2

After upgrading to Magento 2.4.3 we are stuck in a loop with 2FA when trying to login into the admin.

I have been unable to complete an admin login, the 2FA would succeed after entering a code and then loop back to asking for the authentication again.

Improve this question
1
  • In our case when prompted to reconfigure 2FA from email link, the link would redirect back to login. Missing config 'system/security/max_session_size_admin' was addressed as per magento.stackexchange.com/a/350916/15747
    – Flipmedia
    Nov 3, 2022 at 17:01

3 Answers 3

Reset to default
3

This does seem to be related to system/security/max_session_size_admin
These settings are required in 2.4.3 but didn't exist in 2.4.2, and when testing still didn't exist after the patch until we actually changed the value and saved in admin.

In our case we had an error in the logs that the session size was too large at around 600000, so rather than set it to 0 to disable we set it to 800000 for now.
For our live site we had the looping 2FA but rather than disable 2FA and change session values in admin we just inserted the two records into core_config_data with something along the lines of:

INSERT INTO `core_config_data` (`scope`, `scope_id`, `path`, `value`) VALUES
('default', 0, 'system/security/max_session_size_admin', '800000'),
('default', 0, 'system/security/max_session_size_storefront', '800000');
Improve this answer
2
  • I had the same issue, this was the solution for me.
    – Chris Oliver
    Apr 13, 2022 at 14:00
  • php -d memory_limit=-1 ./bin/magento config:set system/security/max_session_size_admin 2560000 && php -d memory_limit=-1 ./bin/magento config:set system/security/max_session_size_storefront 2560000 && php -d memory_limit=-1 ./bin/magento cache:flush
    – Flipmedia
    Nov 3, 2022 at 17:34
0

For anyone else who gets this after upgrading to Magento 2.4.3 or above. We had the same issue. Fix for us was:
Temporarily disable forced passwords

php bin/magento config:set admin/security/password_is_forced 0
php bin/magento cache:flush

In the MAP we had to go to: Stores > Config > Advanced | System > Security Set Max Session Size in Admin to 0 This gave a warning, but saved fine. Then flushed cache.

We could then re-enable force password change

php bin/magento config:set admin/security/password_is_forced 1

or Stores > Config > Advanced | Admin > Security Set Password Change to Forced Then flush cache.

Improve this answer
0

I have also faced the same issue. It got fixed after Stores > Config > Advanced | System > Security Set Max Session Size in Admin set as 0 and then flushed cache. Also, if you face a page refresh issue Magento 2.4.3 admin dashboard - Invalid security or form key. Please refresh the page

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.