Skip to content

MFAClient.challenge assumes challenge_type should be oob breaking totp authentication challenging  #1262

Description

@cswelin

Checklist

Description

When challenging an otp authenticator the SDK using MFAClient.challenge errors with

▿ MfaChallengeError(code: unsupported_challenge_type, message: User does not have any enrolled authenticator with the supported challenge type (oob), statusCode: 401)
  ▿ info : 2 elements
    ▿ 0 : 2 elements
      - key : "error"
      - value : unsupported_challenge_type
    ▿ 1 : 2 elements
      - key : "error_description"
      - value : User does not have any enrolled authenticator with the supported challenge type (oob)
  - code : "unsupported_challenge_type"
  - statusCode : 401

This is caused by the challenge function assuming the challenge_type should be oob

 func challenge(with authenticatorId: String, mfaToken: String) -> any Requestable<MFAChallenge, MfaChallengeError> {
        let url = URL(string: "mfa/challenge", relativeTo: self.url)!
        var payload: [String: Any] = [:]
        payload["client_id"] = clientId
        payload["challenge_type"] = "oob" <-- hard coded oob
        payload["authenticator_id"] = authenticatorId
        payload["mfa_token"] = mfaToken
        return Request(session: session,
                       url: url,
                       method: "POST",
                       handle: mfaChallengeDecodable,
                       parameters: payload,
                       logger: logger,
                       auth0ClientInfo: auth0ClientInfo)
    }

Reproduction

Add an otp authenticator and attempt to challenge against it using MFAClient.challenege

Additional context

No response

Auth0.swift version

3.0.0, 2.17.0

Platform

iOS

Platform version(s)

iOS 26

Xcode version

26

Package manager

Swift Package Manager

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugThis points to a verified bug in the code

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions