Upgrade to Nextcloud 15 can lockout user when OTP provider App is disabled

[IteDas]

Steps to reproduce

1. Use offical 2FA
2. Upgrade to nextcloud 15
3. Log-Out
4. Try to log in

Expected behaviour

2FA should be disabled when app is disabled

Actual behaviour

Message shown stating that 2FA is enforced (it is not) and not 2FA provider can be selected contact admin.

Server configuration

Operating system:
Debian Stretch 9.6

Web server:
Apache 2.4.37

Database:
Maria DB 10.0.1.37

PHP version:
PHP 7.0.33-0+deb9u1

Nextcloud version: (see Nextcloud admin page)
15.0.0

Updated from an older Nextcloud/ownCloud or fresh install:
Update

Where did you install Nextcloud from:
offical rep

[mnowiasz]

Yes, ran into this, too.

I was finally able to solve this issue (hadn't any backup codes, so I was unable to login as admin) by:

php occ app:update twofactor_totp
php occ app:update twofactor_u2f
php occ app:enable twofactor_totp
php occ app:enable twofactor_u2f

Good luck to all those poor guys who haven't got shell access to their instance.

This is the second time Nexcloud bit me hard using 2FA (the first time was when changing the password made all application password invalids - no warning at all), so I'm really not amused, to put it mildly.

[rullzer]

2FA should be disabled when app is disabled

No it should not. If you enable 2FA on your account it should be enforced for your account.

I was finally able to solve this issue (hadn't any backup codes, so I was unable to login as admin)

Well there is a reason having backup codes is always adviced.

This is the second time Nexcloud bit me hard using 2FA (the first time was when changing the password made all application password invalids - no warning at all), so I'm really not amused, to put it mildly.

That is not related to 2FA. It was a limitation of our earlier apptokens. This should all be solved with NC15.

[timmersr]

php occ app:update twofactor_totp
php occ app:update twofactor_u2f
php occ app:enable twofactor_totp
php occ app:enable twofactor_u2f

This is the second time Nexcloud bit me hard using 2FA (the first time was when changing the password made all application password invalids - no warning at all), so I'm really not amused, to put it mildly.

Thanks for the work-around! Also #12510

I really like Nextcloud, but it would IMHO greatly benefit by pauzing developing new innovations, and first focussing on solving (all) outstanding bugs.

[ChristophWurst]

Duplicate of #11102