feat: mfa policy (#913)

* feat: add mfa to login policy

* feat: add mfa to login policy

* feat: add mfa to login policy

* feat: add mfa to login policy

* feat: add mfa to login policy on org

* feat: add mfa to login policy on org

* feat: append events on policy views

* feat: iam login policy mfa definition

* feat: login policies on orgs

* feat: configured mfas in login process

* feat: configured mfas in login process

* Update internal/ui/login/static/i18n/en.yaml

Co-authored-by: Livio Amstutz <[email protected]>

* fix: rename software and hardware mfas

* fix: pr requests

* fix user mfa

* fix: test

* fix: oidc version

* fix: oidc version

* fix: proto gen

Co-authored-by: Livio Amstutz <[email protected]>
Co-authored-by: Max Peintner <[email protected]>

pkg/grpc/admin/admin.pb.authoptions.go

@@ -184,6 +184,36 @@ var AdminService_AuthMethods = authz.MethodMapping{
 		CheckParam: "",
 	},
 
+	"/caos.zitadel.admin.api.v1.AdminService/GetDefaultLoginPolicySecondFactors": authz.Option{
+		Permission: "iam.policy.read",
+		CheckParam: "",
+	},
+
+	"/caos.zitadel.admin.api.v1.AdminService/AddSecondFactorToDefaultLoginPolicy": authz.Option{
+		Permission: "iam.policy.write",
+		CheckParam: "",
+	},
+
+	"/caos.zitadel.admin.api.v1.AdminService/RemoveSecondFactorFromDefaultLoginPolicy": authz.Option{
+		Permission: "iam.policy.write",
+		CheckParam: "",
+	},
+
+	"/caos.zitadel.admin.api.v1.AdminService/GetDefaultLoginPolicyMultiFactors": authz.Option{
+		Permission: "iam.policy.read",
+		CheckParam: "",
+	},
+
+	"/caos.zitadel.admin.api.v1.AdminService/AddMultiFactorToDefaultLoginPolicy": authz.Option{
+		Permission: "iam.policy.write",
+		CheckParam: "",
+	},
+
+	"/caos.zitadel.admin.api.v1.AdminService/RemoveMultiFactorFromDefaultLoginPolicy": authz.Option{
+		Permission: "iam.policy.write",
+		CheckParam: "",
+	},
+
 	"/caos.zitadel.admin.api.v1.AdminService/GetDefaultPasswordComplexityPolicy": authz.Option{
 		Permission: "iam.policy.read",
 		CheckParam: "",

pkg/grpc/admin/admin.pb.validate.go

@@ -4496,6 +4496,8 @@ func (m *DefaultLoginPolicy) Validate() error {
 		}
 	}
 
+	// no validation rules for ForceMfa
+
 	return nil
 }
 
@@ -4569,6 +4571,8 @@ func (m *DefaultLoginPolicyRequest) Validate() error {
 
 	// no validation rules for AllowExternalIdp
 
+	// no validation rules for ForceMfa
+
 	return nil
 }
 
@@ -4734,6 +4738,8 @@ func (m *DefaultLoginPolicyView) Validate() error {
 		}
 	}
 
+	// no validation rules for ForceMfa
+
 	return nil
 }
 
@@ -5035,6 +5041,274 @@ var _ interface {
 	ErrorName() string
 } = IdpProviderSearchRequestValidationError{}
 
+// Validate checks the field values on SecondFactorsResult with the rules
+// defined in the proto definition for this message. If any rules are
+// violated, an error is returned.
+func (m *SecondFactorsResult) Validate() error {
+	if m == nil {
+		return nil
+	}
+
+	return nil
+}
+
+// SecondFactorsResultValidationError is the validation error returned by
+// SecondFactorsResult.Validate if the designated constraints aren't met.
+type SecondFactorsResultValidationError struct {
+	field  string
+	reason string
+	cause  error
+	key    bool
+}
+
+// Field function returns field value.
+func (e SecondFactorsResultValidationError) Field() string { return e.field }
+
+// Reason function returns reason value.
+func (e SecondFactorsResultValidationError) Reason() string { return e.reason }
+
+// Cause function returns cause value.
+func (e SecondFactorsResultValidationError) Cause() error { return e.cause }
+
+// Key function returns key value.
+func (e SecondFactorsResultValidationError) Key() bool { return e.key }
+
+// ErrorName returns error name.
+func (e SecondFactorsResultValidationError) ErrorName() string {
+	return "SecondFactorsResultValidationError"
+}
+
+// Error satisfies the builtin error interface
+func (e SecondFactorsResultValidationError) Error() string {
+	cause := ""
+	if e.cause != nil {
+		cause = fmt.Sprintf(" | caused by: %v", e.cause)
+	}
+
+	key := ""
+	if e.key {
+		key = "key for "
+	}
+
+	return fmt.Sprintf(
+		"invalid %sSecondFactorsResult.%s: %s%s",
+		key,
+		e.field,
+		e.reason,
+		cause)
+}
+
+var _ error = SecondFactorsResultValidationError{}
+
+var _ interface {
+	Field() string
+	Reason() string
+	Key() bool
+	Cause() error
+	ErrorName() string
+} = SecondFactorsResultValidationError{}
+
+// Validate checks the field values on SecondFactor with the rules defined in
+// the proto definition for this message. If any rules are violated, an error
+// is returned.
+func (m *SecondFactor) Validate() error {
+	if m == nil {
+		return nil
+	}
+
+	// no validation rules for SecondFactor
+
+	return nil
+}
+
+// SecondFactorValidationError is the validation error returned by
+// SecondFactor.Validate if the designated constraints aren't met.
+type SecondFactorValidationError struct {
+	field  string
+	reason string
+	cause  error
+	key    bool
+}
+
+// Field function returns field value.
+func (e SecondFactorValidationError) Field() string { return e.field }
+
+// Reason function returns reason value.
+func (e SecondFactorValidationError) Reason() string { return e.reason }
+
+// Cause function returns cause value.
+func (e SecondFactorValidationError) Cause() error { return e.cause }
+
+// Key function returns key value.
+func (e SecondFactorValidationError) Key() bool { return e.key }
+
+// ErrorName returns error name.
+func (e SecondFactorValidationError) ErrorName() string { return "SecondFactorValidationError" }
+
+// Error satisfies the builtin error interface
+func (e SecondFactorValidationError) Error() string {
+	cause := ""
+	if e.cause != nil {
+		cause = fmt.Sprintf(" | caused by: %v", e.cause)
+	}
+
+	key := ""
+	if e.key {
+		key = "key for "
+	}
+
+	return fmt.Sprintf(
+		"invalid %sSecondFactor.%s: %s%s",
+		key,
+		e.field,
+		e.reason,
+		cause)
+}
+
+var _ error = SecondFactorValidationError{}
+
+var _ interface {
+	Field() string
+	Reason() string
+	Key() bool
+	Cause() error
+	ErrorName() string
+} = SecondFactorValidationError{}
+
+// Validate checks the field values on MultiFactorsResult with the rules
+// defined in the proto definition for this message. If any rules are
+// violated, an error is returned.
+func (m *MultiFactorsResult) Validate() error {
+	if m == nil {
+		return nil
+	}
+
+	return nil
+}
+
+// MultiFactorsResultValidationError is the validation error returned by
+// MultiFactorsResult.Validate if the designated constraints aren't met.
+type MultiFactorsResultValidationError struct {
+	field  string
+	reason string
+	cause  error
+	key    bool
+}
+
+// Field function returns field value.
+func (e MultiFactorsResultValidationError) Field() string { return e.field }
+
+// Reason function returns reason value.
+func (e MultiFactorsResultValidationError) Reason() string { return e.reason }
+
+// Cause function returns cause value.
+func (e MultiFactorsResultValidationError) Cause() error { return e.cause }
+
+// Key function returns key value.
+func (e MultiFactorsResultValidationError) Key() bool { return e.key }
+
+// ErrorName returns error name.
+func (e MultiFactorsResultValidationError) ErrorName() string {
+	return "MultiFactorsResultValidationError"
+}
+
+// Error satisfies the builtin error interface
+func (e MultiFactorsResultValidationError) Error() string {
+	cause := ""
+	if e.cause != nil {
+		cause = fmt.Sprintf(" | caused by: %v", e.cause)
+	}
+
+	key := ""
+	if e.key {
+		key = "key for "
+	}
+
+	return fmt.Sprintf(
+		"invalid %sMultiFactorsResult.%s: %s%s",
+		key,
+		e.field,
+		e.reason,
+		cause)
+}
+
+var _ error = MultiFactorsResultValidationError{}
+
+var _ interface {
+	Field() string
+	Reason() string
+	Key() bool
+	Cause() error
+	ErrorName() string
+} = MultiFactorsResultValidationError{}
+
+// Validate checks the field values on MultiFactor with the rules defined in
+// the proto definition for this message. If any rules are violated, an error
+// is returned.
+func (m *MultiFactor) Validate() error {
+	if m == nil {
+		return nil
+	}
+
+	// no validation rules for MultiFactor
+
+	return nil
+}
+
+// MultiFactorValidationError is the validation error returned by
+// MultiFactor.Validate if the designated constraints aren't met.
+type MultiFactorValidationError struct {
+	field  string
+	reason string
+	cause  error
+	key    bool
+}
+
+// Field function returns field value.
+func (e MultiFactorValidationError) Field() string { return e.field }
+
+// Reason function returns reason value.
+func (e MultiFactorValidationError) Reason() string { return e.reason }
+
+// Cause function returns cause value.
+func (e MultiFactorValidationError) Cause() error { return e.cause }
+
+// Key function returns key value.
+func (e MultiFactorValidationError) Key() bool { return e.key }
+
+// ErrorName returns error name.
+func (e MultiFactorValidationError) ErrorName() string { return "MultiFactorValidationError" }
+
+// Error satisfies the builtin error interface
+func (e MultiFactorValidationError) Error() string {
+	cause := ""
+	if e.cause != nil {
+		cause = fmt.Sprintf(" | caused by: %v", e.cause)
+	}
+
+	key := ""
+	if e.key {
+		key = "key for "
+	}
+
+	return fmt.Sprintf(
+		"invalid %sMultiFactor.%s: %s%s",
+		key,
+		e.field,
+		e.reason,
+		cause)
+}
+
+var _ error = MultiFactorValidationError{}
+
+var _ interface {
+	Field() string
+	Reason() string
+	Key() bool
+	Cause() error
+	ErrorName() string
+} = MultiFactorValidationError{}
+
 // Validate checks the field values on DefaultPasswordComplexityPolicy with the
 // rules defined in the proto definition for this message. If any rules are
 // violated, an error is returned.

