MFA not working based off Timezone

mikev

Hello,
I had the same issue as in:
https://forum.itflow.org/d/1250-mfa-suddenly-stopped-working-for-the-admin-account

the mysql query was tried and didnt work to clear MFA to get back in
I had a backup admin account to disable MFA so I Could at least try again

Every time I enable MFA it simply keeps saying incorrect user / password
We really need MFA as a requirement to use ITFlow securely can anyone suggest where to look closer at this issue or solution for this?

Thanks!

mikev

tailing the access log shows like this so no outstanding errors from there:

Generated an MFA from the affected admin account

MYCLIENTIPHERE - - [23/Nov/2024:20:02:49 -0500] "GET /plugins/barcode/barcode.php?f=png&s=qr&d=otpauth://totp/ITFlow:myemailwashere?secret=mysecretwashereinthelog(scrubbed) HTTP/1.1" 200 1578 "https://itflow.mydomain.com/user_security.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"

Logged out to test mf

MYCLIENTIPHERE - - [23/Nov/2024:20:02:58 -0500] "GET /post.php?logout HTTP/1.1" 302 976 "https://itflow.mydomain.com/user_security.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"

MYCLIENTIPHERE - - [23/Nov/2024:20:02:58 -0500] "GET /login.php HTTP/1.1" 200 1351 "https://itflow.mydomain.com/user_security.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"

MYCLIENTIPHERE - - [23/Nov/2024:20:03:01 -0500] "POST /login.php HTTP/1.1" 200 1784 "https://itflow.mydomain.com/login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"

After that above to entries, nothing else so I dont have anything to go off of with that log.
Tailing the error.log when attempting to login shows:

Tailing the error log did not show anything during login attempt

Any other suggested logging I can review to why the login is invalid only when MFA is on?
Yes, before logging out after setting MFA I did "Verify" and it was shown as "Successful"

Invalid message I get after entering in the MFA code -

mikev

I have noticed that if I make a admin user additionally for one of my guys logging in from New York which is EST time zone same as the server's set time zone MFA works fine.

My account is in PST (Pacific) any suggestions if perhaps timezone being the issue and make it work for any timezone?

Bigbug

mikev it makes sense it's a time issue, as the MFA is based on time

Change your computers timezone to EST and try to login

Bigbug

mikev

Bigbug Change your computers timezone to EST and try to login

try it out just for troubleshooting

Alan

The other thing about MFA, is make sure the server running ITFlow and your machine are accurate within a second, to real time. Most don't realise how crucial time is to systems, and as MFA codes are time dependent, if you've slipped by a minute or two, this will break MFA (not just ITFlow).

mikev

Hey all,

Thanks for the feedback server itself Debian 12 VM I ran the timedatectl and sync all looks good and its in EST time
My guys in EST time on their PCs can use MFA fine
Here on Pacific though or other TZs its a no go
I cant ask people to change their PCs TZ to EST just to get thru MFA i'd like to venture any other ideas?

Can we do anything else with MFA configuration or deployment to make it more universal?

I only say this because there's a lot of applications out there that serve MFA setups for any TZ across the board how do they do it? (Microsoft 365 login, Google G Suite, Facebook, big apps that allow me to setup time based OTP with those just work)… Can I somehow accomplish this with ITFlow?

mikev

Hey, gave it a try on my machine which is normally in PST
Tried it 6:50PM PST

Screenshot shows 9:50PM so I had my pc in EST when attempting to login

Now that may be an additional issue then not sure. Still kind of figuring this out, MFA off it works fine MFA on it doesnt my account is the default admin during install my guys that work on the east coast are additional admins.

johnny

I think we are going to have set the timezone per user to correct this and not app wide. This will not be a simple fix but we will work out a solution hopefully by the end of the week, but our solution could impact MFA for everyone where everyone will need to reset their MFA.

johnny

Im open to ideas here as well maybe a band aid that will hold us over

johnny

Hey @mikev is this a new problem or was this working for different timezones at one point, im not sure how long you have been using ITFlow

johnny

Hey @mikev I think I fixed this can you please update and test.

I think it had to do with checking if a session was set before assigning the timezone.

itflow-org/itflow8c296de

Bigbug

johnny so then it is a bug…. lol

johnny

Hey @Bigbug yup looks that way.

So the way I tested was

Set MFA with Eastern Time Set in ITFlow App under settings > localization

Logged in changed to UTC and logged out

Tryed logging in MFA wasnt accepted.

Changed timezone back all was good.

This looks like a regression on when we decided to switch to see if there was a active session before setting the timezone, however the timezone was never set at the login portal because a session was never active. We did this so it didnt have keep on setting timezone for every page refresh and querying the db each time.

mikev

Hey Johnny,

To provide a response for some of your questions a bove
First off, thanks for all the help as always I've used ITFlow for a couple or so years now but never with this new deployment I am doing where its on AWS EC2 in East where most of our staff is at and needing Pacific people in as well.

Before it was hosted in my home lab for a little while and only me using it from my local server and never had MFA problem we had it public as well but then again it was just me using it and 1 guy in central but it wasnt a problem then.

Now we have the latest build as of when I opened this thread is how new this instance is and we got pacific and est people trying MFA from the app which is hosted in est and set est it doesn't work.

I've updated to your fix and re-enabled MFA running into the same problem.
We're thinking of just taking it internal using tailscale from AWS to our clients to eliminate the concern overall.

I absolutely love IT flow but I was trying to use this instance to manage a medical group with some access credentials and documentation to keep us organized and without MFA on public instance I cant do that so if its internal it wouldn't be so much of an issue.

johnny

It should be fixed now, I did a bunch of tests on my end. Are sure you have all the latest updates?

mikev

Hi johnny

Yes, see below -

Then trying to login shows with MFA enabled attempted -

Bigbug

mikev did you setup MFA from fresh for this user? try another user?