FR: Support registration of second factor without applications protected by 2FA

Description

Scenario

The configuration in configuration.yml:

authentication_backend:
  password_change:
    disable: false
identity_validation:
  elevated_session:
    require_second_factor: true
    skip_second_factor: true

Normally this would allow the use of TOTP or WebAuthn as a second factor to elevate the session instead of sending a code by email, if such a second factor is registered.

Now imagine that there are only access control rules configured like:

access_control:
  (...)
  rules:
    - domain: "auth.example.com"
      subject: 'group:some_silly_users'
      policy: one_factor

In other words, none of the rules have policy: two_factor. The result is that when the user logs in and visits the Two-Factor Authentication page, it is impossible for the user to register a second factor:

There are no protected applications that require a second factor method

A second factor method (TOTP or WebAuthn) is not only used for protected applications. It can also be used to elevate Authelia sessions. Furthermore, a second factor method is more secure than sending a code by email in most scenarios.

Use Case

Allow users to register (and manage) second factors (TOTP and WebAuthn) when no access control rules are configured with policy: two_factor. This allows users to elevate sessions with a more secure second factor, which in turn allows users to more securely perform critical security actions, such as changing passwords.

Details

No response

Documentation

No response

Generative AI

No

Pre-Submission Checklist

• I agree to follow the Code of Conduct

• I have checked for related issues and checked the documentation