Skip to content

[stable18] Clean up 2FA provider registry when a user is deleted#18770

Merged
rullzer merged 1 commit intostable18from
backport/18738/stable18
Jan 10, 2020
Merged

[stable18] Clean up 2FA provider registry when a user is deleted#18770
rullzer merged 1 commit intostable18from
backport/18738/stable18

Conversation

@backportbot-nextcloud
Copy link

backport of #18738

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
@rullzer rullzer merged commit 3b68153 into stable18 Jan 10, 2020
@rullzer rullzer deleted the backport/18738/stable18 branch January 10, 2020 08:44
@robertdahlem
Copy link

This does not seem to be resolved in 18.0.3.
I have installed:

  • twofactor_admin: 2.0.0
  • twofactor_backupcodes: 1.7.0
  • twofactor_email: 1.0.1
  • twofactor_gateway: 0.15.1
  • twofactor_totp: 4.1.3

Created a group "2fa", enforced 2FA for this group, added a user and put it into group "2fa", signed in as this user, was forced to setup 2FA with TOTP. Deleted the user, recreated it and put it into group "2fa", signed in as this user, was asked to authenticate with TOTP app (instead of: being asked to setup 2FA).

Before logging in the first time after recreation:
$ occ twofactorauth:state robert
Two-factor authentication is not enabled for user robert

After logging in but before entering a Token:
$ occ twofactorauth:state robert
Two-factor authentication is not enabled for user robert
Disabled providers:

  • admin
  • backup_codes
  • email
  • gateway_signal
  • gateway_sms
  • gateway_telegram
  • totp

@ChristophWurst
Copy link
Member

Yeah, so I think the state is cleared. But since the totp app does not clears its state, it will propagate again. The actual bug was reported at nextcloud/twofactor_totp#384. Let's continue there.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants