[Feature Request] Require Users (and admins) to verify themselves with one of their enrolled MFA methods

[ahmedbodi]

Is there (or could there be) an option to:

Once a user has a MFA token enrolled, then force them to authenticate themselves with the token before they get access to the rest of the site. Atleast this way, an admin has to verify themselves before they get access to the settings and such to the site. And a user has to verify themselves before they can change their settings.

[cornelinux]

Yes, this has been there for years:
https://privacyidea.readthedocs.io/en/latest/policies/webui.html#login-mode