Linking OAuthProvider auth/multi-factor-auth-required

[OnlyBjarne]

Operating System

Arch linux

Environment (if applicable)

Firefox 131

Firebase SDK Version

10.14.0

Firebase SDK Product(s)

Auth, Functions

Project Tooling

Vue 3.5 application with Vite 5 ,
Running nodejs blocking functions on beforeSignIn

Detailed Problem Description

We are having problems with linking a new OAuthProvider on existing accounts with MFA (TOTP and SMS)

When an existing user without mfa signs in with OAuthProvider account, we get the auth/account-exists-with-different-credential as expected, and we can do the linking as expected. When the linking is attempted, the blocking function runs and we can block the linking before it is completed.

When an existing user with mfa signs in with OAuthProvider account, we get the auth/account-exists-with-different-credential, but after completing the login step the linkWithCredential function throws another auth/multi-factor-auth-required error, and the accounts are linked with no beforeSignIn execution.

Steps and code to reproduce issue

1. Create new email user with MFA active
2. Start OAuthProvider sign in
3. Catch the auth/account-exists-with-different-credential exception
4. Confirm user by logging in with email credentials
5. Catch the auth/multi-factor-auth-required exception
6. Start provider linking
7. Get another auth/multi-factor-auth-required exception
8. Observe that the accounts have been linked, but not the beforeSignIn function

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[DellaBitta]

Hi @OnlyBjarne,

If I understand your issue correctly, the Firebase JS SDK doesn't provide the mechanisms that invoke the beforeSignIn hooks in Cloud Functions. Instead, that code exists in the Functions service runtime. I recommend opening up a Firebase Support ticket so that the service team can debug the issue.

Let me know if I misunderstood the problem, though. Thanks!

[OnlyBjarne]

Hi @DellaBitta ,
After some more testing i have concluded that the issue seems to be server side.

I'll contact Firebase Support with the information.

Thank you for your time!