Skip to content

[6.1] Allow to force or never force MFA for superusers#46248

Merged
HLeithner merged 8 commits intojoomla:6.1-devfrom
zero-24:forcemfasuperusers
Jan 9, 2026
Merged

[6.1] Allow to force or never force MFA for superusers#46248
HLeithner merged 8 commits intojoomla:6.1-devfrom
zero-24:forcemfasuperusers

Conversation

@zero-24
Copy link
Copy Markdown
Contributor

@zero-24 zero-24 commented Oct 7, 2025

Summary of Changes

Allow to force or never force MFA for superusers too.

Testing Instructions

Go to Users -> Manage -> Options -> Multi-factor Authentication
Check the options "Disable Multi-factor Authentication" and "Enforce Multi-factor Authentication"

Actual result BEFORE applying this Pull Request

Its not possible to force or never force MFA for superusers
image

Expected result AFTER applying this Pull Request

It is possible to force or never force MFA for superusers
image

Link to documentations

Please select:

  • Documentation link for docs.joomla.org:

  • No documentation changes for docs.joomla.org needed

  • Pull Request link for manual.joomla.org:

  • No documentation changes for manual.joomla.org needed

bembelimen
bembelimen previously requested changes Oct 8, 2025
View reviewed changes
zero-24 and others added 2 commits October 8, 2025 11:05
@zero-24 @bembelimen
Update administrator/components/com_users/config.xml
fa0caf0 
Co-authored-by: Benjamin Trenkle <bembelimen@users.noreply.github.com>
@zero-24 @bembelimen
Update administrator/components/com_users/config.xml
3e0b238 
Co-authored-by: Benjamin Trenkle <bembelimen@users.noreply.github.com>
@richard67 richard67 dismissed bembelimen’s stale review October 8, 2025 09:31

Requested changes have been implemented.

@richard67
Copy link
Copy Markdown
Member

richard67 commented Oct 8, 2025

Hmm, not sure if it is a new feature which would have to go into 6.1-dev.

@zero-24 zero-24 changed the base branch from 5.4-dev to 6.1-dev October 8, 2025 17:08
@zero-24
Copy link
Copy Markdown
Contributor Author

zero-24 commented Oct 8, 2025

Done @richard67

@richard67 richard67 changed the title [5.x] Allow to force or never force MFA for superusers [6.1] Allow to force or never force MFA for superusers Oct 8, 2025
@ceford
Copy link
Copy Markdown
Contributor

ceford commented Nov 4, 2025

I can see that Super Users appears in each of the dropdown lists. Can you explain what happens if I select both? Will I lock myself out? Does the wording of the inline description need adjustment?

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46248.

@zero-24
Copy link
Copy Markdown
Contributor Author

zero-24 commented Nov 4, 2025

I can see that Super Users appears in each of the dropdown lists. Can you explain what happens if I select both? Will I lock myself out? Does the wording of the inline description need adjustment?

Good question i have not changed the code so the same will happen when you select both Administrator.

If anything you will not lock you self as that only makes sure that its forced that you have to setup 2FA or not. But in the end it will always be a binary decision.

This is the code so when i understand this correctly than forceing 2FA will win:

joomla-cms/libraries/src/Application/MultiFactorAuthenticationHandler.php

Lines 100 to 114 in d4be2a6

$neverMFAUserGroups = $userOptions->get('neverMFAUserGroups', []);
$forceMFAUserGroups = $userOptions->get('forceMFAUserGroups', []);
$isMFADisallowed = \count(
array_intersect(
\is_array($neverMFAUserGroups) ? $neverMFAUserGroups : [],
$user->getAuthorisedGroups()
)
) >= 1;
$isMFAMandatory = \count(
array_intersect(
\is_array($forceMFAUserGroups) ? $forceMFAUserGroups : [],
$user->getAuthorisedGroups()
)
) >= 1;
$isMFADisallowed = $isMFADisallowed && !$isMFAMandatory;

tecpromotion
tecpromotion approved these changes Dec 29, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@tecpromotion tecpromotion left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @zero-24

@tecpromotion tecpromotion mentioned this pull request Dec 29, 2025
Merged
5 tasks
@tecpromotion
Copy link
Copy Markdown
Contributor

tecpromotion commented Dec 29, 2025

I have tested this item ✅ successfully on 34b30b7

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46248.

@tecpromotion tecpromotion self-assigned this Dec 29, 2025
@muhme
Copy link
Copy Markdown
Contributor

muhme commented Jan 2, 2026

I have tested this item ✅ successfully on 34b30b7

Tested with JBT on currect 6.1-dev

  • Checked before Superusers is not selectable in "Disable Multi-factor Authentication" and "Enforce Multi-factor Authentication"
  • Applied PR with Pat h Tester
  • Tested 'Disable Multi-factor Authentication' Super Users is selectable and saveable
  • Enforce Multi-factor Authentication Super Users is selectable and saveable
    • Multifactore authentication is needed and working on next login
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46248.

@richard67
Copy link
Copy Markdown
Member

richard67 commented Jan 2, 2026

RTC

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46248.

@joomla-cms-bot joomla-cms-bot added the RTC This Pull Request is Ready To Commit label Jan 2, 2026
@HLeithner HLeithner mentioned this pull request Jan 9, 2026
Closed
@HLeithner HLeithner merged commit 0224d28 into joomla:6.1-dev Jan 9, 2026
52 checks passed
@HLeithner
Copy link
Copy Markdown
Member

HLeithner commented Jan 9, 2026

thanks

@joomla-cms-bot joomla-cms-bot removed the RTC This Pull Request is Ready To Commit label Jan 9, 2026
@HLeithner HLeithner added this to the Joomla! 6.1.0 milestone Jan 9, 2026
TLWebdesign added a commit to TLWebdesign/joomla-cms that referenced this pull request Jan 9, 2026
@TLWebdesign
Update config.xml
4cdc63b 
also did the same changes that were made for 6.1 in PR joomla#46248
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tecpromotion tecpromotion tecpromotion approved these changes

@bembelimen bembelimen bembelimen left review comments

Assignees

@tecpromotion tecpromotion

Labels

Feature PR-6.1-dev

Projects

None yet

Milestone

Joomla! 6.1.0

Development

Successfully merging this pull request may close these issues.

8 participants

@zero-24 @richard67 @ceford @tecpromotion @muhme @HLeithner @bembelimen @joomla-cms-bot