SSO doesnt appear to Work with 2FA (TOTP)

[b90g]

Description:

Same as mentioned here #2284 but with time based codes.

Environment Information:

• Rocket.Chat Server Version: 3.9.1
• Rocket.Chat App Version: 4.12.1.317
• Device Name: iphone
• OS Version: 14.2

Steps to reproduce:

1. In browser: have a SAML Account at the server and activate 2FA (in this case TOTP)
2. on Phone: try to log in
   2.1 SAML works,
   2.2 then back to SAML... loop

Expected behavior:

Getting asked the time based code.

Actual behavior:

getting back to the SAML login in a loop

Additional context:

its similar maybe the same as the earlier references FIDO issue.. maybe..

[diegolmello]

Can you try on Experimental app from TestFlight?
You can join here https://testflight.apple.com/join/7I3dLCNT
It might have been fixed by #2683 already.

[b90g]

unfortunatly i have no capacity, but will check with next release.

will close and reopen if #2683 wasnt the fix.

[b90g]

Here i am with iOS 4.13.1.

TOTP + SAML still sending me back to SAML. For a brief moment the OTP field was displayed.

Want me to provide a video or so?

[diegolmello]

@b90g Yes, please.

[b90g]

Video.21-01-19.08-17-52.0956.mp4

The first video shows SAML SSO with 2FA activated. I only press the yellow sign in button once and after rocketchat is for a while at the login screen i press the pink login button again which shows that SAML recognized me from my earlier login attempt.

inbetween the first and the second video i disabled the 2fa, it shows that i login with the same SAML-session:

Video.21-01-19.08-18-25.0957.mp4

[diegolmello]

Thanks.
I have a few guesses and we'll take a look.

inbetween the first and the second video i disabled the 2fa, it shows that i login with the same SAML-session:

That's expected. When you login via any 3rd party login (OAuth, SSO), the webview keeps you connected in the same session.
When you logout, the app will ask you if you want to clear your cookies, so you'll be able to login on another SSO session next time.

[b90g]

With email 2FA users have the same behaviour, want me to open another issue for that?

[Gummikavalier]

We are seeing this behavior with RC iOS client 4.15.0.23394 (server version is currently 3.12.3) when TOTP 2FA is enabled, along with Custom Oauth provider.
I assume the issue began after we upgraded to 3.12.0 from 3.9.8 but I'm not sure. Could be security fixes in 3.12.3 too.

Clearing up cookies did not help.

[diegolmello]

Fixed on #2978

[Gummikavalier]

Confirming working in iOS client 4.16.1.23838.