Authentik Google

[horner]

This does not seem to matter:

If its connected or not, it seems one can log in with google? Also, it does not use a second factor while doing so?

Lastly, I added a second MFA:

This is both good and bad if we want to enforce the reporting of lost second tokens.

[horner]

Also do we need to make a PR to change the wording for Duo Authenticator? I would welcome making it.

[horner]

FYI goauthentik/authentik#23356

[runleveldev]

If its connected or not, it seems one can log in with google? Also, it does not use a second factor while doing so?

Google should only show "Connected" if you've logged in with Google at least once. If you have and it's still showing disconnected it's likely a bug we'll need to report upstream.

I've explicitly not enabled 2FA for users authenticating with Google to keep the experience simple for users that won't need LDAP (e.g. password + 2fa) access. We trust that Google is doing due diligence for verifying the login. It's relatively simple to enforce 2FA for Google users as well, but this could lead to a "3-factor" login (or more if the user's Google Workspace is using it's own enterprise SSO) which significantly worsens the experience.

Also do we need to make a PR to change the wording for Duo Authenticator? I would welcome making it.

That's upstream with Authentik. From it's perspective MIE Auth is Duo, we've simply implemented the API. I could probably update the name directly in the database, but I don't see the benefit.

I think the only directly actionable item from this issue is enabling 2FA for users that sign-in with Google. Do you want me to do that?