By pass 2FA should store the value of output of method bypass_two_factor? in class auth\saml\user.rb but currently it straight away stores value as true and hence the behaviour is incorrect.
bypass_two_factor?
auth\saml\user.rb