pkg/grpc/admin/admin.swagger.json

@@ -30,7 +30,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -52,7 +52,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -96,7 +96,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -118,7 +118,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -150,7 +150,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -182,7 +182,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -220,7 +220,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -248,7 +248,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -276,7 +276,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -314,7 +314,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -352,7 +352,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -390,7 +390,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -422,7 +422,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -454,7 +454,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -476,7 +476,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -504,7 +504,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -543,7 +543,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -579,7 +579,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -611,7 +611,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -644,7 +644,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -664,7 +664,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -696,7 +696,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -726,7 +726,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -754,7 +754,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -782,7 +782,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -818,7 +818,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -856,7 +856,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -876,7 +876,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -908,7 +908,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -928,7 +928,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -960,7 +960,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -992,7 +992,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -1024,7 +1024,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -1043,6 +1043,183 @@
         ]
       }
     },
+    "/policies/login/multifactors": {
+      "post": {
+        "operationId": "AdminService_AddMultiFactorToDefaultLoginPolicy",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1MultiFactor"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response",
+            "schema": {
+              "$ref": "#/definitions/runtimeError"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1MultiFactor"
+            }
+          }
+        ],
+        "tags": [
+          "AdminService"
+        ]
+      }
+    },
+    "/policies/login/multifactors/_search": {
+      "get": {
+        "operationId": "AdminService_GetDefaultLoginPolicyMultiFactors",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1MultiFactorsResult"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response",
+            "schema": {
+              "$ref": "#/definitions/runtimeError"
+            }
+          }
+        },
+        "tags": [
+          "AdminService"
+        ]
+      }
+    },
+    "/policies/login/multifactors/{multi_factor}": {
+      "delete": {
+        "operationId": "AdminService_RemoveMultiFactorFromDefaultLoginPolicy",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "properties": {}
+            }
+          },
+          "default": {
+            "description": "An unexpected error response",
+            "schema": {
+              "$ref": "#/definitions/runtimeError"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "multi_factor",
+            "in": "path",
+            "required": true,
+            "type": "string",
+            "enum": [
+              "MULTIFACTORTYPE_UNSPECIFIED",
+              "MULTIFACTORTYPE_U2F_WITH_PIN"
+            ]
+          }
+        ],
+        "tags": [
+          "AdminService"
+        ]
+      }
+    },
+    "/policies/login/secondfactors": {
+      "post": {
+        "operationId": "AdminService_AddSecondFactorToDefaultLoginPolicy",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1SecondFactor"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response",
+            "schema": {
+              "$ref": "#/definitions/runtimeError"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1SecondFactor"
+            }
+          }
+        ],
+        "tags": [
+          "AdminService"
+        ]
+      }
+    },
+    "/policies/login/secondfactors/_search": {
+      "get": {
+        "operationId": "AdminService_GetDefaultLoginPolicySecondFactors",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1SecondFactorsResult"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response",
+            "schema": {
+              "$ref": "#/definitions/runtimeError"
+            }
+          }
+        },
+        "tags": [
+          "AdminService"
+        ]
+      }
+    },
+    "/policies/login/secondfactors/{second_factor}": {
+      "delete": {
+        "operationId": "AdminService_RemoveSecondFactorFromDefaultLoginPolicy",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "properties": {}
+            }
+          },
+          "default": {
+            "description": "An unexpected error response",
+            "schema": {
+              "$ref": "#/definitions/runtimeError"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "second_factor",
+            "in": "path",
+            "required": true,
+            "type": "string",
+            "enum": [
+              "SECONDFACTORTYPE_UNSPECIFIED",
+              "SECONDFACTORTYPE_OTP",
+              "SECONDFACTORTYPE_U2F"
+            ]
+          }
+        ],
+        "tags": [
+          "AdminService"
+        ]
+      }
+    },
     "/policies/password/age": {
       "get": {
         "operationId": "AdminService_GetDefaultPasswordAgePolicy",
@@ -1054,7 +1231,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -1074,7 +1251,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -1106,7 +1283,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -1126,7 +1303,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -1158,7 +1335,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -1178,7 +1355,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -1211,7 +1388,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -1233,7 +1410,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -1255,7 +1432,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -1277,7 +1454,7 @@
             }
           },
           "default": {
-            "description": "An unexpected error response.",
+            "description": "An unexpected error response",
             "schema": {
               "$ref": "#/definitions/runtimeError"
             }
@@ -1398,13 +1575,15 @@
           "type": "string"
         },
         "is_email_verified": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "phone": {
           "type": "string"
         },
         "is_phone_verified": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "country": {
           "type": "string"
@@ -1515,13 +1694,16 @@
       "type": "object",
       "properties": {
         "allow_username_password": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "allow_register": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "allow_external_idp": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "creation_date": {
           "type": "string",
@@ -1530,6 +1712,10 @@
         "change_date": {
           "type": "string",
           "format": "date-time"
+        },
+        "force_mfa": {
+          "type": "boolean",
+          "format": "boolean"
         }
       }
     },
@@ -1537,13 +1723,20 @@
       "type": "object",
       "properties": {
         "allow_username_password": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "allow_register": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "allow_external_idp": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
+        },
+        "force_mfa": {
+          "type": "boolean",
+          "format": "boolean"
         }
       }
     },
@@ -1551,13 +1744,16 @@
       "type": "object",
       "properties": {
         "allow_username_password": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "allow_register": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "allow_external_idp": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "creation_date": {
           "type": "string",
@@ -1566,6 +1762,10 @@
         "change_date": {
           "type": "string",
           "format": "date-time"
+        },
+        "force_mfa": {
+          "type": "boolean",
+          "format": "boolean"
         }
       }
     },
@@ -1632,16 +1832,20 @@
           "format": "uint64"
         },
         "has_uppercase": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "has_lowercase": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "has_number": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "has_symbol": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "creation_date": {
           "type": "string",
@@ -1661,16 +1865,20 @@
           "format": "uint64"
         },
         "has_uppercase": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "has_lowercase": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "has_number": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "has_symbol": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         }
       }
     },
@@ -1682,16 +1890,20 @@
           "format": "uint64"
         },
         "has_uppercase": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "has_lowercase": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "has_number": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "has_symbol": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "creation_date": {
           "type": "string",
@@ -1711,7 +1923,8 @@
           "format": "uint64"
         },
         "show_lockout_failure": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "creation_date": {
           "type": "string",
@@ -1731,7 +1944,8 @@
           "format": "uint64"
         },
         "show_lockout_failure": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         }
       }
     },
@@ -1743,7 +1957,8 @@
           "format": "uint64"
         },
         "show_lockout_failure": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "creation_date": {
           "type": "string",
@@ -1823,13 +2038,15 @@
           "type": "string"
         },
         "is_email_verified": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "phone": {
           "type": "string"
         },
         "is_phone_verified": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "country": {
           "type": "string"
@@ -2300,6 +2517,33 @@
         }
       }
     },
+    "v1MultiFactor": {
+      "type": "object",
+      "properties": {
+        "multi_factor": {
+          "$ref": "#/definitions/v1MultiFactorType"
+        }
+      }
+    },
+    "v1MultiFactorType": {
+      "type": "string",
+      "enum": [
+        "MULTIFACTORTYPE_UNSPECIFIED",
+        "MULTIFACTORTYPE_U2F_WITH_PIN"
+      ],
+      "default": "MULTIFACTORTYPE_UNSPECIFIED"
+    },
+    "v1MultiFactorsResult": {
+      "type": "object",
+      "properties": {
+        "multi_factors": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/v1MultiFactorType"
+          }
+        }
+      }
+    },
     "v1OIDCMappingField": {
       "type": "string",
       "enum": [
@@ -2445,10 +2689,12 @@
           "type": "string"
         },
         "user_login_must_be_domain": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "default": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "sequence": {
           "type": "string",
@@ -2474,7 +2720,8 @@
           "type": "string"
         },
         "user_login_must_be_domain": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         }
       }
     },
@@ -2485,10 +2732,12 @@
           "type": "string"
         },
         "user_login_must_be_domain": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "default": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "sequence": {
           "type": "string",
@@ -2552,7 +2801,8 @@
           "$ref": "#/definitions/v1OrgSearchKey"
         },
         "asc": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         },
         "queries": {
           "type": "array",
@@ -2641,11 +2891,40 @@
       ],
       "default": "SEARCHMETHOD_EQUALS"
     },
+    "v1SecondFactor": {
+      "type": "object",
+      "properties": {
+        "second_factor": {
+          "$ref": "#/definitions/v1SecondFactorType"
+        }
+      }
+    },
+    "v1SecondFactorType": {
+      "type": "string",
+      "enum": [
+        "SECONDFACTORTYPE_UNSPECIFIED",
+        "SECONDFACTORTYPE_OTP",
+        "SECONDFACTORTYPE_U2F"
+      ],
+      "default": "SECONDFACTORTYPE_UNSPECIFIED"
+    },
+    "v1SecondFactorsResult": {
+      "type": "object",
+      "properties": {
+        "second_factors": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/v1SecondFactorType"
+          }
+        }
+      }
+    },
     "v1UniqueOrgResponse": {
       "type": "object",
       "properties": {
         "is_unique": {
-          "type": "boolean"
+          "type": "boolean",
+          "format": "boolean"
         }
       }
     },

pkg/grpc/admin/mock/admin.proto.mock.go

@@ -77,6 +77,46 @@ func (mr *MockAdminServiceClientMockRecorder) AddIdpProviderToDefaultLoginPolicy
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddIdpProviderToDefaultLoginPolicy", reflect.TypeOf((*MockAdminServiceClient)(nil).AddIdpProviderToDefaultLoginPolicy), varargs...)
 }
 
