Require new users to set up two factor auth during registration

[DanielJoyce]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• This issue affects my Ory Network project.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Describe your problem

There doesn't seem to be a way to force a user to set up 2FA on sign up. There are flags configuring it, you can require the various endpoints to require the highest level of auth ( such as userinfo ), but ory won't force users to configure their 2fa during sign up.

Describe your ideal solution

A way to configure 2FA during registration, or a way to add the setup to the registration flow ( Is this currently possible? It's unclear from flow docs if things like this can be done )

Workarounds or alternatives

None, as we need 2fa during registration

Version

latest

Additional Context

No response

[aeneasr]

It would be expected to solve it like this:

1. Set session aal to highest available
2. Set settings aal to highest available
3. Check if session is aal1, if success redirect to page for 2fa setup using settings flow
4. If session is aal1 but user has 2fa set up, session endpoint gives 403 (i think) - redirect to 2fa login screen
5. If session is aal2 do nothing

This is a relatively easy approach in your middleware (which you'll need anyways to redirect to the 2fa login page!) and you have full control over when to show the screen or not. Adding such a config option to Kratos would just complicate things because now you need policy or adaptive mfa or whatever, because every company wants to solve MFA enrollment differently (some want to wait 7 days, others want to wait 3 days, others want to exclude user group A, and so on ...)

[designermonkey]

Sadly, some of us rely on Ory to help us not think about these things too much, as it's a complex domain.

I don't really understand what the flow is that you've described there, @aeneasr. Would we need to implement that in an app like the self-service example gives us?

• Would it not be feasible to add fields to the identity schema representing the built-in MFA as a requirement? I don't know whether that causes complications or is even possible or not.
• Would it be possible to disallow an account to be 'active' unless the user had completed the MFA settings?

[designermonkey]

Can you clarify what aal means @aeneasr ?

[seeruk]

Hey @designermonkey, you can see some descriptions of Authenticator Assurance Level (AAL) in the docs over here: https://www.ory.sh/docs/kratos/mfa/overview

There are some descriptions of the different authentication methods, which are first or second factors, and what constitutes aal1 and aal2.

[designermonkey]

Thanks @seeruk