The only clue I have found is in #2339451: Occasional bypass of fallback flood protection ..:

"- Go to the test site.
- Use correct login.
- Click "Can't access your account?"
- You now have an infinite number of attempts to guess one of the recovery
codes. "

I have set up TFA and TFA basic plugins to use only TOTP, with Recovery codes as fallback option.

I can log in fine with TOTP, but on the TFA page there is no link to use fallback option(s) anywhere, not even when entering an invalid code on purpose, AND, that normal TFA field does not accept the recovery codes (they are longer than the default 6-digits).

I thought that either we should be able to use the recovery codes in the same TFA input field, or at least get a message with a link to a second TFA form when using an invalid code.
I am not seeing the "Can't access your account?" anywhere. I have tried to put the user login block to show on the path /system/tfa* where the TFA entry is, but that block does not either have such info or links.

Am I missing something obvious? None of the Readme.txt files gives a clue to how to use fallback options either, AFAIKS.

Comments

Leeteq’s picture

Leeteq commented

(FYI - I did get a list of Recovery codes when I set up the TFA for the test user, so I have the codes, just not sure where to use them...)

Leeteq’s picture

Leeteq commented

Hmm, ok, on further investiation, I have found a bug.

The first time I used an admin to add the TFA to the test user account.

After that, I had no idea what to expect, so no "visual reference point".
On the next visit to that page, even with TFA successfully set up (TOTP and Recovery codes as the only fallback),
the security tab for that user was empty.
I could still log in with that user and the created TFA, but two things missing:
a) no information other than the option to establish TFA on the security tab for that user.
b) the "Cannot access your account" button did not show up beside the Verify button.

Then, just to test if in case it was possible to add yet another TFA to the same account (which is desireable and a separate feature request, also related to convenient self-serving reset/disabling of TFA), I tried to creata TFA "again" (as in "one more" for this account).

Then, after setting up a new one, suddenly that Security tab gets filled with information, and now both the "Cannot access your account" button shows up when signing in with TFA, and I can also see the links to get more security codes on the Security tab.

However, the new one replaced the initial (initially working TFA), so this module currently only permits one TFA per acccount, which was what I wanted to test.

So stumbling on this issue while testing for something else may give us a clue to a bug in the registration process.

Leeteq’s picture

Leeteq commented
Category: Support request » Bug report
Priority: Normal » Major
Leeteq’s picture

Leeteq commented
Title: Where is the fallback options meant to appear? » Security tab empty after successful TFA registration, and the TFA verification page lacks the recovery button

Correcting the title now as it appears to be a bug in the registration process.

Leeteq’s picture

Leeteq commented

PS. Ref. my comment above; "I tried to creata TFA "again" (as in "one more" for this account)."

- Notice that just the fact that I was able to see that link to create "new" TFA on the security tab for that user AFTER that same user already had TFA 'partially' working, that indicates that it is showing the wrong information on that page. It showed it as if TFA was not installed for that user (cache refreshing issue?) (hence I had the Add link available), instead of showing the new, valid TFA information for that account.

banviktor’s picture

banviktor commented

Hi @Leeteq,

I'm having trouble replicating the issue.
Here's what I did:

As an administrator

  1. Set up TFA module to use TOTP as default validator, and Recovery codes as the only fallback option.
  2. Created a test user
  3. On test user's Security tab set up both methods (are you sure you didn't click on "Skip and finish" instead of "Save" when setting up Recovery codes?)

As a test user

  1. Tried to log in
  2. TOTP validator appeared, "Cannot access your account" is there

As an administrator test user's Security tab is not empty.

Am I missing something?

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Active » Postponed (maintainer needs more info)

Based on #6, seems like the steps to reproduce are unclear.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Postponed (maintainer needs more info) » Closed (cannot reproduce)

Without more information I guess closing this is the right status.