MFA not working based off Timezone

mikev

Hey, gave it a try on my machine which is normally in PST
Tried it 6:50PM PST

Screenshot shows 9:50PM so I had my pc in EST when attempting to login

Now that may be an additional issue then not sure. Still kind of figuring this out, MFA off it works fine MFA on it doesnt my account is the default admin during install my guys that work on the east coast are additional admins.

johnny

I think we are going to have set the timezone per user to correct this and not app wide. This will not be a simple fix but we will work out a solution hopefully by the end of the week, but our solution could impact MFA for everyone where everyone will need to reset their MFA.

johnny

Im open to ideas here as well maybe a band aid that will hold us over

johnny

Hey @mikev is this a new problem or was this working for different timezones at one point, im not sure how long you have been using ITFlow

johnny

Hey @mikev I think I fixed this can you please update and test.

I think it had to do with checking if a session was set before assigning the timezone.

itflow-org/itflow8c296de

Bigbug

johnny so then it is a bug…. lol

johnny

Hey @Bigbug yup looks that way.

So the way I tested was

Set MFA with Eastern Time Set in ITFlow App under settings > localization

Logged in changed to UTC and logged out

Tryed logging in MFA wasnt accepted.

Changed timezone back all was good.

This looks like a regression on when we decided to switch to see if there was a active session before setting the timezone, however the timezone was never set at the login portal because a session was never active. We did this so it didnt have keep on setting timezone for every page refresh and querying the db each time.

mikev

Hey Johnny,

To provide a response for some of your questions a bove
First off, thanks for all the help as always I've used ITFlow for a couple or so years now but never with this new deployment I am doing where its on AWS EC2 in East where most of our staff is at and needing Pacific people in as well.

Before it was hosted in my home lab for a little while and only me using it from my local server and never had MFA problem we had it public as well but then again it was just me using it and 1 guy in central but it wasnt a problem then.

Now we have the latest build as of when I opened this thread is how new this instance is and we got pacific and est people trying MFA from the app which is hosted in est and set est it doesn't work.

I've updated to your fix and re-enabled MFA running into the same problem.
We're thinking of just taking it internal using tailscale from AWS to our clients to eliminate the concern overall.

I absolutely love IT flow but I was trying to use this instance to manage a medical group with some access credentials and documentation to keep us organized and without MFA on public instance I cant do that so if its internal it wouldn't be so much of an issue.

johnny

It should be fixed now, I did a bunch of tests on my end. Are sure you have all the latest updates?

mikev

Hi johnny

Yes, see below -

Then trying to login shows with MFA enabled attempted -

Bigbug

mikev did you setup MFA from fresh for this user? try another user?

mikev

Good morning Bigbug
Setup MFA from fresh does not fix it
New "test" account with Admin and MFA setup works just fine
If that does it then perhaps I'll delete my account which is the default admin account from the fresh install and then just keep using the test change it to my email.

Unless @johnny has any "account level" ideas or perhaps something to check in the DB? Given a test fresh account works fine?

johnny

Hey Mike, Instead of doing goto the user table and find your user make user_token NULL using phpmyadmin

Then try settings up MFA again your account.

mikev

johnny

Will do, I'll need to setup phpmyadmin later today and get back to you with this.
Thanks for the help all of you, greatly appreciated 🙂

mikev

johnny

Hey Johnny,
Upon going selecting the user_token I can see my user account token there starting with 64KNS
Change this to "NULL" and then setup MFA again, same issue

Sorry for the delay in getting back to you.

wrongecho_hiatus

mikev

If you're using phpMyAdmin set the field to null/empty, rather than the actual text 'NULL'.

mikev

wrongecho_hiatus

Hello,

So I got it set to NULL with the checkbox not typing in NULL which I confirmed I was doing before (noob mistake) but this time I see what you mean and it works in removing the MFA so I can get back into that admin account without having MFA since it removes it.

Then I re-enable it the same thing happens (repeat of the issue).

at this point I will leave MFA off and may just continue to use my IP based restrictions.

wrongecho_hiatus

@mikev

Reading the thread again, I'm not convinced this is actually a timezone issue. The error message you get isn't the error message for bad MFA and you've said it's fine with another account.

What happens when you login with MFA using a different browser? For now, the form stores the username and password in a hidden field on the page when you have MFA to resubmit it all together in a single request, so it's possible you have a browser extension that's clearing the fields between the initial login attempt and the MFA being entered.

mikev

wrongecho_hiatus

This had me curious now because I use Bitwarden to fill the user/pass then I have to click login. From there im directed to enter an MFA code and normally I use my keys CTRL SHIFT V on the MFA text box it auto fills the current code from bitwarden extension.

SO this is on google chrome and that problem is reproducible on another browser without any autofilling:
-Firefox
-Load up login page
-Copy username from bitwarden > Paste
-Copy password from bitwarden > paste
-Login
-Sent to MFA code screen: Enter in manually typed from seen as shown in bitwarden

Same issue "Incorrect user or password"

So I've ruled out the auto filling and using another browser. Seems weird so initially when I created this thread I had ITFlow on Amazon EC2 and reported a 2nd user but in EST time can login without issue it seemed at first like it was only the main account.

The EC2 I had to eventually take down and just go back to locally hosting where I still have this issue and I didnt migrate from the EC2 I just went fresh install again on Debian 12. Making other test accounts same issue now its weird this behavior im trying to pinpoint it further. It's notable in EC2 I had port 443 / 80 TCP open and the domain can reach it that way.

On the current local setup I am using CloudFlare tunnels and trying to see if this is causing any layer of authentication issue with MFA involved. With MFA off on this current setup all works fine just with MFA on it doesn't work.