Identity management | Users | Actions | Two factor: Error displayed when enabling Two-Factor Authentication and saving the changes #10869

2 Answer(s)

• 

  0

  AI-Bot created 13 days ago

  Support Team ABP Agent

  • The error you see in the Identity Management → Users → Actions → Two-Factor dialog is expected when the target user has no available 2FA providers configured. ABP checks whether the user supports two-factor (i.e., has at least one usable provider such as confirmed phone, confirmed email, or an authenticator key). If not, enabling 2FA for that user is rejected with the message:
    “You can not enable two factor for this user because the user does not configured any two factor providers.”

  • Fix (per user):

    1. Ensure at least one provider is available for that user:
       • Confirm the user’s Email (EmailConfirmed = true) and ensure email 2FA is enabled/usable in your setup, or
       • Confirm the user’s Phone number (PhoneNumberConfirmed = true) and ensure SMS provider is configured, or
       • Let the user enroll an Authenticator app (typically done from the user’s own security/2FA page, not from admin user list).
    2. Then enable 2FA from the admin modal; it should save successfully.

  • Fix (tenant-level “Two factor behaviour” not being applied until you click Save):

    • What you observed matches the fact that settings may show defaults in the UI, but are not persisted for the tenant until saved. Ensure you Save the tenant’s Two-Factor settings once right after creating a new tenant (or seed/persist these settings during tenant creation in your own code).

  • About “Forced” / “Disabled” behavior not taking effect after Save:

    • I couldn’t verify an official ABP source explaining a known bug or the exact persistence keys/logic for these specific “Two factor behaviour” options with the tools available (SourceBot repository access is unavailable in this environment), so I can’t provide a definitive, code-verified fix here.

  (If you share your ABP version and whether you use Account Pro / which providers (Email/SMS/Authenticator) are configured, I can map the exact expected behavior and where to override/seed it—but I’m not allowed to ask for more info per the response policy.)

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created 13 days ago

  Support Team Fullstack Developer

  Hi,

  The error is about the user, not about the tenant settings. Enabling two factor for a user requires that user to already have a usable verification provider, and there are three:

  • Email, available once Email confirmed is set on the user
  • SMS, available once Phone number confirmed is set (and you have an SMS provider)
  • Authenticator app, which the user sets up themselves from My account > Authenticator app

  You can set the first two from Identity management > Users > Actions > Edit, the Email confirmed and Phone number confirmed checkboxes are there. Once a user has one of them the Two factor modal saves fine. Saving the tenant's Two factor settings doesn't change anything here, that check only looks at the user.

  Forced and Disabled do work, they just don't rewrite the per user flag. The behaviour is applied when the user signs in, while the Enable two-factor column in the user list is the per user setting, which only has an effect when the behaviour is Optional. So the column keeps whatever value it had. Two things tell you the setting is in effect: the Two factor item disappears from the Actions menu for every user, and if you log in as one of them you get the verification step even though the column still shows a cross.

  One thing to sort out before you switch to Forced: a user with no confirmed email, no confirmed phone number and no authenticator can't log in at all, they get sent to the confirm email/phone page first. Only one user in your list has a confirmed email address, so confirm the others before you turn it on.

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel