How do I enable Associated Accounts with 2FA?

Support
1

On my site (https://discuss.openedx.org), I don’t see Associated Accounts when I go to edit my profile, like I do when I edit my profile here. But I can’t see anything in settings or plugins that looks like something I have to enable. What am I missing?

3

It’s suppressed when 2FA is enabled.

4

Maybe the problem here is I’m misunderstanding what they are for. I wanted a way for people to add their Twitter and GitHub accounts so that other users could see them. For example, to follow people they meet in the forum.

But it’s becoming clearer that the fields I see in my profile here are really only for authentication, and so are not displayed to others. In fact, in the admin panels, they are treated with the same secrecy as email address, with an explicit button to view.

If I want publicly visible Twitter and GitHub handles, do I have to add them as custom user fields myself?

5

Traditionally that is done in the About Me field as free text, so yes.

6

You can try Link custom user field to external website if that is what you need.

7

Although a necro bump, this is super relevant and at the top of Google right now:

Is there a 2020 solution for this? Currently, existing forum users that donate via Patreon are locked out from any Discourse rewards. This is a pretty big problem since 2FA is super important and growing in popularity (as it should). We don’t want users to essentially be punished for adding 2FA~

Can’t we just get users to confirm 2fa before connecting any link? It seems outlandish to just remove this feature completely. I have 2FA enabled on Discord, too, for example – should I not be able to connect any account after that?

8

The Patreon plugin doesn’t need the social login for it to work. As long as the email match, local logins will work just as fine and the emails will be assigned to their correct groups.

9

Ohhhh… can we add that to Patreon OP? That’s pretty important. I couldn’t figure out why this guy couldn’t get linked and didn’t know where to turn. This may help others~

However, associated account linking is still pretty nice - some would even say necessary. I’m sure not everyone uses the same email for everything (I don’t) for different reasons. Some may also use aliases (eg, me+someAlias@gmail.com):

Can we get associated account linking even when someone 2FA’s up? Feels like a pretty big downgrade considering how important 2FA is; not the most encouraging to enable it if you lose features.

11

@dylanh724, that’s my situation. I don’t merely utilise RFC 5233 sub-addresses, but different local parts (albeit, with the same subdomain) per service:

Others utilise different local parts and a generic domain that doesn’t relate to them, for which this cannot even theoretically be supported any other way.

Consequently, I want to explain that the undermentioned is nonsensical:

I’ve 2FA enabled. Currently, via TOTP, but shall be via CTAP1, when the undermentioned has been resolved:

This is solely for username-plus-password entry. Instead, I’ve also CTAP2 1FA active for the account. It’s also active for all possible OAuth alternatives, thereby rendering the stated rationale for preventing connecting alternative SSO options quite outdated.

It’s also quite confusing for someone who isn’t aware of the restriction:

Consequently, I advise that this not be the default, especially whilst the undermentioned remains:

That, plus the general dissuasion toward 2FA, means that it’s a net security negative.