Hi, I am trying to set up MFA using email code. The problem I am facing is that I don't do account linking, but use an identity's ID as the 'identity identifier'. This enables users to sign up with an identical email address, albeit different method. I implemented MFA by having this configuration as identity schema:

"id": {
					"type": "string",
					"title": "ID",
					"description": "Combination of provider and provider_id (provider:provider_id)",
					"ory.sh/kratos": {
						"credentials": {
							"password": {
								"identifier": true
							}
						}
					}
				},
				"email": {
					"type": "string",
					"format": "email",
					"title": "E-Mail",
					"minLength": 3,
					"maxLength": 320,
					"ory.sh/kratos": {
						"credentials": {
							"webauthn": {
								"identifier": true
							},
							"code": {
								"identifier": true, // This guy is needed for verification, but breaks registration with same email
								"via": "email"
							}
						}
					}
				},
				"recovery_email": {
					"type": "string",
					"format": "email",
					"title": "Reachable E-Mail",
					"minLength": 3,
					"maxLength": 320,
					"ory.sh/kratos": {
						"credentials": {
							"password": {
								"identifier": true
							}
						},
						"verification": {
							"via": "email"
						},
						"recovery": {
							"via": "email"
						}
					}
				},

With this (MFA) configuration, I cannot sign up anymore with same email. • If I remove the identifiers from code and webauthn, I can register again with a same email, but on login and submitting code Kratos doesn't know to which of the two identities the code belongs to (I guess?) and upon submitting the code it fails with

{
  "id": 4010008,
  "text": "The login code is invalid or has already been used. Please try again.",
  "type": "error"
}

• If I keep the identifiers, I cannot register with same email, but I this error is gone and email code MFA works fine. The question is: How can email code 2FA live next to not using email as identifier for an identity? Any help is welcome.

Hey Zeger, some clarifications about your use case: • Email address is not the identifier (also means emails are not unique), instead you use some string (like a handle/nickname/ID) as identifier • Login and other self-service flows should work through email via code • 2FA should also work through email via code • There can be multiple identities for the same email address Is that correct?

• Correct, I use ID as the identifier as you can see in the snippet • SSO/provider login bypass 2FA, email password requires email 2FA (I have set up pass key as 2FA method as well, but that is only if user configures that through settings) • Yes and this works, but only when code is configured as identifier under email as well, otherwise Kratos will complain with 4010008 (probably because it otherwise doesn't know which identity the code belongs to I guess?) • Yes and this (registering with identical email) works only when I do NOT mark code as identifier under email, otherwise I will get error code 4000007 'this user already exists' (email)

Hey @few-wall-50136 yea I think its not possible really the way you imagine it. But then again it's not really 2FA if you are using the same method for login - it's just 1FA twice - right? So I would recommend passkey or TOTP if you actually want 2FA, otherwise you can also just leave it out, since it doesn't really do anything security-wise. Only workaround I can come up with is using subaddresses - for example you can use

user+google-111@domain

and

user+google-222@domain

- Ory treats these as 2 different unique email addresses but for many(most?) providers it will end up in the same inbox. plus it only really works if you generate the address yourself from provider:provider_id. let me know what you think

Thank you, you're right about email as 2FA is not great. I will get back to what I've decided on