Piston Awesome
Piston Awesome

Reputation: 31

Can't enroll for using TOTP MFA inside gcloud Identity platform for multi-tenants

On Google Identity Platform we have multi-tenants, TOTP is enabled:

    curl -X GET "https://identitytoolkit.googleapis.com/v2/projects/xxx/tenants/xxx"     -H "Authorization: Bearer $(gcloud auth print-access-token)"     -H "Content-Type: application/json"     -H "X-Goog-User-Project: xxx"
{
  "name": "projects/xxx/tenants/xxx",
  "displayName": "xxx",
  "allowPasswordSignup": true,
  "enableEmailLinkSignin": true,
  "hashConfig": {
    "algorithm": "SCRYPT",
    "signerKey": "xxx",
    "saltSeparator": "xxx",
    "rounds": 8,
    "memoryCost": 14
  },
  "mfaConfig": {
    "providerConfigs": [
      {
        "totpProviderConfig": {
          "adjacentIntervals": 5
        },
        "state": "ENABLED"
      }
    ]
  },
  "inheritance": {}
}

Now if I want to enroll it, I'm getting 400 error: Documentation https://cloud.google.com/identity-platform/docs/reference/rest/v1/accounts/update

POST https://identitytoolkit.googleapis.com/v1/accounts:update Body

    {
  "tenantId": "xxx",
  "targetProjectId": "xxx",
  "mfa": {
    "enrollments": [
      {
        "displayName": "My TOTP",
        "mfaEnrollmentId": "totp",
        "totpInfo": {}
      }
    ]
  },
  "localId": "xxx"
}

Response:

    {
  "error": {
    "code": 400,
    "message": "UNSUPPORTED_SECOND_FACTOR : attempting to add a new TOTP enrollment",
    "errors": [
      {
        "message": "UNSUPPORTED_SECOND_FACTOR : attempting to add a new TOTP enrollment",
        "domain": "global",
        "reason": "invalid"
      }
    ]
  }
}

The same result if I'm using Golang Firebase v4 Admin SDK

Do anyone know anything about the problem? It looks like TOTP is impossible to use, even in UI only available MFA SMS, but not TOTP

Upvotes: 0

Views: 112

Answers (0)

Related Questions