Newly created admin users unable to pass Two-Factor Authentication

Question

Our production site, as well as our QA servers, are all having an issue with passing the 2-factor authentication in admin panel.

When a newly created admin user scans the QR code after providing their username and password, and enters the 6-digit code shown on the Google Authenticator app, they are consistently given an "Invalid code" error message. However, if an existing admin resets their Google Authenticator 2FA settings under User Accounts, the new user can scan the QR code and enter the 6-digit code with no issue. This is not happening on any old accounts, only new ones.

This issue is not reproducible on local environments.

There was a similar question asked earlier but the OP himself had to reset the 2FA in the accepted solution. This should ideally work without resetting the 2FA.

We are running Magento Commerce/Enterprise version 2.3.5-p1 while the msp/twofactorauth package is at version 3.1.2

Answer 1

we had a similar problem where one environment worked fine and the other kept giving "invalid code" or simply redirected to the same screen. We had a look in the logs and found the following error:

Session size of 259423 exceeded allowed session max size of 256000.

After this the solution was simple:

bin/magento config:set system/security/max_session_size_admin 260000

And it worked. So tail the logs and see if it is a session memory limit.