Permission to disable tfa

Help
1

In my custom FE admin system, I am trying to setup a way for a lower level admin role (lower than superadmin) to disable another user’s tfa, if needed (for example someone has lost their phone or auth app). I have created a custom endpoint that posts to ‘/users/[id]/tfa/disable’ and this works, but only if I’m superadmin. Otherwise I get permission error. What collection do I need to give permission to for this? It is obviously not directus_users since admins already have update permission to that. Or is this something that can never have an access policy?

I am the only superadmin for the system and I’d rather not have tfa issues on my support table :wink:

1 Answer

1
2

There’s no built-in way for other users to force reset or override the TFA token. This is currently done on purpose as doing so opens up a large security can of worms. That doesn’t negate your ask though! I’ve jotted down your message as a feature request so we can address this in a better way in the future :slight_smile: Thanks!

Allright, I see. But since people with admin (superadmin) access can do this, there apparently is a permission for this, although I cannot reach it within the access policies. Had all my users been superadmins, there wouldn't be a problem, but for most of my admins, I need a lower setting for many permissions. It would be great if just this particular tfa reset permission would be available to set from somewhere :)

 –

Yeah that's exactly it. Right now a lot of things are linked to this superadmin all-or-nothing flag rather than having a set of more granular system entitlements for things like "allowed to reset other user's TFA". That's the feature request we're tracking :)

 –

So, I've hit another weird Directus decision as it seems. In a perfect world, there is a Super Admin that can do everything and anything. Then there are delegated admins, that can do something. In directus, as I see, you are either Super admin and you can do everything, or you are not and you can't do anything. Talking about security.... I want my "delegated" admin to be able to set Project Name. They can't. Because for some reason they can't access settings even though I explicitely give permission. So I need to give them SuperAdmin access? That's a bigger sec. issue if you ask me. Weird.

 –