It seems 2FA is mutually exclusive with associated accounts:
Why is this?
We’d like our users to add an external OpenID Connect service, but currently they have to make their accounts less secure to do so.
AI-generated summary
The discussion explores why 2FA is incompatible with associated accounts, as 2FA-enforced accounts suppress associated account logins to prevent security risks. KhoiUSA explains that associated accounts can be compromised, bypassing 2FA protections. However, the Enforce second factor on external auth setting can be disabled to allow associated accounts, though this is not recommended unless the external auth system itself enforces 2FA. Additionally, disabling Enable local logins can restrict login to OpenID Connect only, with a warning that users must have alternate login methods configured to avoid being locked out. aidanheerdegen raises concerns about requiring users to reduce security to use external OpenID Connect services.
Well, the reason being is that your associated accounts can also be compromised, and AFAIK associated accounts bypass the 2FA restriction on forum accounts. That is why 2FA suppresses associated accounts. Associated accounts can be compromised, especially without 2FA allowing bad-actors to therefore, log into your forum account as well.
However, there is a site setting you can modify to stop 2FA-accounts from suppressing associated account logins. It’s named Enforce second factor on external auth, switch the setting so it’s unchecked. Unless your external auth enforces 2FA and is secure, then I don’t recommend you disabling this setting.
If you want to have people log in via your OpenID Connect service only, then you can disable the site setting Enable local logins. Keep in mind of the warning stating WARNING: if disabled, you may be unable to log in if you have not previously configured at least one alternate login method.
