Make 2FA enabled, but optional - and how to change 2FA secret once it was applied

[vmario89]

Preflight Checklist

• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for an issue that matches the one I want to file, without success.

Problem Description

Hi,

i tried to enable #3712 and it works very good. But i have questions / feature request for it:

• how to change the 2FA secret, once it was provided. I need to be able to change the secret, in case i lost my secret. therefore some backup codes would be good too
• how to make it optional: i want to enable 2FA globally, but not for every user. i want to make it optional per user. so the user can decide if he/she wants to have a second factor or not. now at the moment, if enabled, everybode is forced to use 2FA
• show the secret plaintext below the QR code in case we have no device to scan it.
• the config settings are not in official docs yet - maybe due to these reasons?

Proposed Solution

see problem description

Alternatives Considered

No response

Additional Information

Dex Version: v2.46.0-20260708110934-ec1a183e
Go Version: go1.26.0
Go OS/ARCH: linux amd64

[nabokihms]

Hello, @vmario89.

1. We have an API method to reset MFA: ResetMFA, but no recovery codes at the moment.
2. For now, there is no such policy. MFA is more like a guard than an optional thing.
3. This one is good.
4. The reason is that it is only in the main branch rn.

[vmario89]

Hey,

thanks for the reply. I see, i had some time more now to work with Dex and configured a lot of static clients.

for 2. point:

i tested MFA with regular TOTP and now also with WebAuthn (FIDO2) using some YubiKey and some self-build FIDO2 key as well. For each method, the registration and login process works very fine.

for making it convenient to the end user finally, buttons/structures in the main menu user interface are required in my opion to change these second factor(s) (remove the 2FA, reset the 2FA, show registered 2FA methods, etc.) - API is good, but is not for end users which do not operate on a shell or even know what it is.

Enforcing 2FA for all users is unrealistic (should be limited to defined groups like admins for instance), but very desired for all "more important" accounts.