feat: mfa policy (#913)

* feat: add mfa to login policy * feat: add mfa to login policy * feat: add mfa to login policy * feat: add mfa to login policy * feat: add mfa to login policy on org * feat: add mfa to login policy on org * feat: append events on policy views * feat: iam login policy mfa definition * feat: login policies on orgs * feat: configured mfas in login process * feat: configured mfas in login process * Update internal/ui/login/static/i18n/en.yaml Co-authored-by: Livio Amstutz <livio.a@gmail.com> * fix: rename software and hardware mfas * fix: pr requests * fix user mfa * fix: test * fix: oidc version * fix: oidc version * fix: proto gen Co-authored-by: Livio Amstutz <livio.a@gmail.com> Co-authored-by: Max Peintner <max@caos.ch>
2025-08-11 18:07:31 +00:00 · 2020-11-04 11:26:10 +01:00
parent 51417be35d
commit 202aae4954
76 changed files with 12913 additions and 5614 deletions
--- a/internal/org/repository/eventsourcing/eventstore.go
+++ b/internal/org/repository/eventsourcing/eventstore.go
@@ -106,6 +106,14 @@ func (es *OrgEventstore) OrgByID(ctx context.Context, org *org_model.Org) (*org_
 	return model.OrgToModel(esOrg), nil
 }

+func (es *OrgEventstore) OrgEventsByID(ctx context.Context, id string, sequence uint64) ([]*es_models.Event, error) {
+	query, err := OrgByIDQuery(id, sequence)
+	if err != nil {
+		return nil, err
+	}
+	return es.FilterEvents(ctx, query)
+}
+
 func (es *OrgEventstore) IsOrgUnique(ctx context.Context, name, domain string) (isUnique bool, err error) {
 	var found bool
 	err = es_sdk.Filter(ctx, es.FilterEvents, isUniqueValidation(&found), OrgNameUniqueQuery(name))
@@ -767,7 +775,7 @@ func (es *OrgEventstore) AddLoginPolicy(ctx context.Context, policy *iam_model.L

 func (es *OrgEventstore) ChangeLoginPolicy(ctx context.Context, policy *iam_model.LoginPolicy) (*iam_model.LoginPolicy, error) {
 	if policy == nil || !policy.IsValid() {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-Lso02", "Errors.Org.LoginPolicy.Invalid")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-mL0ps", "Errors.Org.LoginPolicy.Invalid")
 	}
 	org, err := es.OrgByID(ctx, org_model.NewOrg(policy.AggregateID))
 	if err != nil {
@@ -775,7 +783,7 @@ func (es *OrgEventstore) ChangeLoginPolicy(ctx context.Context, policy *iam_mode
 	}

 	if org.LoginPolicy == nil {
-		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-Lso02", "Errors.Org.LoginPolicy.NotExisting")
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-3Mg9s", "Errors.Org.LoginPolicy.NotExisting")
 	}

 	repoOrg := model.OrgFromModel(org)
@@ -870,6 +878,96 @@ func (es *OrgEventstore) RemoveIDPProviderFromLoginPolicy(ctx context.Context, p
 	return es_sdk.PushAggregates(ctx, es.PushAggregates, repoOrg.AppendEvents, agg)
 }

+func (es *OrgEventstore) AddSecondFactorToLoginPolicy(ctx context.Context, aggregateID string, mfa iam_model.SecondFactorType) (iam_model.SecondFactorType, error) {
+	if mfa == iam_model.SecondFactorTypeUnspecified {
+		return 0, errors.ThrowPreconditionFailed(nil, "EVENT-3Rf8s", "Errors.Org.LoginPolicy.MFA.Unspecified")
+	}
+	org, err := es.OrgByID(ctx, org_model.NewOrg(aggregateID))
+	if err != nil {
+		return 0, err
+	}
+	if org.LoginPolicy == nil {
+		return 0, errors.ThrowAlreadyExists(nil, "EVENT-hMd9s", "Errors.Org.LoginPolicy.NotExisting")
+	}
+	if _, m := org.LoginPolicy.GetSecondFactor(mfa); m != 0 {
+		return 0, errors.ThrowAlreadyExists(nil, "EVENT-3Bm9s", "Errors.Org.LoginPolicy.MFA.AlreadyExisting")
+	}
+	repoOrg := model.OrgFromModel(org)
+	repoMFA := iam_es_model.SecondFactorFromModel(mfa)
+
+	addAggregate := LoginPolicySecondFactorAddedAggregate(es.Eventstore.AggregateCreator(), repoOrg, repoMFA, es.IamID)
+	err = es_sdk.Push(ctx, es.PushAggregates, repoOrg.AppendEvents, addAggregate)
+	if err != nil {
+		return 0, err
+	}
+	if _, m := iam_es_model.GetMFA(repoOrg.LoginPolicy.SecondFactors, repoMFA.MfaType); m != 0 {
+		return iam_model.SecondFactorType(m), nil
+	}
+	return 0, errors.ThrowInternal(nil, "EVENT-rM9so", "Errors.Internal")
+}
+
+func (es *OrgEventstore) RemoveSecondFactorFromLoginPolicy(ctx context.Context, aggregateID string, mfa iam_model.SecondFactorType) error {
+	if mfa == iam_model.SecondFactorTypeUnspecified {
+		return errors.ThrowPreconditionFailed(nil, "EVENT-6Nm9s", "Errors.Org.LoginPolicy.MFA.Unspecified")
+	}
+	org, err := es.OrgByID(ctx, org_model.NewOrg(aggregateID))
+	if err != nil {
+		return err
+	}
+	if _, m := org.LoginPolicy.GetSecondFactor(mfa); m == 0 {
+		return errors.ThrowPreconditionFailed(nil, "EVENT-5Mso9", "Errors.IAM.LoginPolicy.MFA.NotExisting")
+	}
+	repoOrg := model.OrgFromModel(org)
+	repoMFA := iam_es_model.SecondFactorFromModel(mfa)
+	agg := LoginPolicySecondFactorRemovedAggregate(es.Eventstore.AggregateCreator(), repoOrg, repoMFA)
+	return es_sdk.Push(ctx, es.PushAggregates, repoOrg.AppendEvents, agg)
+}
+
+func (es *OrgEventstore) AddMultiFactorToLoginPolicy(ctx context.Context, aggregateID string, mfa iam_model.MultiFactorType) (iam_model.MultiFactorType, error) {
+	if mfa == iam_model.MultiFactorTypeUnspecified {
+		return 0, errors.ThrowPreconditionFailed(nil, "EVENT-6Zms9", "Errors.Org.LoginPolicy.MFA.Unspecified")
+	}
+	org, err := es.OrgByID(ctx, org_model.NewOrg(aggregateID))
+	if err != nil {
+		return 0, err
+	}
+	if org.LoginPolicy == nil {
+		return 0, errors.ThrowAlreadyExists(nil, "EVENT-fGmx9", "Errors.Org.LoginPolicy.NotExisting")
+	}
+	if _, m := org.LoginPolicy.GetMultiFactor(mfa); m != 0 {
+		return 0, errors.ThrowAlreadyExists(nil, "EVENT-2Fj9s", "Errors.Org.LoginPolicy.MFA.AlreadyExisting")
+	}
+	repoOrg := model.OrgFromModel(org)
+	repoMFA := iam_es_model.MultiFactorFromModel(mfa)
+
+	addAggregate := LoginPolicyMultiFactorAddedAggregate(es.Eventstore.AggregateCreator(), repoOrg, repoMFA, es.IamID)
+	err = es_sdk.Push(ctx, es.PushAggregates, repoOrg.AppendEvents, addAggregate)
+	if err != nil {
+		return 0, err
+	}
+	if _, m := iam_es_model.GetMFA(repoOrg.LoginPolicy.MultiFactors, repoMFA.MfaType); m != 0 {
+		return iam_model.MultiFactorType(m), nil
+	}
+	return 0, errors.ThrowInternal(nil, "EVENT-2fMo0", "Errors.Internal")
+}
+
+func (es *OrgEventstore) RemoveMultiFactorFromLoginPolicy(ctx context.Context, aggregateID string, mfa iam_model.MultiFactorType) error {
+	if mfa == iam_model.MultiFactorTypeUnspecified {
+		return errors.ThrowPreconditionFailed(nil, "EVENT-lsM9c", "Errors.Org.LoginPolicy.MFA.Unspecified")
+	}
+	org, err := es.OrgByID(ctx, org_model.NewOrg(aggregateID))
+	if err != nil {
+		return err
+	}
+	if _, m := org.LoginPolicy.GetMultiFactor(mfa); m == 0 {
+		return errors.ThrowPreconditionFailed(nil, "EVENT-3dM0s", "Errors.IAM.LoginPolicy.MFA.NotExisting")
+	}
+	repoOrg := model.OrgFromModel(org)
+	repoMFA := iam_es_model.MultiFactorFromModel(mfa)
+	agg := LoginPolicyMultiFactorRemovedAggregate(es.Eventstore.AggregateCreator(), repoOrg, repoMFA)
+	return es_sdk.Push(ctx, es.PushAggregates, repoOrg.AppendEvents, agg)
+}
+
 func (es *OrgEventstore) AddPasswordComplexityPolicy(ctx context.Context, policy *iam_model.PasswordComplexityPolicy) (*iam_model.PasswordComplexityPolicy, error) {
 	if policy == nil {
 		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-Sjkl9", "Errors.Org.PasswordComplexityPolicy.Invalid")
--- a/internal/org/repository/eventsourcing/eventstore_mock_test.go
+++ b/internal/org/repository/eventsourcing/eventstore_mock_test.go
@@ -105,6 +105,26 @@ func GetMockChangesOrgWithLoginPolicy(ctrl *gomock.Controller) *OrgEventstore {
 	return GetMockedEventstore(ctrl, mockEs)
 }

