2FA sync via Cloudron Connector not working

[Teiluj]

Hi - It seems as we are facing a recent issue with regards to 2FA in a setup where one cloudron server is used as the identity provider and other cloudron servers sync with this IDP cloudron server.

Similar to here, please consider the following setup:

In case of 2 Cloudron servers connecting user directories, the docs tells us:

The Cloudron connector is the only one that supports 2FA. If the user has 2FA setup in the Cloudron LDAP Server, then 2FA is required to login

So in practice, in the setup:

• Cloudron Server A (CSA) is the one owning the user directory. CSA has 2FA enabled / requires users to set up >2FA.
• Cloudron Server B (CSB) user directory is connected with CSA via the "Cloudron connector" (External Directory connection provided by Cloudron)

Until recently, when logging on the CSB server, a "synced-user" was prompted for username, password and then 2FA

Recently (unfortunately, I am not able to pinpoint when exactly this started) however, synced-users are only asked for username and password and not 2FA anymore.

It currently seems as the Cloudron connector does not support 2FA anymore.

Is there anything I should look into to make sure that the "2FA sync" when using the cloudron connector works again?

[james]

Hello @teiluj
Thanks for reporting.
It could be that the CSA remembers the 2FA status and propagates it to the CSB, thus the 2FA not needed when CSA already validated that.

But that is an assumption. We will have to look into reproducing this.

[Teiluj]

In troubleshooting the following https://forum.cloudron.io/topic/15562/2fa-sync-via-cloudron-connector-not-working?_=1780301632476 last week:

• I enabled local 2FA on the "child" cloudron server (CSB)
• I attempted to login on CSB using a synced user.
• This leads CSB to ask to register for MFA (and in that instance create a passkey)
  Having completed the test (and seeing that the "synced user" did not carry the 2FA from the parent Cloudron server - CSA - but rather was forcing to create a new 2FA/passkey for the synced user), I then turned off the enabling/enforcing of 2FA on CSB.

Right now, when this synced user (from CSA) attempt to log into CSB, username / password works fine. However he is prompted to use a passkey which only exists on CSB and which does not correspond to his MFA/passkey from CSA

Because it is a synced user ("synced from the external LDAP directory") there is also no option to reset his local MFA/passkey.

Not too sure how to process from here. Any suggestions?

[james]

Hello @teiluj
I have merged the topics together since this will be related.

Interesting, indeed.
Since passkeys are bound to the domain, a Cloudron doing auth over another Cloudron how that should be handled is something we have to look into.
Thank you very much for working on this and giving us more insights.

[james]

Hello @teiluj
We have reproduced the issue with TOTP.
A fix will be supplied soon.

[girish]

@teiluj thanks for the great report. I have fixed this now. Unfortunately, it's a series of changes, so cannot be applied easily. Fix will be part of next Cloudron release.

[Teiluj]

Teiluj said:

Right now, when this synced user (from CSA) attempt to log into CSB, username / password works fine. However he is prompted to use a passkey which only exists on CSB and which does not correspond to his MFA/passkey from CSA

Because it is a synced user ("synced from the external LDAP directory") there is also no option to reset his local MFA/passkey.

Not too sure how to process from here. Any suggestions?

Apologies for bringing this up again but I do not think that the fix has been released for this yet and this is now creating major challenges.

How can I clear CSB-defined passkey for a given LDAP-synced from CSA user on CSB?

Hopefully this makes sense. Grateful in advance for any hints/help on this.

[Teiluj]

What is the way to clear 2FA (including passkey) for a given user?

If I stop the LDAP sync, clear the 2FA for the related user on CSB and restart the sync, would this get around the issue for now?

I know that @staff are working on Cloudron 10 and I am looking forward to this, but not having a working 2FA for Cloudron synced user and OIDC enabled apps is somewhat of a security concerns of importance,I would argue.

[james]

Hello @teiluj
The fix is included in Cloudron version 10.

[Teiluj]

@james said:

Hello @teiluj
The fix is included in Cloudron version 10.

Hi @james - The release of the fix with v10, I understood. But I am not certain you can share a date for when v10 will be out, or can you (I see this is the demo server already!)?

OK so for the record, the following worked to re-enable the user to access the app:
With a local (i.e. non-LDAP-synced) admin user on CSB

• Disable the LDAP sync on CSB
• Impersonate the impacted user on CSB
• While logged in CSB as the impacted user, go to profile and disable TOTP/passkey as required
• Logout from CSB as the impacted user
• Login on CSB as the local admin user
• Re-enable/reset the LDAP sync with CSA

This would have been a lot faster, less complicated if an admin user had the possibility to reset TOTP/Passkey for other users.
Could this be made as a feature request?

Something like the following would be great