Added support for OOB and Recovery code MFA challenges

[ejensen]

Changes

This PR adds methods to start OOB MFA challenges and to login with OOB & recovery codes. Previously, the only supported MFA authenticator was OTP.

References

• Auth0 Support ticket
• Auth0 guide to challenge user with MFA
• Auth0 API documentation on the MFA challenge request
• Auth0 API documentation on the OOB verify request
• Auth0 API documentation on the recovery code verify request
• Addresses issue MFA Challenge  #261

Testing

• This change adds unit test coverage
• This change has been tested on the latest version of the platform/language or why not

Checklist

• I have read the Auth0 general contribution guidelines
• All existing and new tests complete without errors
• All active GitHub checks have passed

[Widcket]

Hi @ejensen, thanks for this PR. We'll discuss this internally.

[Widcket]

@ejensen can you please provide more details about your use case?

[ejensen]

@ejensen can you please provide more details about your use case?

@Widcket We want to support Out Of Band (OOB) MFA Authenticators in addition to OTP MFA Authenticators.
Auth0.Swift and Auth0.Android currently only supports OTP Authenticators. Making it impossible for users with OOB Authenticator (SMS/Voice/Email/Push) to login. Others have also reported this issue in #261

Adding API to support OOB MFA Authenticators allows clients to trigger the OOB challenges and authenticate with the responses detailed in Auth0's documentation:

• Enroll and Challenge SMS and Voice Authenticators
• Enroll and Challenge Email Authenticators
• Enroll and Challenge Push Authenticators
• Verify with out-of-band (OOB)
• Verify with recover code

[Widcket]

Hi @ejensen, can you please give me access to your fork so I can add a commit to see if that kickstarts the CI?

[ejensen]

@Widcket The fork is public and I gave you write access

[Widcket]

@ejensen I can't commit changes. We're having a CI hiccup on the iOS repos, and adding a commit fixed it for this PR.

[Widcket]

@ejensen Sorry, I hadn't accepted the invitation yet. My bad.

[Widcket]

Looks good, just missing tests for multifactorChallenge(mfaToken: String, types: [String]?, channel: String?, authenticatorId: String?). Make sure to test even the optional parameters.

[ejensen]

@Widcket commit b0fb3b2 add tests for the multifactorChallenge method

[Widcket]

Thanks @ejensen.