+func GetMockChangesOrgWithLoginPolicyWithMFA(ctrl *gomock.Controller) *OrgEventstore {
+	orgData, _ := json.Marshal(model.Org{Name: "MusterOrg"})
+	loginPolicy, _ := json.Marshal(iam_es_model.LoginPolicy{AllowRegister: true, AllowExternalIdp: true, AllowUsernamePassword: true})
+	idpData, _ := json.Marshal(iam_es_model.IDPProvider{IDPConfigID: "IDPConfigID", Type: int32(iam_model.IDPProviderTypeSystem)})
+	secondFactor, _ := json.Marshal(iam_es_model.MFA{MfaType: int32(iam_model.SecondFactorTypeOTP)})
+	multiFactor, _ := json.Marshal(iam_es_model.MFA{MfaType: int32(iam_model.MultiFactorTypeU2FWithPIN)})
+	events := []*es_models.Event{
+		{AggregateID: "AggregateID", Sequence: 1, Type: model.OrgAdded, Data: orgData},
+		{AggregateID: "AggregateID", Sequence: 1, Type: model.LoginPolicyAdded, Data: loginPolicy},
+		{AggregateID: "AggregateID", Sequence: 1, Type: model.LoginPolicyIDPProviderAdded, Data: idpData},
+		{AggregateID: "AggregateID", Sequence: 1, Type: model.LoginPolicySecondFactorAdded, Data: secondFactor},
+		{AggregateID: "AggregateID", Sequence: 1, Type: model.LoginPolicyMultiFactorAdded, Data: multiFactor},
+	}
+	mockEs := mock.NewMockEventstore(ctrl)
+	mockEs.EXPECT().FilterEvents(gomock.Any(), gomock.Any()).Return(events, nil)
+	mockEs.EXPECT().AggregateCreator().Return(es_models.NewAggregateCreator("TEST"))
+	mockEs.EXPECT().PushAggregates(gomock.Any(), gomock.Any()).Return(nil)
+	return GetMockedEventstore(ctrl, mockEs)
+}
+
 func GetMockChangesOrgWithPasswordComplexityPolicy(ctrl *gomock.Controller) *OrgEventstore {
 	orgData, _ := json.Marshal(model.Org{Name: "MusterOrg"})
 	passwordComplexityPolicy, _ := json.Marshal(iam_es_model.PasswordComplexityPolicy{
--- a/internal/org/repository/eventsourcing/eventstore_test.go
+++ b/internal/org/repository/eventsourcing/eventstore_test.go
@@ -2732,6 +2732,344 @@ func TestRemoveIdpProviderFromLoginPolicy(t *testing.T) {
 	}
 }

+func TestAddSecondFactorToLoginPolicy(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	type args struct {
+		es          *OrgEventstore
+		ctx         context.Context
+		aggregateID string
+		mfa         iam_model.SecondFactorType
+	}
+	type res struct {
+		result  iam_model.SecondFactorType
+		wantErr bool
+		errFunc func(err error) bool
+	}
+	tests := []struct {
+		name string
+		args args
+		res  res
+	}{
+		{
+			name: "add second factor to login policy, ok",
+			args: args{
+				es:          GetMockChangesOrgWithLoginPolicy(ctrl),
+				ctx:         authz.NewMockContext("orgID", "userID"),
+				aggregateID: "AggregateID",
+				mfa:         iam_model.SecondFactorTypeOTP,
+			},
+			res: res{
+				result: iam_model.SecondFactorTypeOTP,
+			},
+		},
+		{
+			name: "add second factor to login policy, already existing",
+			args: args{
+				es:          GetMockChangesOrgWithLoginPolicyWithMFA(ctrl),
+				ctx:         authz.NewMockContext("orgID", "userID"),
+				aggregateID: "AggregateID",
+				mfa:         iam_model.SecondFactorTypeOTP,
+			},
+			res: res{
+				wantErr: true,
+				errFunc: caos_errs.IsErrorAlreadyExists,
+			},
+		},
+		{
+			name: "invalid mfa",
+			args: args{
+				es:          GetMockChangesOrgOK(ctrl),
+				ctx:         authz.NewMockContext("orgID", "userID"),
+				aggregateID: "AggregateID",
+				mfa:         iam_model.SecondFactorTypeUnspecified,
+			},
+			res: res{
+				wantErr: true,
+				errFunc: caos_errs.IsPreconditionFailed,
+			},
+		},
+		{
+			name: "existing iam not found",
+			args: args{
+				es:          GetMockChangesOrgNoEvents(ctrl),
+				ctx:         authz.NewMockContext("orgID", "userID"),
+				aggregateID: "Test",
+				mfa:         iam_model.SecondFactorTypeOTP,
+			},
+			res: res{
+				wantErr: true,
+				errFunc: caos_errs.IsNotFound,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := tt.args.es.AddSecondFactorToLoginPolicy(tt.args.ctx, tt.args.aggregateID, tt.args.mfa)
+			if (tt.res.wantErr && !tt.res.errFunc(err)) || (err != nil && !tt.res.wantErr) {
+				t.Errorf("got wrong err: %v ", err)
+				return
+			}
+			if tt.res.wantErr && tt.res.errFunc(err) {
+				return
+			}
+			if result != tt.res.result {
+				t.Errorf("got wrong result : expected: %v, actual: %v ", tt.res.result, result)
+			}
+		})
+	}
+}
+
+func TestRemoveSecondFactorFromLoginPolicy(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	type args struct {
+		es          *OrgEventstore
+		ctx         context.Context
+		aggregateID string
+		mfa         iam_model.SecondFactorType
+	}
+	type res struct {
+		wantErr bool
+		errFunc func(err error) bool
+	}
+	tests := []struct {
+		name string
+		args args
+		res  res
+	}{
+		{
+			name: "remove second factor from login policy, ok",
+			args: args{
+				es:          GetMockChangesOrgWithLoginPolicyWithMFA(ctrl),
+				ctx:         authz.NewMockContext("orgID", "userID"),
+				aggregateID: "AggregateID",
+				mfa:         iam_model.SecondFactorTypeOTP,
+			},
+			res: res{},
+		},
+		{
+			name: "remove second factor from  login policy, not existing",
+			args: args{
+				es:  GetMockChangesOrgWithLoginPolicy(ctrl),
+				ctx: authz.NewMockContext("orgID", "userID"),
+
+				aggregateID: "AggregateID",
+				mfa:         iam_model.SecondFactorTypeOTP,
+			},
+			res: res{
+				wantErr: true,
+				errFunc: caos_errs.IsPreconditionFailed,
+			},
+		},
+		{
+			name: "invalid provider",
+			args: args{
+				es:          GetMockChangesOrgOK(ctrl),
+				ctx:         authz.NewMockContext("orgID", "userID"),
+				aggregateID: "AggregateID",
+				mfa:         iam_model.SecondFactorTypeUnspecified,
+			},
+			res: res{
+				wantErr: true,
+				errFunc: caos_errs.IsPreconditionFailed,
+			},
+		},
+		{
+			name: "existing iam not found",
+			args: args{
+				es:          GetMockChangesOrgNoEvents(ctrl),
+				ctx:         authz.NewMockContext("orgID", "userID"),
+				aggregateID: "Test",
+				mfa:         iam_model.SecondFactorTypeOTP,
+			},
+			res: res{
+				wantErr: true,
+				errFunc: caos_errs.IsNotFound,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := tt.args.es.RemoveSecondFactorFromLoginPolicy(tt.args.ctx, tt.args.aggregateID, tt.args.mfa)
+
+			if !tt.res.wantErr && err != nil {
+				t.Errorf("should not get err: %v ", err)
+			}
+			if tt.res.wantErr && !tt.res.errFunc(err) {
+				t.Errorf("got wrong err: %v ", err)
+			}
+		})
+	}
+}
+
+func TestAddMultiFactorToLoginPolicy(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	type args struct {
+		es          *OrgEventstore
+		ctx         context.Context
+		aggregateID string
+		mfa         iam_model.MultiFactorType
+	}
+	type res struct {
+		result  iam_model.MultiFactorType
+		wantErr bool
+		errFunc func(err error) bool
+	}
+	tests := []struct {
+		name string
+		args args
+		res  res
+	}{
+		{
+			name: "add mfa to login policy, ok",
+			args: args{
+				es:          GetMockChangesOrgWithLoginPolicy(ctrl),
+				ctx:         authz.NewMockContext("orgID", "userID"),
+				aggregateID: "AggregateID",
+				mfa:         iam_model.MultiFactorTypeU2FWithPIN,
+			},
+			res: res{
+				result: iam_model.MultiFactorTypeU2FWithPIN,
+			},
+		},
+		{
+			name: "add mfa to login policy, already existing",
+			args: args{
+				es:          GetMockChangesOrgWithLoginPolicyWithMFA(ctrl),
+				ctx:         authz.NewMockContext("orgID", "userID"),
+				aggregateID: "AggregateID",
+				mfa:         iam_model.MultiFactorTypeU2FWithPIN,
+			},
+			res: res{
+				wantErr: true,
+				errFunc: caos_errs.IsErrorAlreadyExists,
+			},
+		},
+		{
+			name: "invalid mfa",
+			args: args{
+				es:          GetMockChangesOrgOK(ctrl),
+				ctx:         authz.NewMockContext("orgID", "userID"),
+				aggregateID: "AggregateID",
+				mfa:         iam_model.MultiFactorTypeUnspecified,
+			},
+			res: res{
+				wantErr: true,
+				errFunc: caos_errs.IsPreconditionFailed,
+			},
+		},
+		{
+			name: "existing iam not found",
+			args: args{
+				es:          GetMockChangesOrgNoEvents(ctrl),
+				ctx:         authz.NewMockContext("orgID", "userID"),
+				aggregateID: "Test",
+				mfa:         iam_model.MultiFactorTypeU2FWithPIN,
+			},
+			res: res{
+				wantErr: true,
+				errFunc: caos_errs.IsNotFound,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := tt.args.es.AddMultiFactorToLoginPolicy(tt.args.ctx, tt.args.aggregateID, tt.args.mfa)
+			if (tt.res.wantErr && !tt.res.errFunc(err)) || (err != nil && !tt.res.wantErr) {
+				t.Errorf("got wrong err: %v ", err)
+				return
+			}
+			if tt.res.wantErr && tt.res.errFunc(err) {
+				return
+			}
+			if result != tt.res.result {
+				t.Errorf("got wrong result : expected: %v, actual: %v ", tt.res.result, result)
+			}
+		})
+	}
+}
+
+func TestRemoveMultiFactorFromLoginPolicy(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	type args struct {
+		es          *OrgEventstore
+		ctx         context.Context
+		aggregateID string
+		mfa         iam_model.MultiFactorType
+	}
+	type res struct {
+		wantErr bool
+		errFunc func(err error) bool
+	}
+	tests := []struct {
+		name string
+		args args
+		res  res
+	}{
+		{
+			name: "remove mfa from login policy, ok",
+			args: args{
+				es:          GetMockChangesOrgWithLoginPolicyWithMFA(ctrl),
+				ctx:         authz.NewMockContext("orgID", "userID"),
+				aggregateID: "AggregateID",
+				mfa:         iam_model.MultiFactorTypeU2FWithPIN,
+			},
+			res: res{},
+		},
+		{
+			name: "remove mfa from  login policy, not existing",
+			args: args{
+				es:  GetMockChangesOrgWithLoginPolicy(ctrl),
+				ctx: authz.NewMockContext("orgID", "userID"),
+
+				aggregateID: "AggregateID",
+				mfa:         iam_model.MultiFactorTypeU2FWithPIN,
+			},
+			res: res{
+				wantErr: true,
+				errFunc: caos_errs.IsPreconditionFailed,
+			},
+		},
+		{
+			name: "invalid provider",
+			args: args{
+				es:          GetMockChangesOrgOK(ctrl),
+				ctx:         authz.NewMockContext("orgID", "userID"),
+				aggregateID: "AggregateID",
+				mfa:         iam_model.MultiFactorTypeUnspecified,
+			},
+			res: res{
+				wantErr: true,
+				errFunc: caos_errs.IsPreconditionFailed,
+			},
+		},
+		{
+			name: "existing iam not found",
+			args: args{
+				es:          GetMockChangesOrgNoEvents(ctrl),
+				ctx:         authz.NewMockContext("orgID", "userID"),
+				aggregateID: "Test",
+				mfa:         iam_model.MultiFactorTypeU2FWithPIN,
+			},
+			res: res{
+				wantErr: true,
+				errFunc: caos_errs.IsNotFound,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := tt.args.es.RemoveMultiFactorFromLoginPolicy(tt.args.ctx, tt.args.aggregateID, tt.args.mfa)
+
+			if !tt.res.wantErr && err != nil {
+				t.Errorf("should not get err: %v ", err)
+			}
+			if tt.res.wantErr && !tt.res.errFunc(err) {
+				t.Errorf("got wrong err: %v ", err)
+			}
+		})
+	}
+}
+
 func TestAddLabelPolicy(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	type args struct {
--- a/internal/org/repository/eventsourcing/login_policy.go
+++ b/internal/org/repository/eventsourcing/login_policy.go
@@ -9,18 +9,18 @@ import (
 	"github.com/caos/zitadel/internal/org/repository/eventsourcing/model"
 )

-func LoginPolicyAddedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Org, policy *iam_es_model.LoginPolicy) func(ctx context.Context) (*es_models.Aggregate, error) {
+func LoginPolicyAddedAggregate(aggCreator *es_models.AggregateCreator, org *model.Org, policy *iam_es_model.LoginPolicy) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if policy == nil {
 			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-Smla8", "Errors.Internal")
 		}
-		agg, err := OrgAggregate(ctx, aggCreator, existing.AggregateID, existing.Sequence)
+		agg, err := OrgAggregate(ctx, aggCreator, org.AggregateID, org.Sequence)
 		if err != nil {
 			return nil, err
 		}
 		validationQuery := es_models.NewSearchQuery().
 			AggregateTypeFilter(model.OrgAggregate).
-			AggregateIDFilter(existing.AggregateID)
+			AggregateIDFilter(org.AggregateID)

 		validation := checkExistingLoginPolicyValidation()
 		agg.SetPrecondition(validationQuery, validation)
@@ -28,16 +28,16 @@ func LoginPolicyAddedAggregate(aggCreator *es_models.AggregateCreator, existing
 	}
 }

