Skip to content

feat: Add SetupCheck to warn about missing second factor provider #57854

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nickvergessen merged 3 commits into from
Feb 5, 2026
Merged

feat: Add SetupCheck to warn about missing second factor provider #57854

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1f5e6cb
feat: Add SetupCheck to warn about missing second factor provider
come-nc Jan 27, 2026
8475bed
fix(settings): Only consider primary providers for 2FA setup check
come-nc Feb 2, 2026
26cec2d
feat: Add info level result if 2FA is not enforced
come-nc Feb 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions apps/settings/composer/composer/autoload_classmap.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,6 +140,7 @@
'OCA\\Settings\\SetupChecks\\TaskProcessingSuccessRate' => $baseDir . '/../lib/SetupChecks/TaskProcessingSuccessRate.php',
'OCA\\Settings\\SetupChecks\\TempSpaceAvailable' => $baseDir . '/../lib/SetupChecks/TempSpaceAvailable.php',
'OCA\\Settings\\SetupChecks\\TransactionIsolation' => $baseDir . '/../lib/SetupChecks/TransactionIsolation.php',
'OCA\\Settings\\SetupChecks\\TwoFactorConfiguration' => $baseDir . '/../lib/SetupChecks/TwoFactorConfiguration.php',
'OCA\\Settings\\SetupChecks\\WellKnownUrls' => $baseDir . '/../lib/SetupChecks/WellKnownUrls.php',
'OCA\\Settings\\SetupChecks\\Woff2Loading' => $baseDir . '/../lib/SetupChecks/Woff2Loading.php',
'OCA\\Settings\\UserMigration\\AccountMigrator' => $baseDir . '/../lib/UserMigration/AccountMigrator.php',
Expand Down
1 change: 1 addition & 0 deletions apps/settings/composer/composer/autoload_static.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,6 +155,7 @@ class ComposerStaticInitSettings
'OCA\\Settings\\SetupChecks\\TaskProcessingSuccessRate' => __DIR__ . '/..' . '/../lib/SetupChecks/TaskProcessingSuccessRate.php',
'OCA\\Settings\\SetupChecks\\TempSpaceAvailable' => __DIR__ . '/..' . '/../lib/SetupChecks/TempSpaceAvailable.php',
'OCA\\Settings\\SetupChecks\\TransactionIsolation' => __DIR__ . '/..' . '/../lib/SetupChecks/TransactionIsolation.php',
'OCA\\Settings\\SetupChecks\\TwoFactorConfiguration' => __DIR__ . '/..' . '/../lib/SetupChecks/TwoFactorConfiguration.php',
'OCA\\Settings\\SetupChecks\\WellKnownUrls' => __DIR__ . '/..' . '/../lib/SetupChecks/WellKnownUrls.php',
'OCA\\Settings\\SetupChecks\\Woff2Loading' => __DIR__ . '/..' . '/../lib/SetupChecks/Woff2Loading.php',
'OCA\\Settings\\UserMigration\\AccountMigrator' => __DIR__ . '/..' . '/../lib/UserMigration/AccountMigrator.php',
Expand Down
2 changes: 2 additions & 0 deletions apps/settings/lib/AppInfo/Application.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,7 @@
use OCA\Settings\SetupChecks\TaskProcessingPickupSpeed;
use OCA\Settings\SetupChecks\TempSpaceAvailable;
use OCA\Settings\SetupChecks\TransactionIsolation;
use OCA\Settings\SetupChecks\TwoFactorConfiguration;
use OCA\Settings\SetupChecks\WellKnownUrls;
use OCA\Settings\SetupChecks\Woff2Loading;
use OCA\Settings\UserMigration\AccountMigrator;
Expand Down Expand Up @@ -218,6 +219,7 @@ public function register(IRegistrationContext $context): void {
$context->registerSetupCheck(TaskProcessingPickupSpeed::class);
$context->registerSetupCheck(TempSpaceAvailable::class);
$context->registerSetupCheck(TransactionIsolation::class);
$context->registerSetupCheck(TwoFactorConfiguration::class);
$context->registerSetupCheck(PushService::class);
$context->registerSetupCheck(WellKnownUrls::class);
$context->registerSetupCheck(Woff2Loading::class);
Expand Down
65 changes: 65 additions & 0 deletions apps/settings/lib/SetupChecks/TwoFactorConfiguration.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,65 @@
<?php

declare(strict_types=1);

/**
* SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
* SPDX-License-Identifier: AGPL-3.0-or-later
*/

namespace OCA\Settings\SetupChecks;

use OC\Authentication\TwoFactorAuth\MandatoryTwoFactor;
use OC\Authentication\TwoFactorAuth\ProviderLoader;
use OC\Authentication\TwoFactorAuth\ProviderSet;
use OCP\IL10N;
use OCP\SetupCheck\ISetupCheck;
use OCP\SetupCheck\SetupResult;

class TwoFactorConfiguration implements ISetupCheck {
public function __construct(
private IL10N $l10n,
private ProviderLoader $providerLoader,
private MandatoryTwoFactor $mandatoryTwoFactor,
) {
}

public function getName(): string {
return $this->l10n->t('Second factor configuration');
}

public function getCategory(): string {
return 'security';
}

public function run(): SetupResult {
$providers = $this->providerLoader->getProviders();
$providerSet = new ProviderSet($providers, false);
$primaryProviders = $providerSet->getPrimaryProviders();
if (count($primaryProviders) === 0) {
return SetupResult::warning($this->l10n->t('This instance has no second factor provider available.'));
}
Comment on lines +39 to +41
Copy link
Member

@provokateurin provokateurin Feb 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I use SSO on my instance (with enforced 2FA), so after the update my admin overview tells me that this is an issue. Could this setup check also check if there are other backends and hide itself, because it can't know if 2FA is enabled/enforced in that case?

Copy link
Member

@nickvergessen nickvergessen Feb 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could this setup check also check if there are other backends and hide itself

Having other backends is not enough reason to hide it. Basically all backends would need it, and then there is still the installing admin user on the database backend.
Just enable a 2FA app and enforce it for your admin

Copy link
Member

@provokateurin provokateurin Feb 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I actually don't have an admin user who is on the DB backend since #53212
But yeah I'll just ignore the warning then (since I know it's "wrong" in my case) 🤷‍♀️


$state = $this->mandatoryTwoFactor->getState();

if (!$state->isEnforced()) {
return SetupResult::info(
$this->l10n->t(
'Second factor providers are available but two-factor authentication is not enforced.'
)
);
} else {
return SetupResult::success(
$this->l10n->t(
'Second factor providers are available and enforced: %s.',
[
implode(', ', array_map(
fn ($p) => '"' . $p->getDisplayName() . '"',
$primaryProviders)
)
]
)
);
}
}
}
8 changes: 6 additions & 2 deletions lib/private/Authentication/TwoFactorAuth/ProviderLoader.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,8 +30,12 @@ public function __construct(
* @return IProvider[]
* @throws Exception
*/
public function getProviders(IUser $user): array {
$allApps = $this->appManager->getEnabledAppsForUser($user);
public function getProviders(?IUser $user = null): array {
if ($user === null) {
$allApps = $this->appManager->getEnabledApps();
} else {
$allApps = $this->appManager->getEnabledAppsForUser($user);
}
$providers = [];

foreach ($allApps as $appId) {
Expand Down
Loading