Temporarily disable MFA for a user about django-allauth HOT 3 OPEN

Could you add a little bit more background on the use case? Under what circumstances would you want to make use of this?

from django-allauth.

Thanks for the fast reply!

We have an application where 2FA is mandatory for all users. However the administrator of that system should have the ability to disable it for individual users (for various reasons). If the admin disables it and then later enables it again, ideally the user should not go through the setup process again but just use his already configured authenticator app.

At the moment I am hacking around this issue by creating a backup copy of the users Authenticator on disable and then restore it again on enable. But it would be nicer if this was just a flag in the Authenticator

Up to now I have used the django-two-factor-auth package for 2FA, which had exactly this feature, but I switched to allauth now because I like your package much better 😀

from django-allauth.

I am really curious what these "for various reasons" are. Could you elaborate there? I think we need to have a good rationale for a feature like this.

Also wondering, how does this affect what the user sees on screen? I get that the user does not see 2FA kicking in when signing in, but if the user visits the 2FA setup and overview screen, what happens then? Does it appear as if no 2FA is enabled, or do they actually see it is setup but disabled?

from django-allauth.