+// AddMultiFactorToDefaultLoginPolicy mocks base method
+func (m *MockAdminServiceClient) AddMultiFactorToDefaultLoginPolicy(arg0 context.Context, arg1 *admin.MultiFactor, arg2 ...grpc.CallOption) (*admin.MultiFactor, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0, arg1}
+	for _, a := range arg2 {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "AddMultiFactorToDefaultLoginPolicy", varargs...)
+	ret0, _ := ret[0].(*admin.MultiFactor)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// AddMultiFactorToDefaultLoginPolicy indicates an expected call of AddMultiFactorToDefaultLoginPolicy
+func (mr *MockAdminServiceClientMockRecorder) AddMultiFactorToDefaultLoginPolicy(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0, arg1}, arg2...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddMultiFactorToDefaultLoginPolicy", reflect.TypeOf((*MockAdminServiceClient)(nil).AddMultiFactorToDefaultLoginPolicy), varargs...)
+}
+
+// AddSecondFactorToDefaultLoginPolicy mocks base method
+func (m *MockAdminServiceClient) AddSecondFactorToDefaultLoginPolicy(arg0 context.Context, arg1 *admin.SecondFactor, arg2 ...grpc.CallOption) (*admin.SecondFactor, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0, arg1}
+	for _, a := range arg2 {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "AddSecondFactorToDefaultLoginPolicy", varargs...)
+	ret0, _ := ret[0].(*admin.SecondFactor)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// AddSecondFactorToDefaultLoginPolicy indicates an expected call of AddSecondFactorToDefaultLoginPolicy
+func (mr *MockAdminServiceClientMockRecorder) AddSecondFactorToDefaultLoginPolicy(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0, arg1}, arg2...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddSecondFactorToDefaultLoginPolicy", reflect.TypeOf((*MockAdminServiceClient)(nil).AddSecondFactorToDefaultLoginPolicy), varargs...)
+}
+
 // ChangeIamMember mocks base method
 func (m *MockAdminServiceClient) ChangeIamMember(arg0 context.Context, arg1 *admin.ChangeIamMemberRequest, arg2 ...grpc.CallOption) (*admin.IamMember, error) {
 	m.ctrl.T.Helper()
@@ -237,6 +277,46 @@ func (mr *MockAdminServiceClientMockRecorder) GetDefaultLoginPolicyIdpProviders(
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetDefaultLoginPolicyIdpProviders", reflect.TypeOf((*MockAdminServiceClient)(nil).GetDefaultLoginPolicyIdpProviders), varargs...)
 }
 
+// GetDefaultLoginPolicyMultiFactors mocks base method
+func (m *MockAdminServiceClient) GetDefaultLoginPolicyMultiFactors(arg0 context.Context, arg1 *emptypb.Empty, arg2 ...grpc.CallOption) (*admin.MultiFactorsResult, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0, arg1}
+	for _, a := range arg2 {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "GetDefaultLoginPolicyMultiFactors", varargs...)
+	ret0, _ := ret[0].(*admin.MultiFactorsResult)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetDefaultLoginPolicyMultiFactors indicates an expected call of GetDefaultLoginPolicyMultiFactors
+func (mr *MockAdminServiceClientMockRecorder) GetDefaultLoginPolicyMultiFactors(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0, arg1}, arg2...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetDefaultLoginPolicyMultiFactors", reflect.TypeOf((*MockAdminServiceClient)(nil).GetDefaultLoginPolicyMultiFactors), varargs...)
+}
+
+// GetDefaultLoginPolicySecondFactors mocks base method
+func (m *MockAdminServiceClient) GetDefaultLoginPolicySecondFactors(arg0 context.Context, arg1 *emptypb.Empty, arg2 ...grpc.CallOption) (*admin.SecondFactorsResult, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0, arg1}
+	for _, a := range arg2 {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "GetDefaultLoginPolicySecondFactors", varargs...)
+	ret0, _ := ret[0].(*admin.SecondFactorsResult)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetDefaultLoginPolicySecondFactors indicates an expected call of GetDefaultLoginPolicySecondFactors
+func (mr *MockAdminServiceClientMockRecorder) GetDefaultLoginPolicySecondFactors(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0, arg1}, arg2...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetDefaultLoginPolicySecondFactors", reflect.TypeOf((*MockAdminServiceClient)(nil).GetDefaultLoginPolicySecondFactors), varargs...)
+}
+
 // GetDefaultOrgIamPolicy mocks base method
 func (m *MockAdminServiceClient) GetDefaultOrgIamPolicy(arg0 context.Context, arg1 *emptypb.Empty, arg2 ...grpc.CallOption) (*admin.OrgIamPolicyView, error) {
 	m.ctrl.T.Helper()
@@ -597,6 +677,26 @@ func (mr *MockAdminServiceClientMockRecorder) RemoveIdpProviderFromDefaultLoginP
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveIdpProviderFromDefaultLoginPolicy", reflect.TypeOf((*MockAdminServiceClient)(nil).RemoveIdpProviderFromDefaultLoginPolicy), varargs...)
 }
 
+// RemoveMultiFactorFromDefaultLoginPolicy mocks base method
+func (m *MockAdminServiceClient) RemoveMultiFactorFromDefaultLoginPolicy(arg0 context.Context, arg1 *admin.MultiFactor, arg2 ...grpc.CallOption) (*emptypb.Empty, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0, arg1}
+	for _, a := range arg2 {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "RemoveMultiFactorFromDefaultLoginPolicy", varargs...)
+	ret0, _ := ret[0].(*emptypb.Empty)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// RemoveMultiFactorFromDefaultLoginPolicy indicates an expected call of RemoveMultiFactorFromDefaultLoginPolicy
+func (mr *MockAdminServiceClientMockRecorder) RemoveMultiFactorFromDefaultLoginPolicy(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0, arg1}, arg2...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveMultiFactorFromDefaultLoginPolicy", reflect.TypeOf((*MockAdminServiceClient)(nil).RemoveMultiFactorFromDefaultLoginPolicy), varargs...)
+}
+
 // RemoveOrgIamPolicy mocks base method
 func (m *MockAdminServiceClient) RemoveOrgIamPolicy(arg0 context.Context, arg1 *admin.OrgIamPolicyID, arg2 ...grpc.CallOption) (*emptypb.Empty, error) {
 	m.ctrl.T.Helper()
@@ -617,6 +717,26 @@ func (mr *MockAdminServiceClientMockRecorder) RemoveOrgIamPolicy(arg0, arg1 inte
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveOrgIamPolicy", reflect.TypeOf((*MockAdminServiceClient)(nil).RemoveOrgIamPolicy), varargs...)
 }
 
+// RemoveSecondFactorFromDefaultLoginPolicy mocks base method
+func (m *MockAdminServiceClient) RemoveSecondFactorFromDefaultLoginPolicy(arg0 context.Context, arg1 *admin.SecondFactor, arg2 ...grpc.CallOption) (*emptypb.Empty, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0, arg1}
+	for _, a := range arg2 {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "RemoveSecondFactorFromDefaultLoginPolicy", varargs...)
+	ret0, _ := ret[0].(*emptypb.Empty)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// RemoveSecondFactorFromDefaultLoginPolicy indicates an expected call of RemoveSecondFactorFromDefaultLoginPolicy
+func (mr *MockAdminServiceClientMockRecorder) RemoveSecondFactorFromDefaultLoginPolicy(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0, arg1}, arg2...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveSecondFactorFromDefaultLoginPolicy", reflect.TypeOf((*MockAdminServiceClient)(nil).RemoveSecondFactorFromDefaultLoginPolicy), varargs...)
+}
+
 // SearchIamMembers mocks base method
 func (m *MockAdminServiceClient) SearchIamMembers(arg0 context.Context, arg1 *admin.IamMemberSearchRequest, arg2 ...grpc.CallOption) (*admin.IamMemberSearchResponse, error) {
 	m.ctrl.T.Helper()

pkg/grpc/admin/proto/admin.proto

@@ -416,6 +416,68 @@ service AdminService {
         };
     }
 
+    rpc GetDefaultLoginPolicySecondFactors(google.protobuf.Empty) returns (SecondFactorsResult) {
+        option (google.api.http) = {
+            get: "/policies/login/secondfactors/_search"
+        };
+
+        option (caos.zitadel.utils.v1.auth_option) = {
+            permission: "iam.policy.read"
+        };
+    }
+
+    rpc AddSecondFactorToDefaultLoginPolicy(SecondFactor) returns (SecondFactor) {
+        option (google.api.http) = {
+            post: "/policies/login/secondfactors"
+            body: "*"
+        };
+
+        option (caos.zitadel.utils.v1.auth_option) = {
+            permission: "iam.policy.write"
+        };
+    }
+
+    rpc RemoveSecondFactorFromDefaultLoginPolicy(SecondFactor) returns (google.protobuf.Empty) {
+        option (google.api.http) = {
+            delete: "/policies/login/secondfactors/{second_factor}"
+        };
+
+        option (caos.zitadel.utils.v1.auth_option) = {
+            permission: "iam.policy.write"
+        };
+    }
+
+    rpc GetDefaultLoginPolicyMultiFactors(google.protobuf.Empty) returns (MultiFactorsResult) {
+        option (google.api.http) = {
+            get: "/policies/login/multifactors/_search"
+        };
+
+        option (caos.zitadel.utils.v1.auth_option) = {
+            permission: "iam.policy.read"
+        };
+    }
+
+    rpc AddMultiFactorToDefaultLoginPolicy(MultiFactor) returns (MultiFactor) {
+        option (google.api.http) = {
+            post: "/policies/login/multifactors"
+            body: "*"
+        };
+
+        option (caos.zitadel.utils.v1.auth_option) = {
+            permission: "iam.policy.write"
+        };
+    }
+
+    rpc RemoveMultiFactorFromDefaultLoginPolicy(MultiFactor) returns (google.protobuf.Empty) {
+        option (google.api.http) = {
+            delete: "/policies/login/multifactors/{multi_factor}"
+        };
+
+        option (caos.zitadel.utils.v1.auth_option) = {
+            permission: "iam.policy.write"
+        };
+    }
+
     rpc GetDefaultPasswordComplexityPolicy(google.protobuf.Empty) returns (DefaultPasswordComplexityPolicyView) {
         option (google.api.http) = {
             get: "/policies/password/complexity"
@@ -949,12 +1011,14 @@ message DefaultLoginPolicy {
     bool allow_external_idp = 3;
     google.protobuf.Timestamp creation_date = 4;
     google.protobuf.Timestamp change_date = 5;
+    bool force_mfa = 6;
 }
 
