[Defender Pro] Defender Pro 2FA required even if the role is unchecked.

2FA isn’t working like I expected. I setup a site and set what user roles could use 2FA, but did not include all of those in the Force Authentication section. However a user with the role that is not forced is still being forced to activate 2FA for their profile.

  • Adam
    • Support Gorilla

    Hello jhanten

    I hope you’re well today!

    By the screenshots, only Administrator and Editor should be “forced” to use 2FA while Author, Contributor and Community Leader they should only see the option to enable 2FA in their profiles (though once they enable they’ll need to set it up). Subscriber should be be able to login without 2FA at anytime and shouldn’t have an option to enable it.

    However, I just tested it on my own setup and it seems we’re dealing with a bug here. With the “force” option turned off it works as expected – only the selected roles have an option to set 2FA and it’s optional for them, they don’t have to use it. With the “Force” option enabled all user roles that are allowed to use 2FA are also forced to use it.

    I’ve reported it to our developers as a bug so they would look into it and provide a fix. Please keep the plugin up to date and please also keep an eye on this ticket in case I had any additional information for you before a fix is released.

    Best regards,
    Adam