, but after the login & when i try to click on a resource it asks me to set it up.

IMHO, i think it will be better if its enforced during login so that someone doesnt even get in without a 2FA to begin with

[si458]

yes thats the idea! otherwise all the 2fa method would need screens to be created on the login page which is more work!
this way we just let you login but you cant do anything without going to My Account and setting up 2FA
if you wanted it to be forced during login, you would need to open a feature request for this as its a BIG JOB!!!
we would need to add ALL the different 2fa methods into the login pages as different screens etc
so this would need to be a BIG sponsorship/donation

[yodaphone]

thank you for explaining the challenge.