 message DefaultLoginPolicyRequest {
     bool allow_username_password = 1;
     bool allow_register = 2;
     bool allow_external_idp = 3;
+    bool force_mfa = 4;
 }
 
 message IdpProviderID {
@@ -967,6 +1031,7 @@ message DefaultLoginPolicyView {
     bool allow_external_idp = 3;
     google.protobuf.Timestamp creation_date = 4;
     google.protobuf.Timestamp change_date = 5;
+    bool force_mfa = 6;
 }
 
 message IdpProviderView {
@@ -995,6 +1060,33 @@ message IdpProviderSearchRequest {
     uint64 limit = 2;
 }
 
+message SecondFactorsResult {
+    repeated SecondFactorType second_factors = 1;
+}
+
+message SecondFactor {
+    SecondFactorType second_factor = 1;
+}
+
+enum SecondFactorType {
+    SECONDFACTORTYPE_UNSPECIFIED = 0;
+    SECONDFACTORTYPE_OTP = 1;
+    SECONDFACTORTYPE_U2F = 2;
+}
+
+message MultiFactorsResult {
+    repeated MultiFactorType multi_factors = 1;
+}
+
+message MultiFactor {
+    MultiFactorType multi_factor = 1;
+}
+
+enum MultiFactorType {
+    MULTIFACTORTYPE_UNSPECIFIED = 0;
+    MULTIFACTORTYPE_U2F_WITH_PIN = 1;
+}
+
 message DefaultPasswordComplexityPolicy {
     uint64 min_length = 1;
     bool has_uppercase = 2;

pkg/grpc/management/management.pb.authoptions.go

@@ -609,6 +609,36 @@ var ManagementService_AuthMethods = authz.MethodMapping{
 		CheckParam: "",
 	},
 
+	"/caos.zitadel.management.api.v1.ManagementService/GetLoginPolicySecondFactors": authz.Option{
+		Permission: "iam.policy.read",
+		CheckParam: "",
+	},
+
+	"/caos.zitadel.management.api.v1.ManagementService/AddSecondFactorToLoginPolicy": authz.Option{
+		Permission: "iam.policy.write",
+		CheckParam: "",
+	},
+
+	"/caos.zitadel.management.api.v1.ManagementService/RemoveSecondFactorFromLoginPolicy": authz.Option{
+		Permission: "iam.policy.write",
+		CheckParam: "",
+	},
+
+	"/caos.zitadel.management.api.v1.ManagementService/GetLoginPolicyMultiFactors": authz.Option{
+		Permission: "iam.policy.read",
+		CheckParam: "",
+	},
+
+	"/caos.zitadel.management.api.v1.ManagementService/AddMultiFactorToLoginPolicy": authz.Option{
+		Permission: "iam.policy.write",
+		CheckParam: "",
+	},
+
+	"/caos.zitadel.management.api.v1.ManagementService/RemoveMultiFactorFromLoginPolicy": authz.Option{
+		Permission: "iam.policy.write",
+		CheckParam: "",
+	},
+
 	"/caos.zitadel.management.api.v1.ManagementService/GetPasswordComplexityPolicy": authz.Option{
 		Permission: "policy.read",
 		CheckParam: "",

pkg/grpc/management/management.pb.gw.go

@@ -7416,6 +7416,230 @@ func local_request_ManagementService_RemoveIdpProviderFromLoginPolicy_0(ctx cont
 
 }
 
+func request_ManagementService_GetLoginPolicySecondFactors_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq empty.Empty
+	var metadata runtime.ServerMetadata
+
+	msg, err := client.GetLoginPolicySecondFactors(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_ManagementService_GetLoginPolicySecondFactors_0(ctx context.Context, marshaler runtime.Marshaler, server ManagementServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq empty.Empty
+	var metadata runtime.ServerMetadata
+
+	msg, err := server.GetLoginPolicySecondFactors(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_ManagementService_AddSecondFactorToLoginPolicy_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq SecondFactor
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.AddSecondFactorToLoginPolicy(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_ManagementService_AddSecondFactorToLoginPolicy_0(ctx context.Context, marshaler runtime.Marshaler, server ManagementServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq SecondFactor
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.AddSecondFactorToLoginPolicy(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_ManagementService_RemoveSecondFactorFromLoginPolicy_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq SecondFactor
+	var metadata runtime.ServerMetadata
+
+	var (
+		val string
+		e   int32
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["second_factor"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "second_factor")
+	}
+
+	e, err = runtime.Enum(val, SecondFactorType_value)
+
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "second_factor", err)
+	}
+
+	protoReq.SecondFactor = SecondFactorType(e)
+
+	msg, err := client.RemoveSecondFactorFromLoginPolicy(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_ManagementService_RemoveSecondFactorFromLoginPolicy_0(ctx context.Context, marshaler runtime.Marshaler, server ManagementServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq SecondFactor
+	var metadata runtime.ServerMetadata
+
+	var (
+		val string
+		e   int32
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["second_factor"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "second_factor")
+	}
+
+	e, err = runtime.Enum(val, SecondFactorType_value)
+
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "second_factor", err)
+	}
+
+	protoReq.SecondFactor = SecondFactorType(e)
+
+	msg, err := server.RemoveSecondFactorFromLoginPolicy(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_ManagementService_GetLoginPolicyMultiFactors_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq empty.Empty
+	var metadata runtime.ServerMetadata
+
+	msg, err := client.GetLoginPolicyMultiFactors(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_ManagementService_GetLoginPolicyMultiFactors_0(ctx context.Context, marshaler runtime.Marshaler, server ManagementServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq empty.Empty
+	var metadata runtime.ServerMetadata
+
+	msg, err := server.GetLoginPolicyMultiFactors(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_ManagementService_AddMultiFactorToLoginPolicy_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq MultiFactor
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.AddMultiFactorToLoginPolicy(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_ManagementService_AddMultiFactorToLoginPolicy_0(ctx context.Context, marshaler runtime.Marshaler, server ManagementServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq MultiFactor
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.AddMultiFactorToLoginPolicy(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_ManagementService_RemoveMultiFactorFromLoginPolicy_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq MultiFactor
+	var metadata runtime.ServerMetadata
+
+	var (
+		val string
+		e   int32
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["multi_factor"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "multi_factor")
+	}
+
+	e, err = runtime.Enum(val, MultiFactorType_value)
+
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "multi_factor", err)
+	}
+
+	protoReq.MultiFactor = MultiFactorType(e)
+
+	msg, err := client.RemoveMultiFactorFromLoginPolicy(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_ManagementService_RemoveMultiFactorFromLoginPolicy_0(ctx context.Context, marshaler runtime.Marshaler, server ManagementServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq MultiFactor
+	var metadata runtime.ServerMetadata
+
+	var (
+		val string
+		e   int32
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["multi_factor"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "multi_factor")
+	}
+
+	e, err = runtime.Enum(val, MultiFactorType_value)
+
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "multi_factor", err)
+	}
+
+	protoReq.MultiFactor = MultiFactorType(e)
+
+	msg, err := server.RemoveMultiFactorFromLoginPolicy(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
 func request_ManagementService_GetPasswordComplexityPolicy_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
 	var protoReq empty.Empty
 	var metadata runtime.ServerMetadata
@@ -10247,6 +10471,126 @@ func RegisterManagementServiceHandlerServer(ctx context.Context, mux *runtime.Se
 
 	})
 
+	mux.Handle("GET", pattern_ManagementService_GetLoginPolicySecondFactors_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateIncomingContext(ctx, mux, req)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ManagementService_GetLoginPolicySecondFactors_0(rctx, inboundMarshaler, server, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_GetLoginPolicySecondFactors_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_AddSecondFactorToLoginPolicy_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateIncomingContext(ctx, mux, req)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ManagementService_AddSecondFactorToLoginPolicy_0(rctx, inboundMarshaler, server, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_AddSecondFactorToLoginPolicy_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("DELETE", pattern_ManagementService_RemoveSecondFactorFromLoginPolicy_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateIncomingContext(ctx, mux, req)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ManagementService_RemoveSecondFactorFromLoginPolicy_0(rctx, inboundMarshaler, server, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_RemoveSecondFactorFromLoginPolicy_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("GET", pattern_ManagementService_GetLoginPolicyMultiFactors_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateIncomingContext(ctx, mux, req)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ManagementService_GetLoginPolicyMultiFactors_0(rctx, inboundMarshaler, server, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_GetLoginPolicyMultiFactors_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_AddMultiFactorToLoginPolicy_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateIncomingContext(ctx, mux, req)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ManagementService_AddMultiFactorToLoginPolicy_0(rctx, inboundMarshaler, server, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_AddMultiFactorToLoginPolicy_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("DELETE", pattern_ManagementService_RemoveMultiFactorFromLoginPolicy_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateIncomingContext(ctx, mux, req)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ManagementService_RemoveMultiFactorFromLoginPolicy_0(rctx, inboundMarshaler, server, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_RemoveMultiFactorFromLoginPolicy_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
 	mux.Handle("GET", pattern_ManagementService_GetPasswordComplexityPolicy_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
@@ -13048,6 +13392,126 @@ func RegisterManagementServiceHandlerClient(ctx context.Context, mux *runtime.Se
 
 	})
 
+	mux.Handle("GET", pattern_ManagementService_GetLoginPolicySecondFactors_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_GetLoginPolicySecondFactors_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_GetLoginPolicySecondFactors_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_AddSecondFactorToLoginPolicy_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_AddSecondFactorToLoginPolicy_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_AddSecondFactorToLoginPolicy_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("DELETE", pattern_ManagementService_RemoveSecondFactorFromLoginPolicy_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_RemoveSecondFactorFromLoginPolicy_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_RemoveSecondFactorFromLoginPolicy_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("GET", pattern_ManagementService_GetLoginPolicyMultiFactors_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_GetLoginPolicyMultiFactors_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_GetLoginPolicyMultiFactors_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_AddMultiFactorToLoginPolicy_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_AddMultiFactorToLoginPolicy_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_AddMultiFactorToLoginPolicy_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("DELETE", pattern_ManagementService_RemoveMultiFactorFromLoginPolicy_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_RemoveMultiFactorFromLoginPolicy_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_RemoveMultiFactorFromLoginPolicy_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
 	mux.Handle("GET", pattern_ManagementService_GetPasswordComplexityPolicy_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
@@ -13598,6 +14062,18 @@ var (
 
 	pattern_ManagementService_RemoveIdpProviderFromLoginPolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4, 1, 0, 4, 1, 5, 5}, []string{"orgs", "me", "policies", "login", "idpproviders", "idp_config_id"}, "", runtime.AssumeColonVerbOpt(true)))
 
+	pattern_ManagementService_GetLoginPolicySecondFactors_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4, 2, 5}, []string{"orgs", "me", "policies", "login", "secondfactors", "_search"}, "", runtime.AssumeColonVerbOpt(true)))
+
+	pattern_ManagementService_AddSecondFactorToLoginPolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4}, []string{"orgs", "me", "policies", "login", "secondfactors"}, "", runtime.AssumeColonVerbOpt(true)))
+
+	pattern_ManagementService_RemoveSecondFactorFromLoginPolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4, 1, 0, 4, 1, 5, 5}, []string{"orgs", "me", "policies", "login", "secondfactors", "second_factor"}, "", runtime.AssumeColonVerbOpt(true)))
+
+	pattern_ManagementService_GetLoginPolicyMultiFactors_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4, 2, 5}, []string{"orgs", "me", "policies", "login", "multifactors", "_search"}, "", runtime.AssumeColonVerbOpt(true)))
+
+	pattern_ManagementService_AddMultiFactorToLoginPolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4}, []string{"orgs", "me", "policies", "login", "multifactors"}, "", runtime.AssumeColonVerbOpt(true)))
+
+	pattern_ManagementService_RemoveMultiFactorFromLoginPolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4, 1, 0, 4, 1, 5, 5}, []string{"orgs", "me", "policies", "login", "multifactors", "multi_factor"}, "", runtime.AssumeColonVerbOpt(true)))
+
 	pattern_ManagementService_GetPasswordComplexityPolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4}, []string{"orgs", "me", "policies", "password", "complexity"}, "", runtime.AssumeColonVerbOpt(true)))
 
 	pattern_ManagementService_GetDefaultPasswordComplexityPolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4}, []string{"orgs", "default", "policies", "password", "complexity"}, "", runtime.AssumeColonVerbOpt(true)))
@@ -13876,6 +14352,18 @@ var (
 
 	forward_ManagementService_RemoveIdpProviderFromLoginPolicy_0 = runtime.ForwardResponseMessage
 
+	forward_ManagementService_GetLoginPolicySecondFactors_0 = runtime.ForwardResponseMessage
+
+	forward_ManagementService_AddSecondFactorToLoginPolicy_0 = runtime.ForwardResponseMessage
+
+	forward_ManagementService_RemoveSecondFactorFromLoginPolicy_0 = runtime.ForwardResponseMessage
+
+	forward_ManagementService_GetLoginPolicyMultiFactors_0 = runtime.ForwardResponseMessage
+
+	forward_ManagementService_AddMultiFactorToLoginPolicy_0 = runtime.ForwardResponseMessage
+
+	forward_ManagementService_RemoveMultiFactorFromLoginPolicy_0 = runtime.ForwardResponseMessage
+
 	forward_ManagementService_GetPasswordComplexityPolicy_0 = runtime.ForwardResponseMessage
 
 	forward_ManagementService_GetDefaultPasswordComplexityPolicy_0 = runtime.ForwardResponseMessage

pkg/grpc/management/management.pb.validate.go

@@ -4011,10 +4011,10 @@ var _ interface {
 	ErrorName() string
 } = UpdateUserAddressRequestValidationError{}
 
-// Validate checks the field values on MultiFactors with the rules defined in
-// the proto definition for this message. If any rules are violated, an error
-// is returned.
-func (m *MultiFactors) Validate() error {
+// Validate checks the field values on UserMultiFactors with the rules defined
+// in the proto definition for this message. If any rules are violated, an
+// error is returned.
+func (m *UserMultiFactors) Validate() error {
 	if m == nil {
 		return nil
 	}
@@ -4024,7 +4024,7 @@ func (m *MultiFactors) Validate() error {
 
 		if v, ok := interface{}(item).(interface{ Validate() error }); ok {
 			if err := v.Validate(); err != nil {
-				return MultiFactorsValidationError{
+				return UserMultiFactorsValidationError{
 					field:  fmt.Sprintf("Mfas[%v]", idx),
 					reason: "embedded message failed validation",
 					cause:  err,
@@ -4037,9 +4037,9 @@ func (m *MultiFactors) Validate() error {
 	return nil
 }
 
-// MultiFactorsValidationError is the validation error returned by
-// MultiFactors.Validate if the designated constraints aren't met.
-type MultiFactorsValidationError struct {
+// UserMultiFactorsValidationError is the validation error returned by
+// UserMultiFactors.Validate if the designated constraints aren't met.
+type UserMultiFactorsValidationError struct {
 	field  string
 	reason string
 	cause  error
@@ -4047,22 +4047,22 @@ type MultiFactorsValidationError struct {
 }
 
 // Field function returns field value.
-func (e MultiFactorsValidationError) Field() string { return e.field }
+func (e UserMultiFactorsValidationError) Field() string { return e.field }
 
 // Reason function returns reason value.
-func (e MultiFactorsValidationError) Reason() string { return e.reason }
+func (e UserMultiFactorsValidationError) Reason() string { return e.reason }
 
 // Cause function returns cause value.
-func (e MultiFactorsValidationError) Cause() error { return e.cause }
+func (e UserMultiFactorsValidationError) Cause() error { return e.cause }
 
 // Key function returns key value.
-func (e MultiFactorsValidationError) Key() bool { return e.key }
+func (e UserMultiFactorsValidationError) Key() bool { return e.key }
 
 // ErrorName returns error name.
-func (e MultiFactorsValidationError) ErrorName() string { return "MultiFactorsValidationError" }
+func (e UserMultiFactorsValidationError) ErrorName() string { return "UserMultiFactorsValidationError" }
 
 // Error satisfies the builtin error interface
-func (e MultiFactorsValidationError) Error() string {
+func (e UserMultiFactorsValidationError) Error() string {
 	cause := ""
 	if e.cause != nil {
 		cause = fmt.Sprintf(" | caused by: %v", e.cause)
@@ -4074,14 +4074,14 @@ func (e MultiFactorsValidationError) Error() string {
 	}
 
 	return fmt.Sprintf(
-		"invalid %sMultiFactors.%s: %s%s",
+		"invalid %sUserMultiFactors.%s: %s%s",
 		key,
 		e.field,
 		e.reason,
 		cause)
 }
 
-var _ error = MultiFactorsValidationError{}
+var _ error = UserMultiFactorsValidationError{}
 
 var _ interface {
 	Field() string
@@ -4089,12 +4089,12 @@ var _ interface {
 	Key() bool
 	Cause() error
 	ErrorName() string
-} = MultiFactorsValidationError{}
+} = UserMultiFactorsValidationError{}
 
-// Validate checks the field values on MultiFactor with the rules defined in
-// the proto definition for this message. If any rules are violated, an error
-// is returned.
-func (m *MultiFactor) Validate() error {
+// Validate checks the field values on UserMultiFactor with the rules defined
+// in the proto definition for this message. If any rules are violated, an
+// error is returned.
+func (m *UserMultiFactor) Validate() error {
 	if m == nil {
 		return nil
 	}
@@ -4106,9 +4106,9 @@ func (m *MultiFactor) Validate() error {
 	return nil
 }
 
-// MultiFactorValidationError is the validation error returned by
-// MultiFactor.Validate if the designated constraints aren't met.
-type MultiFactorValidationError struct {
+// UserMultiFactorValidationError is the validation error returned by
+// UserMultiFactor.Validate if the designated constraints aren't met.
+type UserMultiFactorValidationError struct {
 	field  string
 	reason string
 	cause  error
@@ -4116,22 +4116,22 @@ type MultiFactorValidationError struct {
 }
 
 // Field function returns field value.
-func (e MultiFactorValidationError) Field() string { return e.field }
+func (e UserMultiFactorValidationError) Field() string { return e.field }
 
 // Reason function returns reason value.
-func (e MultiFactorValidationError) Reason() string { return e.reason }
+func (e UserMultiFactorValidationError) Reason() string { return e.reason }
 
 // Cause function returns cause value.
-func (e MultiFactorValidationError) Cause() error { return e.cause }
+func (e UserMultiFactorValidationError) Cause() error { return e.cause }
 
 // Key function returns key value.
-func (e MultiFactorValidationError) Key() bool { return e.key }
+func (e UserMultiFactorValidationError) Key() bool { return e.key }
 
 // ErrorName returns error name.
-func (e MultiFactorValidationError) ErrorName() string { return "MultiFactorValidationError" }
+func (e UserMultiFactorValidationError) ErrorName() string { return "UserMultiFactorValidationError" }
 
