Make two-factor authentication (2FA) mandatory for users

BastianHammer · 28 June 2025 03:26

Hello,

I’m sure there is a way - but not via the UI.

Check out this post, about the opposite:

The challenge that I see is, that the values in the DB are encoded. Suite seems to be using an internal encoding logic (not Base64) for that.

If you search for 2FA in the code, you’ll find a possible approach on how to automate this:

github.com

salesagility/SuiteCRM-Core/blob/1ac4f6d6995fc68a0471dd3da7fabc21b6cfd4c4/core/backend/Authentication/Controller/SecurityController.php#L198


      
              $this->cacheManagerHandler->markAsNeedsUpdate('app-metadata-user-preferences-' . $user->getId());
          
              $response = [
                  'two_factor_disabled' => true
              ];
          
              return new Response(json_encode($response), Response::HTTP_OK);
          }
          
          #[Route('/2fa/enable-finalize', name: 'app_2fa_enable_finalize', methods: ["GET", "POST"])]
          public function enableFinalize2fa(#[CurrentUser] ?User $user, Security $security, Request $request, TotpAuthenticatorInterface $totpAuthenticator): Response
          {
              $auth_code = $request->getPayload()->get('auth_code') ?? '';
          
              $correctCode = $totpAuthenticator->checkCode($user, $auth_code);
          
              if ($correctCode) {
                  $this->userHandler->setUserPreference('is_two_factor_enabled', true);
                  $this->preparedStatementHandler->update(
                      'UPDATE users SET is_totp_enabled = true WHERE id = :id',
                      ['id' => $user->getId()],