SSO: Option to skip 2FA on login

[kowalski7cc]

Many IdP already provide the option to enforce authentication using many types of 2FA or passkeys. When it's enabled, user would be prompted two times to provide a second factor to the login, and in many cases it could be the same device/tool.
I think it would be userful to add a setting like SSO_SKIP_2FA for vaultwarden instances to simplify user login.

[stefan0xC]

Why do you have 2FA enabled if you don't need it? I mean it's not required by default, so I don't think that we should have to address this specifically. Bitwarden also says that you don't need to activate the require two-step login policy "if you are using an SSO or identity provider's 2FA functionality".

[kowalski7cc]

I don't have the "require two-step login policy" enabled, but I have them configured on my account for the password based authentication

[stefan0xC]

Ah, okay. So you would only want to skip the 2FA check if you login via SSO? I.e. make the following configurable:

vaultwarden/src/api/identity.rs

Line 278 in 0c6817c

let twofactor_token = twofactor_auth(&mut user, &data, &mut device, ip, client_version, conn).await?;

edit: I have not checked if this can work or if the client would expect a valid TwoFactorToken if TwoFactorProviders is not empty. so this might not even be possible.

[kowalski7cc]

So you would only want to skip the 2FA check if you login via SSO?

Exactly

[kowalski7cc]

Forgot to add the pull #6833

[cwchristerw]

This is partially related to #6211

[schewara]

I am in the same boat here and would love to have a setting where 2FA can be bypassed when already enforced by the Identity provider, as this is the primary reason we have not activated SSO in our environment.

GitLab has an identical mechanism with omniauth_allow_bypass_two_factor

Therefore having a setting available to not have to provide multiple 2FA tokens would be a great usability improvement.