React-native-auth0: multi factor authentication, mfa_required

[aprilmintacpineda]

Please do not report security vulnerabilities here. The Responsible Disclosure Program details the procedure for disclosing security issues.

Thank you in advance for helping us to improve this library! Please read through the template below and answer all relevant questions. Your additional work here is greatly appreciated and will help us respond as quickly as possible. For general support or usage questions, use the Auth0 Community or Auth0 Support. Finally, to avoid duplicates, please search existing Issues before submitting one here.

By submitting an Issue to this repository, you agree to the terms within the Auth0 Code of Conduct.

Description

const credentials = await auth0.auth.passwordRealm({
  username: email,
  password,
  realm: 'Username-Password-Authentication',
  scope: 'openid profile email read:current_user',
  audience: '<url here>'
});

throws an error saying: mfa_required: Multifactor authentication required. I was expecting it to return the tokens then I will call await auth0.auth.userInfo({ token: accessToken }) to get the user data and from there I will know if mfa is required and display the mfa form.

Reproduction

Detail the steps taken to reproduce this error, what was expected, and whether this issue can be reproduced consistently or if it is intermittent.

Where applicable, please include:

• Code sample to reproduce the issue
• Log files (redact/remove sensitive information)
• Application settings (redact/remove sensitive information)
• Screenshots

Just the codes above.

Environment

Please provide the following:

• Version of this library used: 2.6.0
• Version of the platform or framework used, if applicable:
• Other relevant versions (language, server software, OS, browser):
• Other modules/plugins/libraries that might be involved:

[Widcket]

Hi @aprilmintacpineda, do you have MFA enabled on your Auth0 tenant?

[aprilmintacpineda]

@Widcket yes I have, it's set to ALWAYS and the "Phone Message" is on.

I also have checked the mfa on grant types.

Which is the intention because I want to use the MFA. I'm trying to login using an account that has enrolled in MFA.

[Widcket]

@aprilmintacpineda in that case you need to check if the user has an MFA factor enrolled or not. Please follow the steps on the "Authenticate Using the Resource Owner Password Flow with MFA" guide from this point onwards.

[aprilmintacpineda]

I will follow that and come back to you with a response. Thank you!

[aprilmintacpineda]

@Widcket aren't there functions in this library that I can call to do these requests instead of using fetch or something similar?

[Widcket]

I'm afraid this SDK does not provide methods to interact with the MFA API.

[aprilmintacpineda]

Okay then, I'll look into this and come back with a response, also to help others who will encounter this.

[aprilmintacpineda]

@Widcket based on what I have read so far, MFA requires server to server, is that right?

[Widcket]

Sorry, I'm not following. What do you mean?

[aprilmintacpineda]

@Widcket I mean, I need to do it on the server-side, because the examples on the link you gave client secret which suggests that I should do it on the server-side, is that correct?

[Widcket]

@aprilmintacpineda were you able to implement the MFA flow?

[aprilmintacpineda]

@Widcket No, not yet, I'm still a bit confused if it should be on the backend or not.

[Widcket]

@aprilmintacpineda according to the Authentication API docs, the client secret it's only required for regular web applications. To implement a mobile MFA flow, you can take a look at how the Guardian for iOS library does it.