Skip to content

M2-07 Identity Provider Integration & MFA Enforcement for Admin Accounts

Milestone: M2 — Platform and Client Admin SOW Reference: FR7, INT8 Requirement Clarity: 🟡 Confirm which IdP(s) are actually required at MVP — SOW Appendix 1 lists Entra ID/Auth0/Okta as illustrative options under INT8, not a hard requirement to support all three Dev Status: 🟡 Partially prototyped — Auth0 login works; MFA enrollment/management has no in-app UI (schema-only via MfaMethod entity)

Overview

Enforce MFA for all admin accounts (highly recommended for all accounts), backed by the confirmed identity provider(s).

Backend Tasks

  • Confirm with Curo which IdP(s) are actually in MVP scope (Auth0 only vs. also Entra ID/Okta)
  • Enforce MFA at the Auth0 tenant/rule level for admin roles — no MFA enforcement exists anywhere yet. Note: the old one-off initialize_admin.ts script referenced here previously is now deprecated; admin bootstrapping runs automatically via AdminBootstrapService (app/backend/src/auth/services/admin-bootstrap.service.ts) on every backend boot, but that service only provisions the Platform Admin's identity and organization — it still does not touch MFA
  • Expose an endpoint to enroll/list/remove a user's MFA methods (MfaMethod entity currently unused outside its own file)

Frontend Tasks

  • Build an MFA enrollment/management screen (QR code for TOTP, etc., depending on confirmed method)
  • Surface "MFA required" messaging/redirect for admin accounts without MFA configured

Dependencies

Acceptance Criteria

  • MFA enforced for admin users
  • Users can authenticate via supported identity provider (per SOW Appendix 3, FR7 acceptance criteria)

Existing Reference Material

Blockers & Risks

  • Needs decision: IdP scope (single vs. multiple) before estimating this task properly.