Has anyone got the mfa working on self-host?

Yep.

I have mfa_enabled on and my identity schema has it as well for both email and phone. The only thing different is that phone number is optional. Also have a username as another type of identifier. So my identifier is for those 3. But when I go to the aal2, it doesn't show up the 2FA for that user. Am I missing something?

@thankful-secretary-66849 Has the user enabled some form of MFA i.e. totp added to their authenticator app and verified the code.

Not the TOTP but email is verified. The nodes is null.

Let me dig out what I am doing here and my config, 5 min there

Thanks I'll try to compare mine to yours.

@thankful-secretary-66849 Also a resource I found useful was https://github.com/ory/kratos-selfservice-ui-react-nextjs - Basically your should in theory be able to run this against almost any kratos instance and it will present the ui as the user follows the flow. It is a good quick way to test if your install is correct and when adding into your own UI

Yeah I use the API pretty much because it is for a mobile app

Awesome, so this is how I have it down basically POST /auth-api/self-service/login/flows/{flow_id} Content-Type: application/json { "method": "password", "identifier": "[email protected]", "password": "userpassword", "csrf_token": "csrf-token-value" } Thats the inital login, if there is a 2fa login required it should respond with HTTP 422 HTTP 422 Unprocessable Entity { "error": { "id": "security_identity_mfa_required", "code": 422, "status": "Unprocessable Entity" } } When you get the 422 response, the ui should automatically call: POST /auth-api/self-service/login/browser?refresh=false&aal=aal2 Which is a request to upgrade the auth assurance level. Note, it is important here that the user has enabled a 2fa method such as TOTP on their account already. You should be getting someting like this back from your flow request then

"ui": {
      "nodes": [
        {
          "type": "input",
          "group": "totp",
          "attributes": {
            "name": "totp_code",
            "type": "text",
            "required": true
          }
        },
        {
          "type": "input",
          "group": "lookup_secret",
          "attributes": {
            "name": "lookup_secret",
            "type": "text"
          }
        }
      ]
    }

And then post back as normal with your TOTP code. In short that is more or less how I have it worked on the UI side of things. I know from speaking to the mobile devs they do this with a web view on android Of course this is just brief and there is a lot more to it than this, but in a simplified way this is what I have that works, of course the ory guys are free to correct my comment here as I tried to be brief

Looks like I see what the error is. The identity schema I just recently added code. And when I tried a new user the code showed up in the identity. The old users does not have it.

Self hosted I don't think so, but you could do it with the admin api https://www.ory.sh/docs/identities/model/manage-identity-schema#:~:text=If%20you%20are%20self%2Dhosting,Ory%20SDK

Thanks!!

To be honest, I keep my schema really light and push most of the other stuff to downstream systems. Identity is just the uuid then and I can use that downstream to query for what I may need.

True. Yeah and I think it's more flexible to do it that way

No worries, have fun 🙂