Is 2FA activation by email only for Administrators?

[eduardojonck]

Good afternoon,

I activated 2FA using email but I saw that it is only active for the organization's owner user. Is there no way to enable the 2FA option via email for all users?

I ask because it would be nice to always need to use SSO.

[kpfleming]

2FA and SSO are unrelated.

[eduardojonck]

Yes, I know that!

I would just like to know why you activated 2FA by email for the Organization user but not for a regular user. Do you know?

[jobritz]

There are two settings regarding Email 2FA autoenrollment:

• EMAIL_2FA_ENFORCE_ON_VERIFIED_INVITE:
  This setting affects all users, so Email 2FA would be enrolled automatically for all users
• EMAIL_2FA_AUTO_FALLBACK:
  This setting affects users who join an organization where 2FA is enforced via a policy

I'm not completely sure if I understood this correctly, but thats how I would phrase it. You can check the .env.template file for further details about these settings

[stefan0xC]

To mimic upstream behavior new users that join an organization with 2FA required will automatically setup email as second factor if email as second factor has not been disabled.

This setting affects all users, so Email 2FA would be enrolled automatically for all users

Well, this would currently only be enforced on initial registration via a organization invite. With the new registration flow #5215 this could be extended to all registrations if verification is required in newer web-vaults. (But at the moment it's not possible and also then it would not be enforceable for already existing users.)

Cf.

vaultwarden/src/api/core/accounts.rs

Lines 229 to 231 in 6edceb5

	if verified_by_invite && is_email_2fa_required(data.organization_user_id, &mut conn).await {
	email::activate_email_2fa(&user, &mut conn).await.ok();
	}

and

vaultwarden/src/api/core/accounts.rs

Lines 111 to 123 in 6edceb5

	async fn is_email_2fa_required(member_id: Option<MembershipId>, conn: &mut DbConn) -> bool {
	if !CONFIG._enable_email_2fa() {
	return false;
	}
	if CONFIG.email_2fa_enforce_on_verified_invite() {
	return true;
	}
	if member_id.is_some() {
	return OrgPolicy::is_enabled_for_member(&member_id.unwrap(), OrgPolicyType::TwoFactorAuthentication, conn)
	.await;
	}
	false
	}

This setting affects users who join an organization where 2FA is enforced via a policy

Well, the fallback will be used when the membership status or type changes (on accept, confirm, edit or restore) if 2FA is required and no second factor has been setup (and also email as second factor is enabled). And this option would only affect Users and Managers and not Admins and Owners.

[eduardojonck]

Good afternoon,

Great guys!

From what I saw, after I activated the options, the flow works correctly, where new invitations are made, and 2FA is automatically activated and required.