Troubleshooting: Accept/Symbol MFA Option Missing Due to a Blocked External Stylesheet

Version Affected: 20.06 and later
 
 

Overview

When configuring Multi-Factor Methods with the Request Type set to Accept/Deny, the Accept Method dropdown should offer a choice between User pushes "Accept" button and User pushes displayed symbol, as shown below. On some Admin Consoles, this dropdown is missing that choice entirely.

Cause

A strict Content-Security-Policy (CSP) can block one of the CSS files the Accept Method control needs, because that CSS file is hosted externally. The Admin Console's default CSP does not account for this, so the missing CSS file leaves the control looking like the option is missing, when it has actually just failed to render.

Resolution

Adjust the Content-Security-Policy to allow the remote style sheet. For example, if the current CSP is:

default-src 'self' data: 'unsafe-inline' 'unsafe-eval';

Adjust it to:

default-src 'self' data: 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://us-cloud.secureauth.com data: 'unsafe-inline' 'unsafe-eval';

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.