XF 2.2 Login two steps

[Robert9]

Today my system told me to login with two steps.
I checked permission and the two steps are set to none.
Any idea how this is possible?

 

[ENF]

Today my system told me to login with two steps.
I checked permission and the two steps are set to none.
Any idea how this is possible?

Probably need more details here.
2FA just doesn't enable itself on its own.
Check your permissions with the analyzer and of course, check your personal account settings.

And I guess it's worth mentioning, but any other security setup anywhere that would invoke a 2-step login?

 

[Robert9]

And I guess it's worth mentioning, but any other security setup anywhere that would invoke a 2-step login?

While permissions are not set, it must be something else, yes.

 

[ŽivaAkcija]

i am wrong or not, but does administrator when install forum got this on default*

 

[Robert9]

This forum is running many years, before XF it was a vb.

 

[Robert9]

The problem is still existing, but it is the IPad where I have to enter the 2FA, not the PC where I work.
Is there any addon with a function like: Ask for 2FA if not same login like normal? Or is it the cookie on the IPad, that directs the 2FA?

 

[ENF]

The problem is still existing, but it is the IPad where I have to enter the 2FA, not the PC where I work.
Is there any addon with a function like: Ask for 2FA if not same login like normal? Or is it the cookie on the IPad, that directs the 2FA?

I think I answered this already, you need to check your account settings here ../account/two-step/ -- is it set for 2FA or not?
When you enable 2FA in Xenforo, you have to authenticate each device...

If you check this box, you don't need to use 2FA again for 30 days. (this is default XF functionality without any addons)
Each browser/device you use would need to be authenticated.

If you don't have 2FA enabled on your account, then you've got something else going on.

 

[Robert9]

Group admin:
2FA: NEVER

Group user
2FA: Now

---

Check permissions:

No!
Admin: Never
User: No

---

Check config! (could have $config['enableTfa'] = true

$config['superAdmins'] = '1';
$config['fullUnicode'] = true;
$config['enableListeners'] = '1';

---

Check mysql

xf_user_option.use_tfa set to 1

---

Check users/admin.1/edit

found tfa aktivated

I have never touched this here!

---

Only explaination could be:

$config['enableTfa'] = true;
was set last week for five minutes.

This would mean that temporary settings here changes the setting of admin options?

 

[ENF]

This would mean that temporary settings here changes the setting of admin options?

No.

$config['enableTfa'] = true; - This is the default setting and the only time you would put this in your config.php file is if you want to set it to $config['enableTfa'] = false; to disable 2FA globally. (used in emergency cases to gain access an account that is protected by 2FA).

If you have this...

...set to YES, then any account in that group would require 2FA to be used.

In ALL other circumstances, the user has to configure 2FA themselves if they so choose to if the 2FA system is enabled (default setting is yes)

The remaining factor is this setting: ../admin.php?options/groups/acp/

If you login to the ACP, this setting could be placed to require any administrators with ACP access, to login via 2FA.

 

[Robert9]

Thank you.
I still don't know how this happened, but now I know all the places to look for.