feat: allow to force MFA local only (#6234)

This PR adds an option to the LoginPolicy to "Force MFA for local users", so that users authenticated through an IDP must not configure (and verify) an MFA.

internal/api/grpc/admin/export.go

@@ -430,6 +430,7 @@ func (s *Server) getLoginPolicy(ctx context.Context, orgID string, orgIDPs []str
 			AllowRegister:              queriedLogin.AllowRegister,
 			AllowExternalIdp:           queriedLogin.AllowExternalIDPs,
 			ForceMfa:                   queriedLogin.ForceMFA,
+			ForceMfaLocalOnly:          queriedLogin.ForceMFALocalOnly,
 			PasswordlessType:           policy_pb.PasswordlessType(queriedLogin.PasswordlessType),
 			HidePasswordReset:          queriedLogin.HidePasswordReset,
 			IgnoreUnknownUsernames:     queriedLogin.IgnoreUnknownUsernames,

internal/api/grpc/admin/login_policy_converter.go

@@ -14,6 +14,7 @@ func updateLoginPolicyToCommand(p *admin_pb.UpdateLoginPolicyRequest) *command.C
 		AllowRegister:              p.AllowRegister,
 		AllowExternalIDP:           p.AllowExternalIdp,
 		ForceMFA:                   p.ForceMfa,
+		ForceMFALocalOnly:          p.ForceMfaLocalOnly,
 		PasswordlessType:           policy_grpc.PasswordlessTypeToDomain(p.PasswordlessType),
 		HidePasswordReset:          p.HidePasswordReset,
 		IgnoreUnknownUsernames:     p.IgnoreUnknownUsernames,

internal/api/grpc/management/policy_login_converter.go

@@ -15,6 +15,7 @@ func AddLoginPolicyToCommand(p *mgmt_pb.AddCustomLoginPolicyRequest) *command.Ad
 		AllowRegister:              p.AllowRegister,
 		AllowExternalIDP:           p.AllowExternalIdp,
 		ForceMFA:                   p.ForceMfa,
+		ForceMFALocalOnly:          p.ForceMfaLocalOnly,
 		PasswordlessType:           policy_grpc.PasswordlessTypeToDomain(p.PasswordlessType),
 		HidePasswordReset:          p.HidePasswordReset,
 		IgnoreUnknownUsernames:     p.IgnoreUnknownUsernames,
@@ -49,6 +50,7 @@ func updateLoginPolicyToCommand(p *mgmt_pb.UpdateCustomLoginPolicyRequest) *comm
 		AllowRegister:              p.AllowRegister,
 		AllowExternalIDP:           p.AllowExternalIdp,
 		ForceMFA:                   p.ForceMfa,
+		ForceMFALocalOnly:          p.ForceMfaLocalOnly,
 		PasswordlessType:           policy_grpc.PasswordlessTypeToDomain(p.PasswordlessType),
 		HidePasswordReset:          p.HidePasswordReset,
 		IgnoreUnknownUsernames:     p.IgnoreUnknownUsernames,

internal/api/grpc/policy/login_policy.go

@@ -18,6 +18,7 @@ func ModelLoginPolicyToPb(policy *query.LoginPolicy) *policy_pb.LoginPolicy {
 		AllowRegister:              policy.AllowRegister,
 		AllowExternalIdp:           policy.AllowExternalIDPs,
 		ForceMfa:                   policy.ForceMFA,
+		ForceMfaLocalOnly:          policy.ForceMFALocalOnly,
 		PasswordlessType:           ModelPasswordlessTypeToPb(policy.PasswordlessType),
 		HidePasswordReset:          policy.HidePasswordReset,
 		IgnoreUnknownUsernames:     policy.IgnoreUnknownUsernames,

internal/api/grpc/settings/v2/settings_converter.go

@@ -8,7 +8,6 @@ import (
 	settings "github.com/zitadel/zitadel/pkg/grpc/settings/v2alpha"
 )
 
-// TODO: ?
 func loginSettingsToPb(current *query.LoginPolicy) *settings.LoginSettings {
 	multi := make([]settings.MultiFactorType, len(current.MultiFactors))
 	for i, typ := range current.MultiFactors {
@@ -24,6 +23,7 @@ func loginSettingsToPb(current *query.LoginPolicy) *settings.LoginSettings {
 		AllowRegister:              current.AllowRegister,
 		AllowExternalIdp:           current.AllowExternalIDPs,
 		ForceMfa:                   current.ForceMFA,
+		ForceMfaLocalOnly:          current.ForceMFALocalOnly,
 		PasskeysType:               passkeysTypeToPb(current.PasswordlessType),
 		HidePasswordReset:          current.HidePasswordReset,
 		IgnoreUnknownUsernames:     current.IgnoreUnknownUsernames,

internal/api/grpc/settings/v2/settings_converter_test.go

@@ -25,6 +25,7 @@ func Test_loginSettingsToPb(t *testing.T) {
 		AllowRegister:              true,
 		AllowExternalIDPs:          true,
 		ForceMFA:                   true,
+		ForceMFALocalOnly:          true,
 		PasswordlessType:           domain.PasswordlessTypeAllowed,
 		HidePasswordReset:          true,
 		IgnoreUnknownUsernames:     true,
@@ -52,6 +53,7 @@ func Test_loginSettingsToPb(t *testing.T) {
 		AllowRegister:              true,
 		AllowExternalIdp:           true,
 		ForceMfa:                   true,
+		ForceMfaLocalOnly:          true,
 		PasskeysType:               settings.PasskeysType_PASSKEYS_TYPE_ALLOWED,
 		HidePasswordReset:          true,
 		IgnoreUnknownUsernames:     true,