Skip to content

Direct import fails early when 2FA requirements not met

Madelein van Niekerk requested to merge 384030-direct-import-2fa into master

What does this MR do and why?

Fails Direct Import early if the user initiating an import does not have 2FA enabled but the source group has 2FA required.

Current behaviour

If a user does not have admin AND imports a group with 2FA enforced at the group level:

  1. The new group is created
  2. User is added as a member
  3. User is redirected to their accounts page to set up 2FA with a flash error message and can't do anything until 2FA is set up.

How it was fixed

The issue is solved by raising an error before creating the imported group if these requirements are not met. The result is that the import fails and an error message is displayed on the History indicating "User requires Two-Factor Authentication":

Imports page:

Screenshot_2023-08-17_at_11.00.22

History page:

Screenshot_2023-08-17_at_11.00.15

How to set up and validate locally

  1. Log into the review app: https://gitlab-review-384030-dir-kdlbsi.gitlab-review.app/
    1. Create a PTA for connecting to local
    2. Create a group with a project
  2. On localhost:
    1. Disable 2FA for the logged-in user
    2. Create a group and set 2FA to required: Group > Settings > General > Permissions and group features > Check "All users in this group must set up two-factor authentication", set "Delay 2FA enforcement (hours)" to 0 and save
    3. Go to the imports page and connect to the review app using the PTA created above
    4. Import the group created in the review app
    5. Note that it fails and that the reason of failure on the History page is "User requires Two-Factor Authentication"
    6. Enable 2FA and import again and note that there is no failure

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #384030 (closed)

Edited by Madelein van Niekerk

Merge request reports