Event.user.multifactor is Missing for Users With MFA Factors Imported Through Custom Database
Last Updated:
Overview
This article explains why event.user.multifactor may be empty in a Post-Login Action for users who have Multifactor Authentication (MFA) factors set when they are imported through a Custom Database connection.
Applies To
- Custom Database Connection with Automatic Migration enabled
- Post-Login Actions
- Multifactor Authentication (MFA)
Cause
When a user is imported through a Custom Database connection and has MFA factors added to their profile, event.user.multifactor will still be an empty array until the user has completed an MFA challenge.
Solution
There is a backlog item to address this issue. In the meantime, a workaround would be to set an additional app_metadata attribute as part of the Custom Database 'Login' script, and then reference event.user.app_metadata if event.user.multifactor is empty.
Example profile in Custom Database Login script:
return callback(null, {
username: "username",
user_id: "my-custom-db|username@domain.com",
email: "username@domain.com",
email_verified: false,
user_metadata: {
language: "en"
},
app_metadata: {
has_mfa: true
},
mfa_factors: [
{
phone: {
value: "+15551234567"
}
},
]
});
