Hello. I run a clean installation with previously no errors or warnings. I just updated to 32.0.6 and now receive the following warning…
Second factor configuration
This instance has no second factor provider available.
… The strange thing is that if I go to Logging, that warning is not present. To eliminate that it might be a stale warning I logged into my instance from a browser that has never had contact with my NextCloud instance and I get the same behaviour.
I have added, below to my config but that made no difference.
`‘twofactor_enforced’ => ‘false’,`
Are we being forced to move towards 2FA soon - I thought it was optional. If it is still optional, how do I suppress this new warning?
Thank you @scubamuc - clearly an intended change as it is sound security practice. But as for my question on
this does not seem to be mentioned in the GitHub developer notes. I went ahead and enabled the app “Two-Factor TOTP Provider“; so now I am down to a info level message in my log saying that…
”Second factor configuration
Second factor providers are available but two-factor authentication is not enforced.”
If I had to guess, I’d say it’s because there’s no option to turn off or hide the messages, and If there were some kind of “hidden” switch in the code to do so, someone familiar with the Nextcloud codebase should be able to find it, but I doubt there actually is one, tbh.
So I’d say, at least for now, your only options are to follow the recommendations in the message and enforce 2FA or to ignore the message. After all, it’s just an informational message that doesn’t affect functionality.
There is no hidden switch. If you are backing up your full life into Nextcloud it should be considered to use 2FA. Enabling any 2FA app removes that warning and brings an info to remind admins when it’s not enforced. That is exactly the intention. Secure your private life!
And there is absolutely no account on your Nextcloud, not even some admin fallback account that has a password set and therefore would still be accessible via /login?direct=1?
back. 