-func LoginPolicyChangedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Org, policy *iam_es_model.LoginPolicy) func(ctx context.Context) (*es_models.Aggregate, error) {
+func LoginPolicyChangedAggregate(aggCreator *es_models.AggregateCreator, org *model.Org, policy *iam_es_model.LoginPolicy) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if policy == nil {
 			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-Mlco9", "Errors.Internal")
 		}
-		agg, err := OrgAggregate(ctx, aggCreator, existing.AggregateID, existing.Sequence)
+		agg, err := OrgAggregate(ctx, aggCreator, org.AggregateID, org.Sequence)
 		if err != nil {
 			return nil, err
 		}
-		changes := existing.LoginPolicy.Changes(policy)
+		changes := org.LoginPolicy.Changes(policy)
 		if len(changes) == 0 {
 			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-Smk8d", "Errors.NoChangesFound")
 		}
@@ -45,12 +45,12 @@ func LoginPolicyChangedAggregate(aggCreator *es_models.AggregateCreator, existin
 	}
 }

-func LoginPolicyRemovedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Org) func(ctx context.Context) (*es_models.Aggregate, error) {
+func LoginPolicyRemovedAggregate(aggCreator *es_models.AggregateCreator, org *model.Org) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
-		if existing == nil {
+		if org == nil {
 			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-S8sio", "Errors.Internal")
 		}
-		agg, err := OrgAggregate(ctx, aggCreator, existing.AggregateID, existing.Sequence)
+		agg, err := OrgAggregate(ctx, aggCreator, org.AggregateID, org.Sequence)
 		if err != nil {
 			return nil, err
 		}
@@ -58,18 +58,18 @@ func LoginPolicyRemovedAggregate(aggCreator *es_models.AggregateCreator, existin
 	}
 }

-func LoginPolicyIDPProviderAddedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Org, provider *iam_es_model.IDPProvider, iamID string) func(ctx context.Context) (*es_models.Aggregate, error) {
+func LoginPolicyIDPProviderAddedAggregate(aggCreator *es_models.AggregateCreator, org *model.Org, provider *iam_es_model.IDPProvider, iamID string) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if provider == nil {
 			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-Sml9d", "Errors.Internal")
 		}
-		agg, err := OrgAggregate(ctx, aggCreator, existing.AggregateID, existing.Sequence)
+		agg, err := OrgAggregate(ctx, aggCreator, org.AggregateID, org.Sequence)
 		if err != nil {
 			return nil, err
 		}
 		validationQuery := es_models.NewSearchQuery().
 			AggregateTypeFilter(model.OrgAggregate, iam_es_model.IAMAggregate).
-			AggregateIDsFilter(existing.AggregateID, iamID)
+			AggregateIDsFilter(org.AggregateID, iamID)

 		validation := checkExistingLoginPolicyIDPProviderValidation(provider)
 		agg.SetPrecondition(validationQuery, validation)
@@ -77,11 +77,11 @@ func LoginPolicyIDPProviderAddedAggregate(aggCreator *es_models.AggregateCreator
 	}
 }

-func LoginPolicyIDPProviderRemovedAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, existing *model.Org, provider *iam_es_model.IDPProviderID, cascade bool) (*es_models.Aggregate, error) {
+func LoginPolicyIDPProviderRemovedAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, org *model.Org, provider *iam_es_model.IDPProviderID, cascade bool) (*es_models.Aggregate, error) {
 	if provider == nil {
 		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-Sml9d", "Errors.Internal")
 	}
-	agg, err := OrgAggregate(ctx, aggCreator, existing.AggregateID, existing.Sequence)
+	agg, err := OrgAggregate(ctx, aggCreator, org.AggregateID, org.Sequence)
 	if err != nil {
 		return nil, err
 	}
@@ -92,6 +92,71 @@ func LoginPolicyIDPProviderRemovedAggregate(ctx context.Context, aggCreator *es_
 	return agg.AppendEvent(eventType, provider)
 }