 // Error satisfies the builtin error interface
-func (e MultiFactorValidationError) Error() string {
+func (e UserMultiFactorValidationError) Error() string {
 	cause := ""
 	if e.cause != nil {
 		cause = fmt.Sprintf(" | caused by: %v", e.cause)
@@ -4143,14 +4143,14 @@ func (e MultiFactorValidationError) Error() string {
 	}
 
 	return fmt.Sprintf(
-		"invalid %sMultiFactor.%s: %s%s",
+		"invalid %sUserMultiFactor.%s: %s%s",
 		key,
 		e.field,
 		e.reason,
 		cause)
 }
 
-var _ error = MultiFactorValidationError{}
+var _ error = UserMultiFactorValidationError{}
 
 var _ interface {
 	Field() string
@@ -4158,7 +4158,7 @@ var _ interface {
 	Key() bool
 	Cause() error
 	ErrorName() string
-} = MultiFactorValidationError{}
+} = UserMultiFactorValidationError{}
 
 // Validate checks the field values on PasswordRequest with the rules defined
 // in the proto definition for this message. If any rules are violated, an
@@ -13383,6 +13383,8 @@ func (m *LoginPolicy) Validate() error {
 		}
 	}
 
+	// no validation rules for ForceMfa
+
 	return nil
 }
 
@@ -13454,6 +13456,8 @@ func (m *LoginPolicyRequest) Validate() error {
 
 	// no validation rules for AllowExternalIdp
 
+	// no validation rules for ForceMfa
+
 	return nil
 }
 
@@ -13773,6 +13777,8 @@ func (m *LoginPolicyView) Validate() error {
 		}
 	}
 
+	// no validation rules for ForceMfa
+
 	return nil
 }
 
@@ -14413,6 +14419,274 @@ var _ interface {
 	ErrorName() string
 } = ExternalIDPRemoveRequestValidationError{}
 
+// Validate checks the field values on SecondFactorsResult with the rules
+// defined in the proto definition for this message. If any rules are
+// violated, an error is returned.
+func (m *SecondFactorsResult) Validate() error {
+	if m == nil {
+		return nil
+	}
+
+	return nil
+}
+
+// SecondFactorsResultValidationError is the validation error returned by
+// SecondFactorsResult.Validate if the designated constraints aren't met.
+type SecondFactorsResultValidationError struct {
+	field  string
+	reason string
+	cause  error
+	key    bool
+}
+
+// Field function returns field value.
+func (e SecondFactorsResultValidationError) Field() string { return e.field }
+
+// Reason function returns reason value.
+func (e SecondFactorsResultValidationError) Reason() string { return e.reason }
+
+// Cause function returns cause value.
+func (e SecondFactorsResultValidationError) Cause() error { return e.cause }
+
+// Key function returns key value.
+func (e SecondFactorsResultValidationError) Key() bool { return e.key }
+
+// ErrorName returns error name.
+func (e SecondFactorsResultValidationError) ErrorName() string {
+	return "SecondFactorsResultValidationError"
+}
+
+// Error satisfies the builtin error interface
+func (e SecondFactorsResultValidationError) Error() string {
+	cause := ""
+	if e.cause != nil {
+		cause = fmt.Sprintf(" | caused by: %v", e.cause)
+	}
+
+	key := ""
+	if e.key {
+		key = "key for "
+	}
+
+	return fmt.Sprintf(
+		"invalid %sSecondFactorsResult.%s: %s%s",
+		key,
+		e.field,
+		e.reason,
+		cause)
+}
+
+var _ error = SecondFactorsResultValidationError{}
+
+var _ interface {
+	Field() string
+	Reason() string
+	Key() bool
+	Cause() error
+	ErrorName() string
+} = SecondFactorsResultValidationError{}
+
+// Validate checks the field values on SecondFactor with the rules defined in
+// the proto definition for this message. If any rules are violated, an error
+// is returned.
+func (m *SecondFactor) Validate() error {
+	if m == nil {
+		return nil
+	}
+
+	// no validation rules for SecondFactor
+
+	return nil
+}
+
+// SecondFactorValidationError is the validation error returned by
+// SecondFactor.Validate if the designated constraints aren't met.
+type SecondFactorValidationError struct {
+	field  string
+	reason string
+	cause  error
+	key    bool
+}
+
+// Field function returns field value.
+func (e SecondFactorValidationError) Field() string { return e.field }
+
+// Reason function returns reason value.
+func (e SecondFactorValidationError) Reason() string { return e.reason }
+
+// Cause function returns cause value.
+func (e SecondFactorValidationError) Cause() error { return e.cause }
+
+// Key function returns key value.
+func (e SecondFactorValidationError) Key() bool { return e.key }
+
+// ErrorName returns error name.
+func (e SecondFactorValidationError) ErrorName() string { return "SecondFactorValidationError" }
+
+// Error satisfies the builtin error interface
+func (e SecondFactorValidationError) Error() string {
+	cause := ""
+	if e.cause != nil {
+		cause = fmt.Sprintf(" | caused by: %v", e.cause)
+	}
+
+	key := ""
+	if e.key {
+		key = "key for "
+	}
+
+	return fmt.Sprintf(
+		"invalid %sSecondFactor.%s: %s%s",
+		key,
+		e.field,
+		e.reason,
+		cause)
+}
+
+var _ error = SecondFactorValidationError{}
+
+var _ interface {
+	Field() string
+	Reason() string
+	Key() bool
+	Cause() error
+	ErrorName() string
+} = SecondFactorValidationError{}
+
+// Validate checks the field values on MultiFactorsResult with the rules
+// defined in the proto definition for this message. If any rules are
+// violated, an error is returned.
+func (m *MultiFactorsResult) Validate() error {
+	if m == nil {
+		return nil
+	}
+
+	return nil
+}
+
+// MultiFactorsResultValidationError is the validation error returned by
+// MultiFactorsResult.Validate if the designated constraints aren't met.
+type MultiFactorsResultValidationError struct {
+	field  string
+	reason string
+	cause  error
+	key    bool
+}
+
+// Field function returns field value.
+func (e MultiFactorsResultValidationError) Field() string { return e.field }
+
+// Reason function returns reason value.
+func (e MultiFactorsResultValidationError) Reason() string { return e.reason }
+
+// Cause function returns cause value.
+func (e MultiFactorsResultValidationError) Cause() error { return e.cause }
+
+// Key function returns key value.
+func (e MultiFactorsResultValidationError) Key() bool { return e.key }
+
+// ErrorName returns error name.
+func (e MultiFactorsResultValidationError) ErrorName() string {
+	return "MultiFactorsResultValidationError"
+}
+
+// Error satisfies the builtin error interface
+func (e MultiFactorsResultValidationError) Error() string {
+	cause := ""
+	if e.cause != nil {
+		cause = fmt.Sprintf(" | caused by: %v", e.cause)
+	}
+
+	key := ""
+	if e.key {
+		key = "key for "
+	}
+
+	return fmt.Sprintf(
+		"invalid %sMultiFactorsResult.%s: %s%s",
+		key,
+		e.field,
+		e.reason,
+		cause)
+}
+
+var _ error = MultiFactorsResultValidationError{}
+
+var _ interface {
+	Field() string
+	Reason() string
+	Key() bool
+	Cause() error
+	ErrorName() string
+} = MultiFactorsResultValidationError{}
+
+// Validate checks the field values on MultiFactor with the rules defined in
+// the proto definition for this message. If any rules are violated, an error
+// is returned.
+func (m *MultiFactor) Validate() error {
+	if m == nil {
+		return nil
+	}
+
+	// no validation rules for MultiFactor
+
+	return nil
+}
+
+// MultiFactorValidationError is the validation error returned by
+// MultiFactor.Validate if the designated constraints aren't met.
+type MultiFactorValidationError struct {
+	field  string
+	reason string
+	cause  error
+	key    bool
+}
+
+// Field function returns field value.
+func (e MultiFactorValidationError) Field() string { return e.field }
+
+// Reason function returns reason value.
+func (e MultiFactorValidationError) Reason() string { return e.reason }
+
+// Cause function returns cause value.
+func (e MultiFactorValidationError) Cause() error { return e.cause }
+
+// Key function returns key value.
+func (e MultiFactorValidationError) Key() bool { return e.key }
+
+// ErrorName returns error name.
+func (e MultiFactorValidationError) ErrorName() string { return "MultiFactorValidationError" }
+
+// Error satisfies the builtin error interface
+func (e MultiFactorValidationError) Error() string {
+	cause := ""
+	if e.cause != nil {
+		cause = fmt.Sprintf(" | caused by: %v", e.cause)
+	}
+
+	key := ""
+	if e.key {
+		key = "key for "
+	}
+
+	return fmt.Sprintf(
+		"invalid %sMultiFactor.%s: %s%s",
+		key,
+		e.field,
+		e.reason,
+		cause)
+}
+
+var _ error = MultiFactorValidationError{}
+
+var _ interface {
+	Field() string
+	Reason() string
+	Key() bool
+	Cause() error
+	ErrorName() string
+} = MultiFactorValidationError{}
+
 // Validate checks the field values on PasswordComplexityPolicy with the rules
 // defined in the proto definition for this message. If any rules are
 // violated, an error is returned.

