Merge 2a4dda3f25 into 32098ca7d1

.env.template

@@ -555,6 +555,12 @@
 ## Optional Master password policy (minComplexity=[0-4]), `enforceOnLogin` is not supported at the moment.
 # SSO_MASTER_PASSWORD_POLICY='{"enforceOnLogin":false,"minComplexity":3,"minLength":12,"requireLower":false,"requireNumbers":false,"requireSpecial":false,"requireUpper":false}'
 
+## Skip Vaultwarden 2FA for SSO/social login: false (never), true (always), auto (only when the IdP returns an MFA ACR/AMR claim)
+# SSO_2FA_SKIP=false
+
+## In auto mode, comma-separated OIDC AMR values that indicate MFA. Set blank to disable AMR matching.
+# SSO_2FA_AMR="mfa,otp,fido2,webauthn,hwk"
+
 ## Use sso only for authentication not the session lifecycle
 # SSO_AUTH_ONLY_NOT_SESSION=false
 

src/api/identity.rs

@@ -353,7 +353,20 @@ async fn sso_login(
         Some((mut user, sso_user)) => {
             let mut device = get_device(&data, conn, &user).await?;
 
-            let twofactor_token = twofactor_auth(&mut user, &data, &mut device, ip, client_version, conn).await?;
+            let skip_2fa = match CONFIG.sso_2fa_skip().as_str() {
+                "true" => true,
+                "auto" => {
+                    let amr_values = CONFIG.sso_2fa_amr_vec();
+                    user_infos.acr.as_deref() == Some(sso::SSO_2FA_ACR)
+                        || user_infos.amr.as_ref().is_some_and(|amr| amr.iter().any(|method| amr_values.contains(method)))
+                }
+                _ => false,
+            };
+            let twofactor_token = if skip_2fa {
+                None
+            } else {
+                twofactor_auth(&mut user, &data, &mut device, ip, client_version, conn).await?
+            };
 
             if user.private_key.is_none() {
                 // User was invited a stub was created

src/config.rs

@@ -845,6 +845,10 @@ make_config! {
         sso_auth_only_not_session:      bool,   true,   def,    false;
         /// Client cache for discovery endpoint. |> Duration in seconds (0 or less to disable). More details: https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect#client-cache
         sso_client_cache_expiration:    u64,    true,   def,    0;
+        /// Skip 2FA for SSO/social login |> `false` keeps Vaultwarden 2FA, `true` always skips it, `auto` skips it only when the IdP returns an MFA AMR or ACR claim
+        sso_2fa_skip:                   String, true,   def,    "false".to_owned();
+        /// SSO 2FA AMR values |> Comma-separated AMR values that satisfy `SSO_2FA_SKIP=auto`
+        sso_2fa_amr:                    String, true,   def,    "mfa,otp,fido2,webauthn,hwk".to_owned();
         /// Log all tokens |> `LOG_LEVEL=debug` or `LOG_LEVEL=info,vaultwarden::sso=debug` is required
         sso_debug_tokens:               bool,   true,   def,    false;
     },
@@ -1116,6 +1120,10 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
         validate_sso_master_password_policy(cfg.sso_master_password_policy.as_ref())?;
     }
 
+    if !matches!(cfg.sso_2fa_skip.as_str(), "false" | "true" | "auto") {
+        err!("`SSO_2FA_SKIP` must be one of: false, true, auto");
+    }
+
     if cfg._enable_yubico {
         if cfg.yubico_client_id.is_some() != cfg.yubico_secret_key.is_some() {
             err!("Both `YUBICO_CLIENT_ID` and `YUBICO_SECRET_KEY` must be set for Yubikey OTP support")
@@ -1708,6 +1716,10 @@ impl Config {
     pub fn sso_authorize_extra_params_vec(&self) -> Vec<(String, String)> {
         url::form_urlencoded::parse(self.sso_authorize_extra_params().as_bytes()).into_owned().collect()
     }
+
+    pub fn sso_2fa_amr_vec(&self) -> Vec<String> {
+        self.sso_2fa_amr().split(',').map(str::trim).filter(|v| !v.is_empty()).map(str::to_owned).collect()
+    }
 }
 
 use handlebars::{

src/db/models/sso_auth.rs

@@ -35,6 +35,8 @@ pub struct OIDCAuthenticatedUser {
     pub email: String,
     pub email_verified: Option<bool>,
     pub user_name: Option<String>,
+    pub acr: Option<String>,
+    pub amr: Option<Vec<String>>,
 }
 
 impl_FromToSqlText!(OIDCAuthenticatedUser);

src/sso.rs

@@ -17,6 +17,8 @@ use crate::{
     sso_client::Client,
 };
 
+pub const SSO_2FA_ACR: &str = "2";
+
 pub static FAKE_SSO_IDENTIFIER: &str = "00000000-01DC-01DC-01DC-000000000000";
 
 static SSO_JWT_ISSUER: LazyLock<String> = LazyLock::new(|| format!("{}|sso", CONFIG.domain_origin()));
@@ -305,6 +307,10 @@ pub async fn exchange_code(
         email: email.clone(),
         email_verified,
         user_name: user_name.clone(),
+        acr: id_claims.auth_context_ref().map(|acr| acr.as_str().to_string()),
+        amr: id_claims
+            .auth_method_refs()
+            .map(|amr| amr.iter().map(|method| method.as_str().to_string()).collect()),
     };
 
     debug!("Authenticated user {authenticated_user:?}");

src/sso_client.rs

@@ -202,6 +202,21 @@ impl Client {
             .add_scopes(scopes)
             .add_extra_params(CONFIG.sso_authorize_extra_params_vec());
 
+        if CONFIG.sso_2fa_skip() == "auto" {
+            auth_req = auth_req.add_extra_param(
+                "claims",
+                serde_json::json!({
+                    "id_token": {
+                        "acr": {
+                            "essential": true,
+                            "values": [crate::sso::SSO_2FA_ACR]
+                            }
+                        }
+                })
+                .to_string(),
+            );
+        }
+
         if CONFIG.sso_pkce() {
             auth_req = auth_req
                 .add_extra_param::<&str, String>("code_challenge", client_challenge.clone().into())