GAIA Multi-Factor authentication after upgrade to R81.20 Take 99

[Alex-]

I've upgraded an appliance from R81.20 Take 98 to R81.20 Take 99 and connected with an MFA-enabled local administrator.

Since then, it doesn't ask the code anymore for clish (simple username/password), while it still asks it for the WebUI.

I've reset the MFA code as I'm testing the feature before larger deployment but the behaviour stays the same.

WebUI: MFA

clish, with user-matching Expert password: username/password

Expected behaviour or TAC?

[Alex-]

Similar behaviour with another appliance. I created a new administrator with MFA on Take 98, WebUI + Clish ask for MFA.

After Take 99, only WebUI asks the MFA code, Clish is username + password.

[Alex-]

I met another issue after enabling MFA for an account.

Upon clicking the option to generate the code on the login page after turning on the option, there was a delay and got the following notification, approximately: "Failed to generate code, you asked for a code but this is not necessary. You will be redirected to the WebUI". The message isn't entirely correct, I didn't screenshot it.

After trying to log in again, that user was presented with MFA code entry, which of course couldn't be completed as we had no codes, temporal or recovery generated. Another admin account had to be used to reset MFA on that account, which enrolled correctly afterwards.

[Alex-]

Turning it off doesn't work apparently. If I uncheck the value in the WebUI, or set it to "no" in Clish, the WebUI will still ask the MFA code.

After trying both UI/Clish MFA deactivation, "show user <user> two-factor-authentication-state" still shows it as enabled.

Minor point: most activation keywords in clish are "on/off".

For "set user <user> force-two-factor-authentication" this is "yes/no".  So we have to make changes in scripted value matching. 😀

Also, "show configuration" doesn't display the MFA status per user in the global output, the "show user" commands have to be run.

[Alex-]

Seems to be related to the upgrade process and not Take 99.

I installed R81.20 on a VM, upgraded it directly to Take 99 and both WebUI and Clish work with MFA.