WebAuthn + TOTP MFA returns invalid_grant "NextMfa" error in OIDC apps

I am just experimenting with the current head of development of casdoor. I am using mostly WebAuthn for authentication and now I am getting this error in oidc apps:

Error exchanging token: *** "invalid_grant" "authorization code: [NextMfa] is invalid"

I am also not able to login to casdoor itself using webauthn.

Is that a configuration issue?

I want to add that I have both WebAuthN and TOTP mfa activated, I had hoped to be able to either use WebAuthN to log in or user/password/totp.

Thanks for the report — that was a real bug, not a config issue. With both WebAuthn and TOTP enabled, the login page didn't handle the TOTP prompt after WebAuthn, so "NextMfa" was sent back as the authorization code.

It's fixed on master: https://github.com/casdoor/casdoor/commit/82bd02be4f8ad44e3d9713ae08d39fd19f424e3d

After updating, WebAuthn sign-in will ask for your TOTP code and then complete normally. Note that when MFA is enabled, it's required after WebAuthn too, so WebAuthn alone won't skip the TOTP step.

This indeed works now, thank you. Would it be possible to make the mfa step optional if the initial step already used a strong auth? MFA is mostly used to secure the relatively insecure user/password combination.

@jumager send a github issue

This already works with latest commit that made 2FA optional with WebAuthN as the primary method. Thanks!