feat: Option to disable 2FA for OAuth users

.changeset/tiny-geckos-kiss.md

@@ -0,0 +1,6 @@
+---
+'@rocket.chat/i18n': minor
+'@rocket.chat/meteor': minor
+---
+
+Added a new setting which allows workspace admins to disable email two factor authentication for SSO (OAuth) users. If enabled, SSO users won't be asked for email two factor authentication.

apps/meteor/app/2fa/server/code/EmailCheck.ts

@@ -28,6 +28,10 @@ export class EmailCheck implements ICodeCheck {
 			return false;
 		}
 
+		if (settings.get('Accounts_TwoFactorAuthentication_Disable_Email_For_OAuth_Users')) {
+			return user?.services?.password?.bcrypt !== undefined;
+		}
+
 		return this.getUserVerifiedEmails(user).length > 0;
 	}
 

apps/meteor/app/2fa/server/code/PasswordCheckFallback.ts

@@ -14,7 +14,7 @@ export class PasswordCheckFallback implements ICodeCheck {
 		// TODO: Remove this setting for version 4.0 forcing the
 		// password fallback for who has password set.
 		if (settings.get('Accounts_TwoFactorAuthentication_Enforce_Password_Fallback')) {
-			return user.services?.password?.bcrypt != null;
+			return user.services?.password?.bcrypt !== undefined;
 		}
 		return false;
 	}

apps/meteor/client/views/account/security/TwoFactorEmail.tsx

@@ -1,15 +1,18 @@
 import { Box, Button, Margins } from '@rocket.chat/fuselage';
-import { useUser, useTranslation } from '@rocket.chat/ui-contexts';
-import type { ComponentProps, ReactElement } from 'react';
+import { useUser, useTranslation, useSetting } from '@rocket.chat/ui-contexts';
+import type { ComponentProps } from 'react';
 import React, { useCallback } from 'react';
 
 import { useEndpointAction } from '../../../hooks/useEndpointAction';
 
-const TwoFactorEmail = (props: ComponentProps<typeof Box>): ReactElement => {
+const TwoFactorEmail = (props: ComponentProps<typeof Box>): JSX.Element | null => {
 	const t = useTranslation();
 	const user = useUser();
 
+	const disableEmail2FAForOAuth = useSetting('Accounts_TwoFactorAuthentication_Disable_Email_For_OAuth_Users');
+	const isOAuthUser = !user?.services?.password?.exists;
 	const isEnabled = user?.services?.email2fa?.enabled;
+	const isAllowed = !isOAuthUser || !disableEmail2FAForOAuth;
 
 	const enable2faAction = useEndpointAction('POST', '/v1/users.2fa.enableEmail', {
 		successMessage: t('Two-factor_authentication_enabled'),
@@ -25,6 +28,10 @@ const TwoFactorEmail = (props: ComponentProps<typeof Box>): ReactElement => {
 		await disable2faAction();
 	}, [disable2faAction]);
 
+	if (!isAllowed) {
+		return null;
+	}
+
 	return (
 		<Box display='flex' flexDirection='column' alignItems='flex-start' mbs={16} {...props}>
 			<Margins blockEnd={8}>

apps/meteor/server/settings/accounts.ts

@@ -31,6 +31,18 @@ export const createAccountSettings = () =>
 				public: true,
 			});
 
+			await this.add('Accounts_TwoFactorAuthentication_Disable_Email_For_OAuth_Users', false, {
+				type: 'boolean',
+				enableQuery: [
+					enable2FA,
+					{
+						_id: 'Accounts_TwoFactorAuthentication_By_Email_Enabled',
+						value: true,
+					},
+				],
+				public: true,
+			});
+
 			await this.add('Accounts_TwoFactorAuthentication_By_Email_Auto_Opt_In', true, {
 				type: 'boolean',
 				enableQuery: [

packages/i18n/src/locales/en.i18n.json

@@ -282,6 +282,7 @@
   "Accounts_TwoFactorAuthentication_By_Email_Code_Expiration": "Time to expire the code sent via email in seconds",
   "Accounts_TwoFactorAuthentication_By_Email_Enabled": "Enable Two Factor Authentication via Email",
   "Accounts_TwoFactorAuthentication_By_Email_Enabled_Description": "Users with email verified and the option enabled in their profile page will receive an email with a temporary code to authorize certain actions like login, save the profile, etc.",
+  "Accounts_TwoFactorAuthentication_Disable_Email_For_OAuth_Users": "Disable two factor authentication via email for OAuth users",
   "Accounts_TwoFactorAuthentication_Enabled": "Enable Two Factor Authentication",
   "Accounts_TwoFactorAuthentication_Enabled_Description": "If deactivated, this setting will deactivate all Two Factor Authentication.  \nTo force users to use Two Factor Authentication, the admin has to configure the 'user' role to enforce it.",
   "Accounts_TwoFactorAuthentication_Enforce_Password_Fallback": "Enforce password fallback",