Visible error for multifactor options with local auth

[jrozner]

Visible error for multifactor options with local auth

[JoelAtDeluxe]

I can't reproduce this as indicated. If the server only has okta, then no local auth components will render.

I can get a similar error by including both ashirt and okta as valid authentication schemes, and then having a user with only okta auth, plus some additional steps below. We can probably just capture these errors and render a not available message.

steps to generate an error here:

1. login with a user that has local auth (alternate: link a local auth with an okta-only user)
2. go to account settings/authentication methods
3. unlink local auth
4. go to the account settings/security page

A refresh "fixes" this -- as noted above, only the components for the current set of auth schemes load. This only changes on refresh, so components will be out of sync until the user hits the refresh page button.

[JoelAtDeluxe]

On the backend, there's not a lot we can do without leaking user details. On the frontend, I will be putting up a PR that adds a friendlier error message in situations where the frontend thinks it should advertise multifactor auth, but for whatever reason, it cannot. In these cases, this error message will be displayed:
Multifactor Authentication is not available for this account. Please ensure you have linked ASHIRT local authentication. (given that this is only a local auth feature this should be a pretty safe message)

[jrozner]

The reason that it renders is that the user has a local auth scheme that was setup before the switch to only okta. If you add a local auth scheme in then change the auth schemes to only allow okta, the local auth scheme will still exist in the database and the backend will still return it when the /user endpoint is requested so it chooses to render that component.

Edit: one solution might be to filter out auth schemes from the database and only return the ones that are currently enabled for the /user endpoint. This maybe enough to stop the views from rendering.

[JoelAtDeluxe]

There are 2 PRs that address this issue.
PR #149 filters users that have auth scheme linked that are no longer supported. This should prevent the above situation from happening in those situatiions.
PR #148 provides a front end solution. Rather than displaying an error icon and vague error message, we instead display a simple message on error that indicates (As noted in a previous comment) that the feature is simply not available for the user.