Disable 2FA Options under Enroll dropdown? | authentik | Page 1

#

@exotic plover no 100% sure but iirc every user can enroll any device of which a "Stage Configuration" Flow exists and has access to. so if you go to "Flows and Stages" --> "Flows" --> Scroll down to "Stage Configuration" and select any authenticator you dont want, under "Policy / Group / User Bindings" either explicitly allow a specific group or specifically deny access to the group you dont want to have access to it.
that should disable the specified menu to enroll it if i'm not wrong. give it a shot

#

imo no, wouldnt be unwise. but as always: backup, backup, backup. and you have to be sure you really really dont need it.
the default flows are provided and can be downloaded/imported at any time anyway

#

as long as you dont lock yourself out if authentik goes down... ^^ but i dont really have any flows that i really really dont need, so i would be cautious

#

the famous

//do not touch, magic below

#

i explicitly denied email authenticator for my user and i can still see the option but it wont allow me to create one

#

could be cache or be that way

#

logo

#

i gave up on css

#

as there are so many changes and i have no time to always fix it

#

budget tho ^^

#

ye, i can only get it so far as to not allow it but not to not display it at all. what i did is deleting every configuration stage of everything i dont want. but if you want different authenticators depending on group its not the prettiest but at least working. maybe someone else has a better idea on how to hide it for certain users/groups

#

which configuration flow it should use

#

so if that is empty, it wont display it in the menu for users

#

and if it is configured it will use that flow for the setup

#

ye, took me a while

#

but i understood it faster than keycloak

#

yes

#

but then noone can configure it

#

in theory, yes. i just selected nothing on the "configuration flow" in static keys

#

and now it wont display it

#

the setup stage is more or less the enroll menu

#

and here you tell it which setup flow to use

#

which is the page the user gets to configure it

#

if i understand that correctly

#

i only have "Email Authenticator", "TOTP Device" and "WebAuthn device" so maybe you tried something?

#

ah small correction. you have a flow to configure a totp device. you can use that flow to force a user to configure it on first login for example. that stage has the option "Configuration flow" if that is set, the user can configure it themself. if not, they cant

#

so you can force or offer a user with the flow to configure it on login but need to select a configuration flow for manual setup

#

easiest option: configure the ones you want and delete the others and be done with it. if you want different ones depending on group, play around if the flows and stages with bindings and see if you can hide specific ones. i gtg now tho. hmu if you find out something 😄

#Disable 2FA Options under Enroll dropdown?