pkg/grpc/management/management.swagger.json

@@ -1223,6 +1223,183 @@
         ]
       }
     },
+    "/orgs/me/policies/login/multifactors": {
+      "post": {
+        "operationId": "ManagementService_AddMultiFactorToLoginPolicy",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1MultiFactor"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response",
+            "schema": {
+              "$ref": "#/definitions/runtimeError"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1MultiFactor"
+            }
+          }
+        ],
+        "tags": [
+          "ManagementService"
+        ]
+      }
+    },
+    "/orgs/me/policies/login/multifactors/_search": {
+      "get": {
+        "operationId": "ManagementService_GetLoginPolicyMultiFactors",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1MultiFactorsResult"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response",
+            "schema": {
+              "$ref": "#/definitions/runtimeError"
+            }
+          }
+        },
+        "tags": [
+          "ManagementService"
+        ]
+      }
+    },
+    "/orgs/me/policies/login/multifactors/{multi_factor}": {
+      "delete": {
+        "operationId": "ManagementService_RemoveMultiFactorFromLoginPolicy",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "properties": {}
+            }
+          },
+          "default": {
+            "description": "An unexpected error response",
+            "schema": {
+              "$ref": "#/definitions/runtimeError"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "multi_factor",
+            "in": "path",
+            "required": true,
+            "type": "string",
+            "enum": [
+              "MULTIFACTORTYPE_UNSPECIFIED",
+              "MULTIFACTORTYPE_U2F_WITH_PIN"
+            ]
+          }
+        ],
+        "tags": [
+          "ManagementService"
+        ]
+      }
+    },
+    "/orgs/me/policies/login/secondfactors": {
+      "post": {
+        "operationId": "ManagementService_AddSecondFactorToLoginPolicy",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1SecondFactor"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response",
+            "schema": {
+              "$ref": "#/definitions/runtimeError"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1SecondFactor"
+            }
+          }
+        ],
+        "tags": [
+          "ManagementService"
+        ]
+      }
+    },
+    "/orgs/me/policies/login/secondfactors/_search": {
+      "get": {
+        "operationId": "ManagementService_GetLoginPolicySecondFactors",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1SecondFactorsResult"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response",
+            "schema": {
+              "$ref": "#/definitions/runtimeError"
+            }
+          }
+        },
+        "tags": [
+          "ManagementService"
+        ]
+      }
+    },
+    "/orgs/me/policies/login/secondfactors/{second_factor}": {
+      "delete": {
+        "operationId": "ManagementService_RemoveSecondFactorFromLoginPolicy",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "properties": {}
+            }
+          },
+          "default": {
+            "description": "An unexpected error response",
+            "schema": {
+              "$ref": "#/definitions/runtimeError"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "second_factor",
+            "in": "path",
+            "required": true,
+            "type": "string",
+            "enum": [
+              "SECONDFACTORTYPE_UNSPECIFIED",
+              "SECONDFACTORTYPE_OTP",
+              "SECONDFACTORTYPE_U2F"
+            ]
+          }
+        ],
+        "tags": [
+          "ManagementService"
+        ]
+      }
+    },
     "/orgs/me/policies/password/age": {
       "get": {
         "operationId": "ManagementService_GetPasswordAgePolicy",
@@ -3808,7 +3985,7 @@
           "200": {
             "description": "A successful response.",
             "schema": {
-              "$ref": "#/definitions/v1MultiFactors"
+              "$ref": "#/definitions/v1UserMultiFactors"
             }
           },
           "default": {
@@ -5691,6 +5868,10 @@
         "change_date": {
           "type": "string",
           "format": "date-time"
+        },
+        "force_mfa": {
+          "type": "boolean",
+          "format": "boolean"
         }
       }
     },
@@ -5708,6 +5889,10 @@
         "allow_external_idp": {
           "type": "boolean",
           "format": "boolean"
+        },
+        "force_mfa": {
+          "type": "boolean",
+          "format": "boolean"
         }
       }
     },
@@ -5737,6 +5922,10 @@
         "change_date": {
           "type": "string",
           "format": "date-time"
+        },
+        "force_mfa": {
+          "type": "boolean",
+          "format": "boolean"
         }
       }
     },
@@ -5880,21 +6069,26 @@
     "v1MultiFactor": {
       "type": "object",
       "properties": {
-        "type": {
-          "$ref": "#/definitions/v1MfaType"
-        },
-        "state": {
-          "$ref": "#/definitions/v1MFAState"
+        "multi_factor": {
+          "$ref": "#/definitions/v1MultiFactorType"
         }
       }
     },
-    "v1MultiFactors": {
+    "v1MultiFactorType": {
+      "type": "string",
+      "enum": [
+        "MULTIFACTORTYPE_UNSPECIFIED",
+        "MULTIFACTORTYPE_U2F_WITH_PIN"
+      ],
+      "default": "MULTIFACTORTYPE_UNSPECIFIED"
+    },
+    "v1MultiFactorsResult": {
       "type": "object",
       "properties": {
-        "mfas": {
+        "multi_factors": {
           "type": "array",
           "items": {
-            "$ref": "#/definitions/v1MultiFactor"
+            "$ref": "#/definitions/v1MultiFactorType"
           }
         }
       }
@@ -7905,6 +8099,34 @@
       ],
       "default": "SEARCHMETHOD_EQUALS"
     },
+    "v1SecondFactor": {
+      "type": "object",
+      "properties": {
+        "second_factor": {
+          "$ref": "#/definitions/v1SecondFactorType"
+        }
+      }
+    },
+    "v1SecondFactorType": {
+      "type": "string",
+      "enum": [
+        "SECONDFACTORTYPE_UNSPECIFIED",
+        "SECONDFACTORTYPE_OTP",
+        "SECONDFACTORTYPE_U2F"
+      ],
+      "default": "SECONDFACTORTYPE_UNSPECIFIED"
+    },
+    "v1SecondFactorsResult": {
+      "type": "object",
+      "properties": {
+        "second_factors": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/v1SecondFactorType"
+          }
+        }
+      }
+    },
     "v1SetPasswordNotificationRequest": {
       "type": "object",
       "properties": {
@@ -8522,6 +8744,28 @@
         }
       }
     },
+    "v1UserMultiFactor": {
+      "type": "object",
+      "properties": {
+        "type": {
+          "$ref": "#/definitions/v1MfaType"
+        },
+        "state": {
+          "$ref": "#/definitions/v1MFAState"
+        }
+      }
+    },
+    "v1UserMultiFactors": {
+      "type": "object",
+      "properties": {
+        "mfas": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/v1UserMultiFactor"
+          }
+        }
+      }
+    },
     "v1UserPhone": {
       "type": "object",
       "properties": {

pkg/grpc/management/mock/management.proto.mock.go

@@ -77,6 +77,26 @@ func (mr *MockManagementServiceClientMockRecorder) AddMachineKey(arg0, arg1 inte
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddMachineKey", reflect.TypeOf((*MockManagementServiceClient)(nil).AddMachineKey), varargs...)
 }
 
+// AddMultiFactorToLoginPolicy mocks base method
+func (m *MockManagementServiceClient) AddMultiFactorToLoginPolicy(arg0 context.Context, arg1 *management.MultiFactor, arg2 ...grpc.CallOption) (*management.MultiFactor, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0, arg1}
+	for _, a := range arg2 {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "AddMultiFactorToLoginPolicy", varargs...)
+	ret0, _ := ret[0].(*management.MultiFactor)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// AddMultiFactorToLoginPolicy indicates an expected call of AddMultiFactorToLoginPolicy
+func (mr *MockManagementServiceClientMockRecorder) AddMultiFactorToLoginPolicy(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0, arg1}, arg2...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddMultiFactorToLoginPolicy", reflect.TypeOf((*MockManagementServiceClient)(nil).AddMultiFactorToLoginPolicy), varargs...)
+}
+
 // AddMyOrgDomain mocks base method
 func (m *MockManagementServiceClient) AddMyOrgDomain(arg0 context.Context, arg1 *management.AddOrgDomainRequest, arg2 ...grpc.CallOption) (*management.OrgDomain, error) {
 	m.ctrl.T.Helper()
@@ -177,6 +197,26 @@ func (mr *MockManagementServiceClientMockRecorder) AddProjectRole(arg0, arg1 int
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddProjectRole", reflect.TypeOf((*MockManagementServiceClient)(nil).AddProjectRole), varargs...)
 }
 
+// AddSecondFactorToLoginPolicy mocks base method
+func (m *MockManagementServiceClient) AddSecondFactorToLoginPolicy(arg0 context.Context, arg1 *management.SecondFactor, arg2 ...grpc.CallOption) (*management.SecondFactor, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0, arg1}
+	for _, a := range arg2 {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "AddSecondFactorToLoginPolicy", varargs...)
+	ret0, _ := ret[0].(*management.SecondFactor)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// AddSecondFactorToLoginPolicy indicates an expected call of AddSecondFactorToLoginPolicy
+func (mr *MockManagementServiceClientMockRecorder) AddSecondFactorToLoginPolicy(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0, arg1}, arg2...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddSecondFactorToLoginPolicy", reflect.TypeOf((*MockManagementServiceClient)(nil).AddSecondFactorToLoginPolicy), varargs...)
+}
+
 // ApplicationByID mocks base method
 func (m *MockManagementServiceClient) ApplicationByID(arg0 context.Context, arg1 *management.ApplicationID, arg2 ...grpc.CallOption) (*management.ApplicationView, error) {
 	m.ctrl.T.Helper()
@@ -977,6 +1017,46 @@ func (mr *MockManagementServiceClientMockRecorder) GetLoginPolicyIdpProviders(ar
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetLoginPolicyIdpProviders", reflect.TypeOf((*MockManagementServiceClient)(nil).GetLoginPolicyIdpProviders), varargs...)
 }
 
