Livio Spring 8d4f6082ca fix(authz): ignore unready auth methods for mfa requirement check (#11056) ...

# Which Problems Are Solved

The recent
[fix](2a7db64881)
made sure the Zitadel API always requires MFA if a user has set up so
even though not required by the login policy. After the deployment,
multiple users reached out that also users without any MFA set up got
the corresponding `[permission_denied] mfa required (AUTHZ-KI3p0)`error.

# How the Problems Are Solved

- Only check the set up factors with are verified and ready to use.
Ignore all unready auth methods.

# Additional Changes

None

# Additional Context

- relates to
2a7db64881
- closes https://github.com/zitadel/zitadel/issues/11055
- requires backport to v2.71.x, v3.x and v4.x

(cherry picked from commit e4a959c321)

2025-11-11 10:33:18 +01:00

..

action

chore: update crewjam/saml to v0.5.1 (#10652)

2025-10-16 08:04:00 +02:00

admin

fix(actions v1): return org metadata again (#11040)

2025-11-05 15:44:46 +00:00

app/v2beta

chore: fix some eventual consistent integration testing (#10752)

2025-10-16 08:05:43 +02:00

application/v2

feat(api): move application service v2beta to GA (and deprecate v2beta) (#10846)

2025-10-27 08:56:27 +01:00

auth

feat: user profile requests in resource APIs (#10151)

2025-07-04 18:12:59 +02:00

authn

…

authorization

feat(api): move authorization service to v2 (#10914)

2025-10-28 15:09:54 +01:00

change

…

client/middleware

…

event

…

feature

fix: remove legacy events (#10464)

2025-08-21 09:24:03 +02:00

filter

feat: List users by metadata (#10415)

2025-09-15 08:22:53 +02:00

gerrors

feat: exchange gRPC server implementation to connectRPC (#10145)

2025-07-04 14:06:20 +00:00

idp

chore: move gofakeit integration testing calls (#10684)

2025-09-12 10:45:18 +02:00

instance

feat(api): move instance service to v2 (#10919)

2025-10-28 15:10:54 +01:00

internal_permission

feat(api): move internal permission service to GA (and deprecate v2beta) (#10898)

2025-10-27 08:55:55 +01:00

management

fix(actions v1): return org metadata again (#11040)

2025-11-05 15:44:46 +00:00

member

…

metadata

feat: user profile requests in resource APIs (#10151)

2025-07-04 18:12:59 +02:00

object

feat: http provider signing key addition (#10641)

2025-09-15 08:26:41 +02:00

oidc

feat(api): move authorization service to v2 (#10914)

2025-10-28 15:09:54 +01:00

org

fix(actions v1): return org metadata again (#11040)

2025-11-05 15:44:46 +00:00

policy

…

project

feat(api): move project service v2beta to GA (and deprecate v2beta) (#10844)

2025-10-28 15:10:03 +01:00

resources

chore: move gofakeit integration testing calls (#10684)

2025-09-12 10:45:18 +02:00

saml/v2

feat(api): move authorization service to v2 (#10914)

2025-10-28 15:09:54 +01:00

server

fix: sanitize host headers before use

2025-10-29 10:07:05 +01:00

session

fix(authz): ignore unready auth methods for mfa requirement check (#11056)

2025-11-11 10:33:18 +01:00

settings

fix(api): deprecate settings v2beta endpoints (#10909)

2025-10-27 08:58:50 +01:00

system

chore: rehaul DevX (#10571)

2025-10-09 16:53:19 +02:00

text

fix: correct mapping of custom texts (#10725)

2025-10-16 08:04:47 +02:00

user

fix(user): Updating user info when authenticating with external IDP (#11046)

2025-11-11 09:24:31 +01:00

webkey

feat: exchange gRPC server implementation to connectRPC (#10145)

2025-07-04 14:06:20 +00:00

config.go

…

fields.go

…

header_test.go

…

header.go

…

probes_test.go

…

probes.go

…