We have a user with 2FA enabled, and we cannot disable it for them. Clicking the ‘Disable’ button on their account gives us: [image] (You supplied invalid parameters to the request: Discourse::InvalidParameters) There is no row in the users_second_factors table for the user_id. I’ve tried adding a dummy row, which lets me click the ‘Disable’ button without error, but just deletes my dummy row and still leaves 2FA enabled for the user. I’ve also tried the rake users:disable_2fa[username] rake task, which says 2FA disabled for user, but still shows Two Factor Authentication: Yes on the user’s profile in admin. Anything else I can try?

Try via the rails console: [image] Disable 2FA via console Self-Hosting bookmark This guide provides instructions for administrators on how to disable two-factor authentication (2FA) via the console. person_raising_hand Required user level: System Admin wrench Console access required warning This guide should only be used when 2FA cannot be disabled from the user admin page. [image] Discourse supports three types of 2-factor options: TOTP (6-digit codes rotating every 30 seconds), security key (Yubikey, biometric, etc.), and backup codes. Sometimes…

It’d also be good to know what version of Discourse you are running. There have been fixes for the inability to disable 2FA via the UI since the first release of 2FA.

Thanks @omarfilip .. I did the UserSecondFactor delete but didn’t know about UserSecurityKey. This user had no UserSecondFactor record, but they did have a UserSecurityKey record. Once I removed that, their profile shows ‘Two Factor Authenciation: No’ – thanks! @jomaxro We’re on 2.5.0.beta4 ( 8d3900c6da ) Seems like there still is an issue where I should be able to do this via the UI, but get the invalid parameters issue, possibly due to the missing UserSecondFactor record?

[image] Brandon_Martus: @jomaxro We’re on 2.5.0.beta4 ( 8d3900c6da ) That version is old and unsupported, update as soon as possible.

Besides being old and unsupported, you’re also missing over a dozen security fixes, so your site is vulnerable. Please do upgrade.

Cannot disable 2FA for User

Product Support

omarfilip February 4, 2021, 10:35pm 2

Try via the rails console:

Topic		Replies	Views
Disable 2FA via console Self-Hosting how-to	0	2846	April 17, 2020
Turn off two factor authentication Product Support	4	1413	July 8, 2020
Command line disable Two Factor Authentication Product Support	12	2431	March 25, 2020
Task "users:disable_2fa" does not disable security keys Bug	3	440	March 8, 2023
Locked out of own forum. Asking for two-factor verification I never set up. Help : ) Product Support	6	683	September 30, 2022

Cannot disable 2FA for User

Related topics