totp and lookup_secrets - can they be used in parallel?

[KajsaEklof]

Hi, we've trying to configure the TOTP and Lookup Secrets for the self service flows. We’re wondering if users should be able to set up the two 2FA methods in parallel? So that they can use the lookup_secrets (recovery codes) as a back up 🔒

We’ve added both to our kratos config and we’re able to set the 2FA using totp when logged in using submitSelfServiceSettingsFlow and passing in a SubmitSelfServiceSettingsFlowWithTotpMethodBody flow body. This works great and we’re able to use it to log in 👍

We also want to add recovery codes (lookup secrets) parallel to the totp 2FA. So that if a user has lost access to their totp device they can use their codes. When a user adds 2FA (totp) to their account we want to generate the codes automatically and add them as a backup to that account. We’re able to generate the recovery codes and confirm them by calling submitSelfServiceSettingsFlow and passing in a SubmitSelfServiceSettingsFlowWithLookupMethodBody but after that they seem to be set as the only option for 2FA?

When we next try to login the only option for 2FA is to use the recovery codes. We’re only getting the lookup_secrets nodes back in the flow ui and no totp nodes. How can we configure this or change they way we set the recovery codes for the users so that they can be used as a back up to the totp? 🙏

We would like to achieve a similar set up to this loockup secrets example in the documentation.

Here is the kratos config:

selfservice:
  default_browser_return_url: http://127.0.0.1:8084/
  whitelisted_return_urls:
    - http://127.0.0.1:8084/

  methods:
    profile:
      enabled: true
    password:
      enabled: true
    link:
      enabled: true
      config:
        lifespan: 15m
    oidc:
      enabled: true
      config:
        providers:
          - id: github
 DO NOT CHANGE IT ONCE SET!
            provider: github
            client_id: [REDACTED]
            client_secret: [REDACTED]
            mapper_url: file:///etc/config/kratos/oidc.github.jsonnet
            scope:
              - user:email
          - id: google
DO NOT CHANGE IT ONCE SET!
            provider: google
            client_id: [REDACTED
            client_secret: [REDACTED]
            mapper_url: file:///etc/config/kratos/oidc.google.jsonnet
            scope:
              - email
              - profile
            requested_claims:
              id_token:
                email:
                  essential: true
                email_verified:
                  essential: true
                given_name:
                  essential: true
                family_name: null
                hd: null # If you want the G Suite domain
    totp:
      enabled: true
      config:
        issuer: Comnoco.io
    lookup_secret:
      enabled: true

[KajsaEklof]

We cleared all the identities in our database and tested this again today and it's now working as expected! We get both the options of using totp or lookup_secrets when going through the second 2FA challenge to log in. Must have done something wrong before! 😳