+// GetLoginPolicyMultiFactors mocks base method
+func (m *MockManagementServiceClient) GetLoginPolicyMultiFactors(arg0 context.Context, arg1 *emptypb.Empty, arg2 ...grpc.CallOption) (*management.MultiFactorsResult, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0, arg1}
+	for _, a := range arg2 {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "GetLoginPolicyMultiFactors", varargs...)
+	ret0, _ := ret[0].(*management.MultiFactorsResult)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetLoginPolicyMultiFactors indicates an expected call of GetLoginPolicyMultiFactors
+func (mr *MockManagementServiceClientMockRecorder) GetLoginPolicyMultiFactors(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0, arg1}, arg2...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetLoginPolicyMultiFactors", reflect.TypeOf((*MockManagementServiceClient)(nil).GetLoginPolicyMultiFactors), varargs...)
+}
+
+// GetLoginPolicySecondFactors mocks base method
+func (m *MockManagementServiceClient) GetLoginPolicySecondFactors(arg0 context.Context, arg1 *emptypb.Empty, arg2 ...grpc.CallOption) (*management.SecondFactorsResult, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0, arg1}
+	for _, a := range arg2 {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "GetLoginPolicySecondFactors", varargs...)
+	ret0, _ := ret[0].(*management.SecondFactorsResult)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetLoginPolicySecondFactors indicates an expected call of GetLoginPolicySecondFactors
+func (mr *MockManagementServiceClientMockRecorder) GetLoginPolicySecondFactors(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0, arg1}, arg2...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetLoginPolicySecondFactors", reflect.TypeOf((*MockManagementServiceClient)(nil).GetLoginPolicySecondFactors), varargs...)
+}
+
 // GetMachineKey mocks base method
 func (m *MockManagementServiceClient) GetMachineKey(arg0 context.Context, arg1 *management.MachineKeyIDRequest, arg2 ...grpc.CallOption) (*management.MachineKeyView, error) {
 	m.ctrl.T.Helper()
@@ -1258,14 +1338,14 @@ func (mr *MockManagementServiceClientMockRecorder) GetUserEmail(arg0, arg1 inter
 }
 
 // GetUserMfas mocks base method
-func (m *MockManagementServiceClient) GetUserMfas(arg0 context.Context, arg1 *management.UserID, arg2 ...grpc.CallOption) (*management.MultiFactors, error) {
+func (m *MockManagementServiceClient) GetUserMfas(arg0 context.Context, arg1 *management.UserID, arg2 ...grpc.CallOption) (*management.UserMultiFactors, error) {
 	m.ctrl.T.Helper()
 	varargs := []interface{}{arg0, arg1}
 	for _, a := range arg2 {
 		varargs = append(varargs, a)
 	}
 	ret := m.ctrl.Call(m, "GetUserMfas", varargs...)
-	ret0, _ := ret[0].(*management.MultiFactors)
+	ret0, _ := ret[0].(*management.UserMultiFactors)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
@@ -1777,6 +1857,26 @@ func (mr *MockManagementServiceClientMockRecorder) RemoveLoginPolicy(arg0, arg1
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveLoginPolicy", reflect.TypeOf((*MockManagementServiceClient)(nil).RemoveLoginPolicy), varargs...)
 }
 
+// RemoveMultiFactorFromLoginPolicy mocks base method
+func (m *MockManagementServiceClient) RemoveMultiFactorFromLoginPolicy(arg0 context.Context, arg1 *management.MultiFactor, arg2 ...grpc.CallOption) (*emptypb.Empty, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0, arg1}
+	for _, a := range arg2 {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "RemoveMultiFactorFromLoginPolicy", varargs...)
+	ret0, _ := ret[0].(*emptypb.Empty)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// RemoveMultiFactorFromLoginPolicy indicates an expected call of RemoveMultiFactorFromLoginPolicy
+func (mr *MockManagementServiceClientMockRecorder) RemoveMultiFactorFromLoginPolicy(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0, arg1}, arg2...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveMultiFactorFromLoginPolicy", reflect.TypeOf((*MockManagementServiceClient)(nil).RemoveMultiFactorFromLoginPolicy), varargs...)
+}
+
 // RemoveMyOrgDomain mocks base method
 func (m *MockManagementServiceClient) RemoveMyOrgDomain(arg0 context.Context, arg1 *management.RemoveOrgDomainRequest, arg2 ...grpc.CallOption) (*emptypb.Empty, error) {
 	m.ctrl.T.Helper()
@@ -1977,6 +2077,26 @@ func (mr *MockManagementServiceClientMockRecorder) RemoveProjectRole(arg0, arg1
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveProjectRole", reflect.TypeOf((*MockManagementServiceClient)(nil).RemoveProjectRole), varargs...)
 }
 
+// RemoveSecondFactorFromLoginPolicy mocks base method
+func (m *MockManagementServiceClient) RemoveSecondFactorFromLoginPolicy(arg0 context.Context, arg1 *management.SecondFactor, arg2 ...grpc.CallOption) (*emptypb.Empty, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0, arg1}
+	for _, a := range arg2 {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "RemoveSecondFactorFromLoginPolicy", varargs...)
+	ret0, _ := ret[0].(*emptypb.Empty)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// RemoveSecondFactorFromLoginPolicy indicates an expected call of RemoveSecondFactorFromLoginPolicy
+func (mr *MockManagementServiceClientMockRecorder) RemoveSecondFactorFromLoginPolicy(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0, arg1}, arg2...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveSecondFactorFromLoginPolicy", reflect.TypeOf((*MockManagementServiceClient)(nil).RemoveSecondFactorFromLoginPolicy), varargs...)
+}
+
 // RemoveUserGrant mocks base method
 func (m *MockManagementServiceClient) RemoveUserGrant(arg0 context.Context, arg1 *management.UserGrantID, arg2 ...grpc.CallOption) (*emptypb.Empty, error) {
 	m.ctrl.T.Helper()

pkg/grpc/management/proto/management.proto

@@ -390,7 +390,7 @@ rpc GetUserByID(UserID) returns (UserView) {
     };
   }
 
-  rpc GetUserMfas(UserID) returns (MultiFactors) {
+  rpc GetUserMfas(UserID) returns (UserMultiFactors) {
     option (google.api.http) = {
       get: "/users/{id}/mfas"
     };
@@ -1363,6 +1363,68 @@ rpc GetUserByID(UserID) returns (UserView) {
     };
   }
 
+  rpc GetLoginPolicySecondFactors(google.protobuf.Empty) returns (SecondFactorsResult) {
+    option (google.api.http) = {
+            get: "/orgs/me/policies/login/secondfactors/_search"
+        };
+
+    option (caos.zitadel.utils.v1.auth_option) = {
+            permission: "iam.policy.read"
+        };
+  }
+
+  rpc AddSecondFactorToLoginPolicy(SecondFactor) returns (SecondFactor) {
+    option (google.api.http) = {
+            post: "/orgs/me/policies/login/secondfactors"
+            body: "*"
+        };
+
+    option (caos.zitadel.utils.v1.auth_option) = {
+            permission: "iam.policy.write"
+        };
+  }
+
+  rpc RemoveSecondFactorFromLoginPolicy(SecondFactor) returns (google.protobuf.Empty) {
+    option (google.api.http) = {
+            delete: "/orgs/me/policies/login/secondfactors/{second_factor}"
+        };
+
+    option (caos.zitadel.utils.v1.auth_option) = {
+            permission: "iam.policy.write"
+        };
+  }
+
+  rpc GetLoginPolicyMultiFactors(google.protobuf.Empty) returns (MultiFactorsResult) {
+    option (google.api.http) = {
+            get: "/orgs/me/policies/login/multifactors/_search"
+        };
+
+    option (caos.zitadel.utils.v1.auth_option) = {
+            permission: "iam.policy.read"
+        };
+  }
+
+  rpc AddMultiFactorToLoginPolicy(MultiFactor) returns (MultiFactor) {
+    option (google.api.http) = {
+            post: "/orgs/me/policies/login/multifactors"
+            body: "*"
+        };
+
+    option (caos.zitadel.utils.v1.auth_option) = {
+            permission: "iam.policy.write"
+        };
+  }
+
+  rpc RemoveMultiFactorFromLoginPolicy(MultiFactor) returns (google.protobuf.Empty) {
+    option (google.api.http) = {
+            delete: "/orgs/me/policies/login/multifactors/{multi_factor}"
+        };
+
+    option (caos.zitadel.utils.v1.auth_option) = {
+            permission: "iam.policy.write"
+        };
+  }
+
   rpc GetPasswordComplexityPolicy(google.protobuf.Empty) returns (PasswordComplexityPolicyView) {
     option (google.api.http) = {
       get: "/orgs/me/policies/password/complexity"
@@ -1950,11 +2012,11 @@ message UpdateUserAddressRequest {
   string street_address = 6 [(validate.rules).string = {max_len: 200}];
 }
 
-message MultiFactors {
-  repeated MultiFactor mfas = 1;
+message UserMultiFactors {
+  repeated UserMultiFactor mfas = 1;
 }
 
-message MultiFactor {
+message UserMultiFactor {
   MfaType type = 1;
   MFAState state = 2;
 }
@@ -2980,12 +3042,14 @@ message LoginPolicy {
     bool allow_external_idp = 3;
     google.protobuf.Timestamp creation_date = 4;
     google.protobuf.Timestamp change_date = 5;
+    bool force_mfa = 6;
 }
 
 message LoginPolicyRequest {
   bool allow_username_password = 1;
   bool allow_register = 2;
   bool allow_external_idp = 3;
+  bool force_mfa = 4;
 }
 
 message IdpProviderID {
@@ -3009,6 +3073,7 @@ message LoginPolicyView {
     bool allow_external_idp = 4;
     google.protobuf.Timestamp creation_date = 5;
     google.protobuf.Timestamp change_date = 6;
+    bool force_mfa = 7;
 }
 
 message IdpProviderView {
@@ -3081,6 +3146,33 @@ message ExternalIDPRemoveRequest {
   string external_user_id = 3;
 }
 
+message SecondFactorsResult {
+  repeated SecondFactorType second_factors = 1;
+}
+
+message SecondFactor {
+  SecondFactorType second_factor = 1;
+}
+
+enum SecondFactorType {
+  SECONDFACTORTYPE_UNSPECIFIED = 0;
+  SECONDFACTORTYPE_OTP = 1;
+  SECONDFACTORTYPE_U2F = 2;
+}
+
+message MultiFactorsResult {
+  repeated MultiFactorType multi_factors = 1;
+}
+
+message MultiFactor {
+  MultiFactorType multi_factor = 1;
+}
+
+enum MultiFactorType {
+  MULTIFACTORTYPE_UNSPECIFIED = 0;
+  MULTIFACTORTYPE_U2F_WITH_PIN = 1;
+}
+
 message PasswordComplexityPolicy {
   uint64 min_length = 1;
   bool has_lowercase = 2;