Inform admin that role does not have permission to setup own tfa

It seems that that your users don't have the "setup own tfa" permission. I do agree that maybe that permission should be granted by default to all existing roles at the time of installing the site, as it makes little sense to block users from setting up their own TFA.

I think it should be granted to roles manually so maybe documentation makes the most sense to try to improve this situation.

The use case is that admins on a site should have TFA, but the UX and extra security are not appropriate for the typical end-user roles.

Still, if a user's role makes it mandatory for them to have TFA, they should be granted access to the per-user TFA settings.. The access check should maybe take into account both the "setup own tfa" permission and the "Roles required to set up TFA".

That makes sense to me to harmonize them. Validation on the "roles required" could check that all those roles have the permission.

Can confirm, on a default installation this issue occurs.

Granting "setup own tfa" permission to the required role fixed it.

It would be helpful if we can just display a message after module enabling stating permission need to be explicitly assigned to the roles to setup TFA.

Still, if a user's role makes it mandatory for them to have TFA, they should be granted access to the per-user TFA settings.. The access check should maybe take into account both the "setup own tfa" permission and the "Roles required to set up TFA".

While this was indeed my first though when I accidentally ran into this issue the other day I'm not sure we should run under that assumption.

There is indeed a difference between 'required to have tfa' and 'allowed to make changes to token', just because your required to use TFA doesn't mean your allowed to configure it (though I will admit in most cases this will indeed be true.)

I'm inclined to think this should indeed be a documentation change and if we want to reduce the support burden add a status indication under each role that is available to be required that "Role does not have access to configure own tokens, see permissions" (with a link to the Drupal permissions page) this somewhat tracks with the suggestion from #6

Opened MR based on my suggetions in #6 for the SettingsForm to make it more apparent that the "setup own tfa" permission is often necessary.

The remainder of this issue regarding the messaging that leads the user to the error in the first place is probably best handled in the already open 📌 Users are directed to TFA overview regardless of 'setup own tfa' permission Fixed

Committed to Dev.

Not currently planning on back-porting to 1.x at this time since it involves from constructor changes for what is essentially a feature.

Automatically closed - issue fixed for 2 weeks with no activity.