Cannot enable two factor authentication - the solution Topic is solved

[jdfoxmicro]

In the admin console, you go to Users, select a user, and go to the Two Factor Authentication tab to set it up. You scan the QR code, and it gets added to your Google Authenticator app. But when you try to enter the six-digit one-time code to confirm, you get this confusing and unexpected error:

The passwords you entered do not match. Please enter your desired password in the password field and confirm your entry by entering it in the confirm password field.

This happens because you saved your login password for this Joomla site in your browser. When you went into the Users: Edit Profile screen, your browser automatically filled it in on the Password field on the Account Details tab, but not in the Confirm Password field. So when you click Save on the Two Factor Authentication tab, the web page tries to save all of the data in all tabs. Thus the error.

So, click over to the Account Details tab and clear the Password field. It doesn't need to be filled in unless you're changing it. Then, back on the Two Factor Authentication tab, you'll be able to confirm your account.

[ redacted ]

[Webdongle]

The answer is https://docs.joomla.org/J3.x:Two_Factor_Authentication

[jdfoxmicro]

The answer is https://docs.joomla.org/J3.x:Two_Factor_Authentication

Your link goes to the basic documentation on Two Factor Authentication. However, the document, at this moment, does not mention the specific unexpected and confusing error I've addressed in this post, let alone provide an "answer" to it.

[ redacted ]

[Webdongle]

Yes it does. Your problem is caused because you do not enter the code in Joomla before it exspires.

[AMurray]

Your problem is caused because you do not enter the code in Joomla before it expires.

Have to disagree - this issue is not to do with 2FA; this would occur even if you weren't using 2FA (and is expected behaviour if you don't enter the passwords the same in both fields. It is a "symptom" of a browser pre-populating the first password field, and the user saving the profile without realising it).

A browser or password manager may of course pre-fill the form but doesn't negate the fact the user may not notice, save the profile and therefore get that error even if their action had nothing to do with actually changing the password.

It's still a replicable action - just edit profile, go to change password (only first field, don't enter in the second field), then save - and you will get the "passwords do not match" error.

[Webdongle]

So you are saying the problem is that the first password field is auto filled and the user neglects to fill in the password conformation field?