+func LoginPolicySecondFactorAddedAggregate(aggCreator *es_models.AggregateCreator, org *model.Org, mfa *iam_es_model.MFA, iamID string) func(ctx context.Context) (*es_models.Aggregate, error) {
+	return func(ctx context.Context) (*es_models.Aggregate, error) {
+		if mfa == nil || org == nil {
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-5Gk9s", "Errors.Internal")
+		}
+		agg, err := OrgAggregate(ctx, aggCreator, org.AggregateID, org.Sequence)
+		if err != nil {
+			return nil, err
+		}
+		validationQuery := es_models.NewSearchQuery().
+			AggregateTypeFilter(model.OrgAggregate).
+			AggregateIDsFilter(org.AggregateID)
+
+		validation := checkExistingLoginPolicySecondFactorValidation(mfa.MfaType)
+		agg.SetPrecondition(validationQuery, validation)
+		return agg.AppendEvent(model.LoginPolicySecondFactorAdded, mfa)
+	}
+}
+
+func LoginPolicySecondFactorRemovedAggregate(aggCreator *es_models.AggregateCreator, org *model.Org, mfa *iam_es_model.MFA) func(ctx context.Context) (*es_models.Aggregate, error) {
+	return func(ctx context.Context) (*es_models.Aggregate, error) {
+		if mfa == nil || org == nil {
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-Sml9d", "Errors.Internal")
+		}
+		agg, err := OrgAggregate(ctx, aggCreator, org.AggregateID, org.Sequence)
+		if err != nil {
+			return nil, err
+		}
+		return agg.AppendEvent(model.LoginPolicySecondFactorRemoved, mfa)
+	}
+}
+
+func LoginPolicyMultiFactorAddedAggregate(aggCreator *es_models.AggregateCreator, org *model.Org, mfa *iam_es_model.MFA, iamID string) func(ctx context.Context) (*es_models.Aggregate, error) {
+	return func(ctx context.Context) (*es_models.Aggregate, error) {
+		if mfa == nil || org == nil {
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-4Bm9s", "Errors.Internal")
+		}
+		agg, err := OrgAggregate(ctx, aggCreator, org.AggregateID, org.Sequence)
+		if err != nil {
+			return nil, err
+		}
+		validationQuery := es_models.NewSearchQuery().
+			AggregateTypeFilter(model.OrgAggregate).
+			AggregateIDsFilter(org.AggregateID)
+
+		validation := checkExistingLoginPolicyMultiFactorValidation(mfa.MfaType)
+		agg.SetPrecondition(validationQuery, validation)
+		return agg.AppendEvent(model.LoginPolicyMultiFactorAdded, mfa)
+	}
+}
+
+func LoginPolicyMultiFactorRemovedAggregate(aggCreator *es_models.AggregateCreator, org *model.Org, mfa *iam_es_model.MFA) func(ctx context.Context) (*es_models.Aggregate, error) {
+	return func(ctx context.Context) (*es_models.Aggregate, error) {
+		if mfa == nil || org == nil {
+			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-6Nm9s", "Errors.Internal")
+		}
+
+		agg, err := OrgAggregate(ctx, aggCreator, org.AggregateID, org.Sequence)
+		if err != nil {
+			return nil, err
+		}
+		return agg.AppendEvent(model.LoginPolicyMultiFactorRemoved, mfa)
+	}
+}
+
 func checkExistingLoginPolicyValidation() func(...*es_models.Event) error {
 	return func(events ...*es_models.Event) error {
 		existing := false
@@ -184,3 +249,83 @@ func checkExistingLoginPolicyIDPProviderValidation(idpProvider *iam_es_model.IDP
 		return nil
 	}
 }
+
+func checkExistingLoginPolicySecondFactorValidation(mfaType int32) func(...*es_models.Event) error {
+	return func(events ...*es_models.Event) error {
+		mfas := make([]int32, 0)
+		for _, event := range events {
+			switch event.Type {
+			case model.LoginPolicySecondFactorAdded:
+				mfa := new(iam_es_model.MFA)
+				err := mfa.SetData(event)
+				if err != nil {
+					return err
+				}
+				mfas = append(mfas, mfa.MfaType)
+			case model.LoginPolicySecondFactorRemoved:
+				idp := new(iam_es_model.IDPProvider)
+				err := idp.SetData(event)
+				if err != nil {
+					return err
+				}
+				for i := len(mfas) - 1; i >= 0; i-- {
+					if mfas[i] == mfaType {
+						mfas[i] = mfas[len(mfas)-1]
+						mfas[len(mfas)-1] = 0
+						mfas = mfas[:len(mfas)-1]
+						break
+					}
+				}
+			case model.LoginPolicyRemoved:
+				mfas = make([]int32, 0)
+			}
+		}
+
+		for _, m := range mfas {
+			if m == mfaType {
+				return errors.ThrowPreconditionFailed(nil, "EVENT-4Bo0sw", "Errors.Org.LoginPolicy.MFA.AlreadyExisting")
+			}
+		}
+		return nil
+	}
+}
+
+func checkExistingLoginPolicyMultiFactorValidation(mfaType int32) func(...*es_models.Event) error {
+	return func(events ...*es_models.Event) error {
+		mfas := make([]int32, 0)
+		for _, event := range events {
+			switch event.Type {
+			case model.LoginPolicyMultiFactorAdded:
+				mfa := new(iam_es_model.MFA)
+				err := mfa.SetData(event)
+				if err != nil {
+					return err
+				}
+				mfas = append(mfas, mfa.MfaType)
+			case model.LoginPolicyMultiFactorRemoved:
+				idp := new(iam_es_model.IDPProvider)
+				err := idp.SetData(event)
+				if err != nil {
+					return err
+				}
+				for i := len(mfas) - 1; i >= 0; i-- {
+					if mfas[i] == mfaType {
+						mfas[i] = mfas[len(mfas)-1]
+						mfas[len(mfas)-1] = 0
+						mfas = mfas[:len(mfas)-1]
+						break
+					}
+				}
+			case model.LoginPolicyRemoved:
+				mfas = make([]int32, 0)
+			}
+		}
+
+		for _, m := range mfas {
+			if m == mfaType {
+				return errors.ThrowPreconditionFailed(nil, "EVENT-4Bo0sw", "Errors.Org.LoginPolicy.MFA.AlreadyExisting")
+			}
+		}
+		return nil
+	}
+}
--- a/internal/org/repository/eventsourcing/login_policy_test.go
+++ b/internal/org/repository/eventsourcing/login_policy_test.go
@@ -76,7 +76,10 @@ func TestLoginPolicyAddedAggregate(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			agg, err := LoginPolicyAddedAggregate(tt.args.aggCreator, tt.args.existing, tt.args.new)(tt.args.ctx)
-
+			if tt.res.wantErr && !tt.res.errFunc(err) || (err != nil && !tt.res.wantErr) {
+				t.Errorf("got wrong err: %v ", err)
+				return
+			}
 			if !tt.res.wantErr && len(agg.Events) != tt.res.eventLen {
 				t.Errorf("got wrong event len: expected: %v, actual: %v ", tt.res.eventLen, len(agg.Events))
 			}
@@ -88,10 +91,6 @@ func TestLoginPolicyAddedAggregate(t *testing.T) {
 					t.Errorf("should have data in event")
 				}
 			}
-
-			if tt.res.wantErr && !tt.res.errFunc(err) {
-				t.Errorf("got wrong err: %v ", err)
-			}
 		})
 	}
 }
@@ -165,7 +164,10 @@ func TestLoginPolicyChangedAggregate(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			agg, err := LoginPolicyChangedAggregate(tt.args.aggCreator, tt.args.existing, tt.args.new)(tt.args.ctx)
-
+			if tt.res.wantErr && !tt.res.errFunc(err) || (err != nil && !tt.res.wantErr) {
+				t.Errorf("got wrong err: %v ", err)
+				return
+			}
 			if !tt.res.wantErr && len(agg.Events) != tt.res.eventLen {
 				t.Errorf("got wrong event len: expected: %v, actual: %v ", tt.res.eventLen, len(agg.Events))
 			}
@@ -177,10 +179,6 @@ func TestLoginPolicyChangedAggregate(t *testing.T) {
 					t.Errorf("should have data in event")
 				}
 			}
-
-			if tt.res.wantErr && !tt.res.errFunc(err) {
-				t.Errorf("got wrong err: %v ", err)
-			}
 		})
 	}
 }
@@ -235,7 +233,10 @@ func TestLoginPolicyRemovedAggregate(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			agg, err := LoginPolicyRemovedAggregate(tt.args.aggCreator, tt.args.existing)(tt.args.ctx)
-
+			if tt.res.wantErr && !tt.res.errFunc(err) || (err != nil && !tt.res.wantErr) {
+				t.Errorf("got wrong err: %v ", err)
+				return
+			}
 			if !tt.res.wantErr && len(agg.Events) != tt.res.eventLen {
 				t.Errorf("got wrong event len: expected: %v, actual: %v ", tt.res.eventLen, len(agg.Events))
 			}
@@ -244,10 +245,6 @@ func TestLoginPolicyRemovedAggregate(t *testing.T) {
 					t.Errorf("got wrong event type: expected: %v, actual: %v ", tt.res.eventTypes[i], agg.Events[i].Type.String())
 				}
 			}
-
-			if tt.res.wantErr && !tt.res.errFunc(err) {
-				t.Errorf("got wrong err: %v ", err)
-			}
 		})
 	}
 }
@@ -318,7 +315,10 @@ func TestLoginPolicyIdpProviderAddedAggregate(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			agg, err := LoginPolicyIDPProviderAddedAggregate(tt.args.aggCreator, tt.args.existing, tt.args.new, "IAMID")(tt.args.ctx)
-
+			if tt.res.wantErr && !tt.res.errFunc(err) || (err != nil && !tt.res.wantErr) {
+				t.Errorf("got wrong err: %v ", err)
+				return
+			}
 			if !tt.res.wantErr && len(agg.Events) != tt.res.eventLen {
 				t.Errorf("got wrong event len: expected: %v, actual: %v ", tt.res.eventLen, len(agg.Events))
 			}
@@ -330,10 +330,6 @@ func TestLoginPolicyIdpProviderAddedAggregate(t *testing.T) {
 					t.Errorf("should have data in event")
 				}
 			}
-
-			if tt.res.wantErr && !tt.res.errFunc(err) {
-				t.Errorf("got wrong err: %v ", err)
-			}
 		})
 	}
 }
@@ -431,7 +427,10 @@ func TestLoginPolicyIdpProviderRemovedAggregate(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			agg, err := LoginPolicyIDPProviderRemovedAggregate(tt.args.ctx, tt.args.aggCreator, tt.args.existing, tt.args.new, tt.args.cascade)
-
+			if tt.res.wantErr && !tt.res.errFunc(err) || (err != nil && !tt.res.wantErr) {
+				t.Errorf("got wrong err: %v ", err)
+				return
+			}
 			if !tt.res.wantErr && len(agg.Events) != tt.res.eventLen {
 				t.Errorf("got wrong event len: expected: %v, actual: %v ", tt.res.eventLen, len(agg.Events))
 			}
@@ -443,9 +442,351 @@ func TestLoginPolicyIdpProviderRemovedAggregate(t *testing.T) {
 					t.Errorf("should have data in event")
 				}
 			}
+		})
+	}
+}

-			if tt.res.wantErr && !tt.res.errFunc(err) {
+func TestLoginPolicySecondFactorAddedAggregate(t *testing.T) {
+	type args struct {
+		ctx        context.Context
+		existing   *model.Org
+		new        *iam_es_model.MFA
+		aggCreator *models.AggregateCreator
+	}
+	type res struct {
+		eventLen   int
+		eventTypes []models.EventType
+		wantErr    bool
+		errFunc    func(err error) bool
+	}
+	tests := []struct {
+		name string
+		args args
+		res  res
+	}{
+		{
+			name: "add second factor to login policy",
+			args: args{
+				ctx: authz.NewMockContext("orgID", "userID"),
+				existing: &model.Org{
+					ObjectRoot: models.ObjectRoot{AggregateID: "AggregateID"},
+				},
+				new: &iam_es_model.MFA{
+					MfaType: int32(iam_model.SecondFactorTypeOTP),
+				},
+				aggCreator: models.NewAggregateCreator("Test"),
+			},
+			res: res{
+				eventLen:   1,
+				eventTypes: []models.EventType{model.LoginPolicySecondFactorAdded},
+			},
+		},
+		{
+			name: "existing org nil",
+			args: args{
+				ctx:        authz.NewMockContext("orgID", "userID"),
+				existing:   nil,
+				aggCreator: models.NewAggregateCreator("Test"),
+			},
+			res: res{
+				wantErr: true,
+				errFunc: caos_errs.IsPreconditionFailed,
+			},
+		},
+		{
+			name: "mfa nil",
+			args: args{
+				ctx:        authz.NewMockContext("orgID", "userID"),
+				existing:   &model.Org{ObjectRoot: models.ObjectRoot{AggregateID: "AggregateID"}},
+				new:        nil,
+				aggCreator: models.NewAggregateCreator("Test"),
+			},
+			res: res{
+				wantErr: true,
+				errFunc: caos_errs.IsPreconditionFailed,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			agg, err := LoginPolicySecondFactorAddedAggregate(tt.args.aggCreator, tt.args.existing, tt.args.new, "IAMID")(tt.args.ctx)
+			if tt.res.wantErr && !tt.res.errFunc(err) || (err != nil && !tt.res.wantErr) {
 				t.Errorf("got wrong err: %v ", err)
+				return
+			}
+			if !tt.res.wantErr && (agg == nil || len(agg.Events) != tt.res.eventLen) {
+				t.Errorf("got wrong event len: expected: %v, actual: %v ", tt.res.eventLen, len(agg.Events))
+				return
+			}
+			for i := 0; i < tt.res.eventLen; i++ {
+				if !tt.res.wantErr && agg.Events[i].Type != tt.res.eventTypes[i] {
+					t.Errorf("got wrong event type: expected: %v, actual: %v ", tt.res.eventTypes[i], agg.Events[i].Type.String())
+				}
+				if !tt.res.wantErr && agg.Events[i].Data == nil {
+					t.Errorf("should have data in event")
+				}
+			}
+
+		})
+	}
+}
+
+func TestLoginPolicySecondFactorRemovedAggregate(t *testing.T) {
+	type args struct {
+		ctx        context.Context
+		existing   *model.Org
+		new        *iam_es_model.MFA
+		aggCreator *models.AggregateCreator
+	}
+	type res struct {
+		eventLen   int
+		eventTypes []models.EventType
+		wantErr    bool
+		errFunc    func(err error) bool
+	}
+	tests := []struct {
+		name string
+		args args
+		res  res
+	}{
+		{
+			name: "remove second factor from login policy",
+			args: args{
+				ctx: authz.NewMockContext("orgID", "userID"),
+				existing: &model.Org{
+					ObjectRoot: models.ObjectRoot{AggregateID: "AggregateID"},
+					LoginPolicy: &iam_es_model.LoginPolicy{
+						AllowUsernamePassword: true,
+						SecondFactors: []int32{
+							int32(iam_model.SecondFactorTypeOTP),
+						},
+					}},
+				new: &iam_es_model.MFA{
+					MfaType: int32(iam_model.SecondFactorTypeOTP),
+				},
+				aggCreator: models.NewAggregateCreator("Test"),
+			},
+			res: res{
+				eventLen:   1,
+				eventTypes: []models.EventType{model.LoginPolicySecondFactorRemoved},
+			},
+		},
+		{
+			name: "existing org nil",
+			args: args{
+				ctx:        authz.NewMockContext("orgID", "userID"),
+				existing:   nil,
+				aggCreator: models.NewAggregateCreator("Test"),
+			},
+			res: res{
+				wantErr: true,
+				errFunc: caos_errs.IsPreconditionFailed,
+			},
+		},
+		{
+			name: "mfa nil",
+			args: args{
+				ctx:        authz.NewMockContext("orgID", "userID"),
+				existing:   &model.Org{ObjectRoot: models.ObjectRoot{AggregateID: "AggregateID"}},
+				new:        nil,
+				aggCreator: models.NewAggregateCreator("Test"),
+			},
+			res: res{
+				wantErr: true,
+				errFunc: caos_errs.IsPreconditionFailed,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			agg, err := LoginPolicySecondFactorRemovedAggregate(tt.args.aggCreator, tt.args.existing, tt.args.new)(tt.args.ctx)
+			if tt.res.wantErr && !tt.res.errFunc(err) || (err != nil && !tt.res.wantErr) {
+				t.Errorf("got wrong err: %v ", err)
+				return
+			}
+			if !tt.res.wantErr && len(agg.Events) != tt.res.eventLen {
+				t.Errorf("got wrong event len: expected: %v, actual: %v ", tt.res.eventLen, len(agg.Events))
+			}
+			for i := 0; i < tt.res.eventLen; i++ {
+				if !tt.res.wantErr && agg.Events[i].Type != tt.res.eventTypes[i] {
+					t.Errorf("got wrong event type: expected: %v, actual: %v ", tt.res.eventTypes[i], agg.Events[i].Type.String())
+				}
+				if !tt.res.wantErr && agg.Events[i].Data == nil {
+					t.Errorf("should have data in event")
+				}
+			}
+		})
+	}
+}
+
+func TestLoginPolicyMultiFactorAddedAggregate(t *testing.T) {
+	type args struct {
+		ctx        context.Context
+		existing   *model.Org
+		new        *iam_es_model.MFA
+		aggCreator *models.AggregateCreator
+	}
+	type res struct {
+		eventLen   int
+		eventTypes []models.EventType
+		wantErr    bool
+		errFunc    func(err error) bool
+	}
+	tests := []struct {
+		name string
+		args args
+		res  res
+	}{
+		{
+			name: "add mfa to login policy",
+			args: args{
+				ctx: authz.NewMockContext("orgID", "userID"),
+				existing: &model.Org{
+					ObjectRoot: models.ObjectRoot{AggregateID: "AggregateID"},
+				},
+				new: &iam_es_model.MFA{
+					MfaType: int32(iam_model.MultiFactorTypeU2FWithPIN),
+				},
+				aggCreator: models.NewAggregateCreator("Test"),
+			},
+			res: res{
+				eventLen:   1,
+				eventTypes: []models.EventType{model.LoginPolicyMultiFactorAdded},
+			},
+		},
+		{
+			name: "existing org nil",
+			args: args{
+				ctx:        authz.NewMockContext("orgID", "userID"),
+				existing:   nil,
+				aggCreator: models.NewAggregateCreator("Test"),
+			},
+			res: res{
+				wantErr: true,
+				errFunc: caos_errs.IsPreconditionFailed,
+			},
+		},
+		{
+			name: "mfa nil",
+			args: args{
+				ctx:        authz.NewMockContext("orgID", "userID"),
+				existing:   &model.Org{ObjectRoot: models.ObjectRoot{AggregateID: "AggregateID"}},
+				new:        nil,
+				aggCreator: models.NewAggregateCreator("Test"),
+			},
+			res: res{
+				wantErr: true,
+				errFunc: caos_errs.IsPreconditionFailed,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			agg, err := LoginPolicyMultiFactorAddedAggregate(tt.args.aggCreator, tt.args.existing, tt.args.new, "IAMID")(tt.args.ctx)
+			if tt.res.wantErr && !tt.res.errFunc(err) || (err != nil && !tt.res.wantErr) {
+				t.Errorf("got wrong err: %v ", err)
+				return
+			}
+			if !tt.res.wantErr && (agg == nil || len(agg.Events) != tt.res.eventLen) {
+				t.Errorf("got wrong event len: expected: %v, actual: %v ", tt.res.eventLen, len(agg.Events))
+				return
+			}
+			for i := 0; i < tt.res.eventLen; i++ {
+				if !tt.res.wantErr && agg.Events[i].Type != tt.res.eventTypes[i] {
+					t.Errorf("got wrong event type: expected: %v, actual: %v ", tt.res.eventTypes[i], agg.Events[i].Type.String())
+				}
+				if !tt.res.wantErr && agg.Events[i].Data == nil {
+					t.Errorf("should have data in event")
+				}
+			}
+
+		})
+	}
+}
+
+func TestLoginPolicyMultiFactorRemovedAggregate(t *testing.T) {
+	type args struct {
+		ctx        context.Context
+		existing   *model.Org
+		new        *iam_es_model.MFA
+		aggCreator *models.AggregateCreator
+	}
+	type res struct {
+		eventLen   int
+		eventTypes []models.EventType
+		wantErr    bool
+		errFunc    func(err error) bool
+	}
+	tests := []struct {
+		name string
+		args args
+		res  res
+	}{
+		{
+			name: "remove mfa from login policy",
+			args: args{
+				ctx: authz.NewMockContext("orgID", "userID"),
+				existing: &model.Org{
+					ObjectRoot: models.ObjectRoot{AggregateID: "AggregateID"},
+					LoginPolicy: &iam_es_model.LoginPolicy{
+						AllowUsernamePassword: true,
+						MultiFactors: []int32{
+							int32(iam_model.MultiFactorTypeU2FWithPIN),
+						},
+					}},
+				new: &iam_es_model.MFA{
+					MfaType: int32(iam_model.MultiFactorTypeU2FWithPIN),
+				},
+				aggCreator: models.NewAggregateCreator("Test"),
+			},
+			res: res{
+				eventLen:   1,
+				eventTypes: []models.EventType{model.LoginPolicyMultiFactorRemoved},
+			},
+		},
+		{
+			name: "existing org nil",
+			args: args{
+				ctx:        authz.NewMockContext("orgID", "userID"),
+				existing:   nil,
+				aggCreator: models.NewAggregateCreator("Test"),
+			},
+			res: res{
+				wantErr: true,
+				errFunc: caos_errs.IsPreconditionFailed,
+			},
+		},
+		{
+			name: "mfa nil",
+			args: args{
+				ctx:        authz.NewMockContext("orgID", "userID"),
+				existing:   &model.Org{ObjectRoot: models.ObjectRoot{AggregateID: "AggregateID"}},
+				new:        nil,
+				aggCreator: models.NewAggregateCreator("Test"),
+			},
+			res: res{
+				wantErr: true,
+				errFunc: caos_errs.IsPreconditionFailed,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			agg, err := LoginPolicyMultiFactorRemovedAggregate(tt.args.aggCreator, tt.args.existing, tt.args.new)(tt.args.ctx)
+			if tt.res.wantErr && !tt.res.errFunc(err) || (err != nil && !tt.res.wantErr) {
+				t.Errorf("got wrong err: %v ", err)
+				return
+			}
+			if !tt.res.wantErr && len(agg.Events) != tt.res.eventLen {
+				t.Errorf("got wrong event len: expected: %v, actual: %v ", tt.res.eventLen, len(agg.Events))
+			}
+			for i := 0; i < tt.res.eventLen; i++ {
+				if !tt.res.wantErr && agg.Events[i].Type != tt.res.eventTypes[i] {
+					t.Errorf("got wrong event type: expected: %v, actual: %v ", tt.res.eventTypes[i], agg.Events[i].Type.String())
+				}
+				if !tt.res.wantErr && agg.Events[i].Data == nil {
+					t.Errorf("should have data in event")
+				}
 			}
 		})
 	}
--- a/internal/org/repository/eventsourcing/model/login_policy.go
+++ b/internal/org/repository/eventsourcing/model/login_policy.go
@@ -44,6 +44,57 @@ func (o *Org) appendRemoveIdpProviderFromLoginPolicyEvent(event *es_models.Event
 		o.LoginPolicy.IDPProviders[i] = o.LoginPolicy.IDPProviders[len(o.LoginPolicy.IDPProviders)-1]
 		o.LoginPolicy.IDPProviders[len(o.LoginPolicy.IDPProviders)-1] = nil
 		o.LoginPolicy.IDPProviders = o.LoginPolicy.IDPProviders[:len(o.LoginPolicy.IDPProviders)-1]
+		return nil
+	}
+	return nil
+}
+
+func (o *Org) appendAddSecondFactorToLoginPolicyEvent(event *es_models.Event) error {
+	mfa := &iam_es_model.MFA{}
+	err := mfa.SetData(event)
+	if err != nil {
+		return err
+	}
+	o.LoginPolicy.SecondFactors = append(o.LoginPolicy.SecondFactors, mfa.MfaType)
+	return nil
+}
+
+func (o *Org) appendRemoveSecondFactorFromLoginPolicyEvent(event *es_models.Event) error {
+	mfa := &iam_es_model.MFA{}
+	err := mfa.SetData(event)
+	if err != nil {
+		return err
+	}
+	if i, m := iam_es_model.GetMFA(o.LoginPolicy.SecondFactors, mfa.MfaType); m != 0 {
+		o.LoginPolicy.SecondFactors[i] = o.LoginPolicy.SecondFactors[len(o.LoginPolicy.SecondFactors)-1]
+		o.LoginPolicy.SecondFactors[len(o.LoginPolicy.SecondFactors)-1] = 0
+		o.LoginPolicy.SecondFactors = o.LoginPolicy.SecondFactors[:len(o.LoginPolicy.SecondFactors)-1]
+		return nil
+	}
+	return nil
+}
+
+func (o *Org) appendAddMultiFactorToLoginPolicyEvent(event *es_models.Event) error {
+	mfa := &iam_es_model.MFA{}
+	err := mfa.SetData(event)
+	if err != nil {
+		return err
+	}
+	o.LoginPolicy.MultiFactors = append(o.LoginPolicy.MultiFactors, mfa.MfaType)
+	return nil
+}
+
+func (o *Org) appendRemoveMultiFactorFromLoginPolicyEvent(event *es_models.Event) error {
+	mfa := &iam_es_model.MFA{}
+	err := mfa.SetData(event)
+	if err != nil {
+		return err
+	}
+	if i, m := iam_es_model.GetMFA(o.LoginPolicy.MultiFactors, mfa.MfaType); m != 0 {
+		o.LoginPolicy.MultiFactors[i] = o.LoginPolicy.MultiFactors[len(o.LoginPolicy.MultiFactors)-1]
+		o.LoginPolicy.MultiFactors[len(o.LoginPolicy.MultiFactors)-1] = 0
+		o.LoginPolicy.MultiFactors = o.LoginPolicy.MultiFactors[:len(o.LoginPolicy.MultiFactors)-1]
+		return nil
 	}
 	return nil
 }
--- a/internal/org/repository/eventsourcing/model/login_policy_test.go
+++ b/internal/org/repository/eventsourcing/model/login_policy_test.go
@@ -208,3 +208,183 @@ func TestRemoveAddIdpToPolicyEvent(t *testing.T) {
 		})
 	}
 }
+
+func TestAppendAddSecondFactorToPolicyEvent(t *testing.T) {
+	type args struct {
+		org   *Org
+		mfa   *iam_es_model.MFA
+		event *es_models.Event
+	}
+	tests := []struct {
+		name   string
+		args   args
+		result *Org
+	}{
+		{
+			name: "append add second factor to login policy event",
+			args: args{
+				org:   &Org{LoginPolicy: &iam_es_model.LoginPolicy{AllowExternalIdp: true, AllowRegister: true, AllowUsernamePassword: true}},
+				mfa:   &iam_es_model.MFA{MfaType: int32(iam_model.SecondFactorTypeOTP)},
+				event: &es_models.Event{},
+			},
+			result: &Org{LoginPolicy: &iam_es_model.LoginPolicy{
+				AllowExternalIdp:      true,
+				AllowRegister:         true,
+				AllowUsernamePassword: true,
+				SecondFactors: []int32{
+					int32(iam_model.SecondFactorTypeOTP),
+				}}},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.args.mfa != nil {
+				data, _ := json.Marshal(tt.args.mfa)
+				tt.args.event.Data = data
+			}
+			tt.args.org.appendAddSecondFactorToLoginPolicyEvent(tt.args.event)
+			if len(tt.result.LoginPolicy.SecondFactors) != len(tt.args.org.LoginPolicy.SecondFactors) {
+				t.Errorf("got wrong second factor len: expected: %v, actual: %v ", len(tt.result.LoginPolicy.SecondFactors), len(tt.args.org.LoginPolicy.SecondFactors))
+			}
+			if tt.result.LoginPolicy.SecondFactors[0] != tt.args.mfa.MfaType {
+				t.Errorf("got wrong second factor: expected: %v, actual: %v ", tt.result.LoginPolicy.SecondFactors[0], tt.args.mfa)
+			}
+		})
+	}
+}
+
+func TestRemoveSecondFactorFromPolicyEvent(t *testing.T) {
+	type args struct {
+		org   *Org
+		mfa   *iam_es_model.MFA
+		event *es_models.Event
+	}
+	tests := []struct {
+		name   string
+		args   args
+		result *Org
+	}{
+		{
+			name: "append remove second factor from login policy event",
+			args: args{
+				org: &Org{
+					LoginPolicy: &iam_es_model.LoginPolicy{
+						AllowExternalIdp:      true,
+						AllowRegister:         true,
+						AllowUsernamePassword: true,
+						SecondFactors: []int32{
+							int32(iam_model.SecondFactorTypeOTP),
+						}}},
+				mfa:   &iam_es_model.MFA{MfaType: int32(iam_model.SecondFactorTypeOTP)},
+				event: &es_models.Event{},
+			},
+			result: &Org{LoginPolicy: &iam_es_model.LoginPolicy{
+				AllowExternalIdp:      true,
+				AllowRegister:         true,
+				AllowUsernamePassword: true,
+				SecondFactors:         []int32{}}},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.args.mfa != nil {
+				data, _ := json.Marshal(tt.args.mfa)
+				tt.args.event.Data = data
+			}
+			tt.args.org.appendRemoveSecondFactorFromLoginPolicyEvent(tt.args.event)
+			if len(tt.result.LoginPolicy.SecondFactors) != len(tt.args.org.LoginPolicy.SecondFactors) {
+				t.Errorf("got wrong idp mfa len: expected: %v, actual: %v ", len(tt.result.LoginPolicy.SecondFactors), len(tt.args.org.LoginPolicy.SecondFactors))
+			}
+		})
+	}
+}
+
+func TestAppendAddMultiFactorToPolicyEvent(t *testing.T) {
+	type args struct {
+		org   *Org
+		mfa   *iam_es_model.MFA
+		event *es_models.Event
+	}
+	tests := []struct {
+		name   string
+		args   args
+		result *Org
+	}{
+		{
+			name: "append add mfa to login policy event",
+			args: args{
+				org:   &Org{LoginPolicy: &iam_es_model.LoginPolicy{AllowExternalIdp: true, AllowRegister: true, AllowUsernamePassword: true}},
+				mfa:   &iam_es_model.MFA{MfaType: int32(iam_model.MultiFactorTypeU2FWithPIN)},
+				event: &es_models.Event{},
+			},
+			result: &Org{LoginPolicy: &iam_es_model.LoginPolicy{
+				AllowExternalIdp:      true,
+				AllowRegister:         true,
+				AllowUsernamePassword: true,
+				MultiFactors: []int32{
+					int32(iam_model.MultiFactorTypeU2FWithPIN),
+				}}},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.args.mfa != nil {
+				data, _ := json.Marshal(tt.args.mfa)
+				tt.args.event.Data = data
+			}
+			tt.args.org.appendAddMultiFactorToLoginPolicyEvent(tt.args.event)
+			if len(tt.result.LoginPolicy.MultiFactors) != len(tt.args.org.LoginPolicy.MultiFactors) {
+				t.Errorf("got wrong second factor len: expected: %v, actual: %v ", len(tt.result.LoginPolicy.MultiFactors), len(tt.args.org.LoginPolicy.MultiFactors))
+			}
+			if tt.result.LoginPolicy.MultiFactors[0] != tt.args.mfa.MfaType {
+				t.Errorf("got wrong second factor: expected: %v, actual: %v ", tt.result.LoginPolicy.MultiFactors[0], tt.args.mfa)
+			}
+		})
+	}
+}
+
+func TestRemoveMultiFactorFromPolicyEvent(t *testing.T) {
+	type args struct {
+		org   *Org
+		mfa   *iam_es_model.MFA
+		event *es_models.Event
+	}
+	tests := []struct {
+		name   string
+		args   args
+		result *Org
+	}{
+		{
+			name: "append remove mfa from login policy event",
+			args: args{
+				org: &Org{
+					LoginPolicy: &iam_es_model.LoginPolicy{
+						AllowExternalIdp:      true,
+						AllowRegister:         true,
+						AllowUsernamePassword: true,
+						MultiFactors: []int32{
+							int32(iam_model.MultiFactorTypeU2FWithPIN),
+						}}},
+				mfa:   &iam_es_model.MFA{MfaType: int32(iam_model.MultiFactorTypeU2FWithPIN)},
+				event: &es_models.Event{},
+			},
+			result: &Org{LoginPolicy: &iam_es_model.LoginPolicy{
+				AllowExternalIdp:      true,
+				AllowRegister:         true,
+				AllowUsernamePassword: true,
+				MultiFactors:          []int32{}}},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.args.mfa != nil {
+				data, _ := json.Marshal(tt.args.mfa)
+				tt.args.event.Data = data
+			}
+			tt.args.org.appendRemoveMultiFactorFromLoginPolicyEvent(tt.args.event)
+			if len(tt.result.LoginPolicy.MultiFactors) != len(tt.args.org.LoginPolicy.MultiFactors) {
+				t.Errorf("got wrong idp mfa len: expected: %v, actual: %v ", len(tt.result.LoginPolicy.MultiFactors), len(tt.args.org.LoginPolicy.MultiFactors))
+			}
+		})
+	}
+}
--- a/internal/org/repository/eventsourcing/model/org.go
+++ b/internal/org/repository/eventsourcing/model/org.go
@@ -199,6 +199,14 @@ func (o *Org) AppendEvent(event *es_models.Event) (err error) {
 		err = o.appendAddIdpProviderToLoginPolicyEvent(event)
 	case LoginPolicyIDPProviderRemoved:
 		err = o.appendRemoveIdpProviderFromLoginPolicyEvent(event)
+	case LoginPolicySecondFactorAdded:
+		err = o.appendAddSecondFactorToLoginPolicyEvent(event)
+	case LoginPolicySecondFactorRemoved:
+		err = o.appendRemoveSecondFactorFromLoginPolicyEvent(event)
+	case LoginPolicyMultiFactorAdded:
+		err = o.appendAddMultiFactorToLoginPolicyEvent(event)
+	case LoginPolicyMultiFactorRemoved:
+		err = o.appendRemoveMultiFactorFromLoginPolicyEvent(event)
 	case PasswordComplexityPolicyAdded:
 		err = o.appendAddPasswordComplexityPolicyEvent(event)
 	case PasswordComplexityPolicyChanged:
--- a/internal/org/repository/eventsourcing/model/types.go
+++ b/internal/org/repository/eventsourcing/model/types.go
@@ -51,9 +51,14 @@ const (
 	LoginPolicyIDPProviderAdded          models.EventType = "org.policy.login.idpprovider.added"
 	LoginPolicyIDPProviderRemoved        models.EventType = "org.policy.login.idpprovider.removed"
 	LoginPolicyIDPProviderCascadeRemoved models.EventType = "org.policy.login.idpprovider.cascade.removed"
-	LabelPolicyAdded                     models.EventType = "org.policy.label.added"
-	LabelPolicyChanged                   models.EventType = "org.policy.label.changed"
-	LabelPolicyRemoved                   models.EventType = "org.policy.label.removed"
+	LoginPolicySecondFactorAdded         models.EventType = "org.policy.login.secondfactor.added"
+	LoginPolicySecondFactorRemoved       models.EventType = "org.policy.login.secondfactor.removed"
+	LoginPolicyMultiFactorAdded          models.EventType = "org.policy.login.multifactor.added"
+	LoginPolicyMultiFactorRemoved        models.EventType = "org.policy.login.multifactor.removed"
+
+	LabelPolicyAdded   models.EventType = "org.policy.label.added"
+	LabelPolicyChanged models.EventType = "org.policy.label.changed"
+	LabelPolicyRemoved models.EventType = "org.policy.label.removed"

 	PasswordComplexityPolicyAdded   models.EventType = "org.policy.password.complexity.added"
 	PasswordComplexityPolicyChanged models.EventType = "org.policy.password.complexity.changed"