Test are also covered by unittest Prerequisites Apply the patch Do the upgrade processes until finished You can enable the mfa plugin at the end of the upgrade process or You can enable the mfa plugin by going to the Site admin > plugins > admin tools  Go to Site admin > plugin > plugin overview Verify that Multi-factor authentication exists. Verify that Multi-factor authentication / factor exists with its 12 factors listed Verify that you do not see SMS, Security Questions and Login Banner factors Verify that WebAuthn exists in Site admin > Development > Third party libraries Testing In this part will be testing each factor along with setting up the configuration. Warning : If you have inadvertantly messed things up and locked yourself out, you can disable the whole MFA plugin from the CLI : php admin/cli/cfg.php --component=tool_mfa --name=enabled --set=0 Note : Please use two different browsers for testing otherwise you will be locked by a specific factor One is for the configuration called "Site admin" The second second browser is for testing called "Testing". 1. Authentication type factor test Go to Site admin > plugins > admin tools > Multi-factor authentication Enable the Authentication type factor and click on the factor's Settings You will see three options in Factor authentication types that are disabled by default and when it is enabled it means that those types of accounts can login, so if you disable all of them or just any of them the associated account will not be able to authenticate. Please disable the Manual accounts and go to "Testing" browser and login. Verify that you are unable to authenticate. Enable the Manual accounts again Verify that you can login 2. User capability factor test Go to Site admin > plugins > admin tools Enable the User capability factor and click on the factor's Settings Enable Site admins can pass this factor if it's not enabled yet Go to "Testing" browser and login as an admin Verify that you can pass the factor Go back to "Site admin" and disable the Site admins can pass this factor Go back to "Testing" browser and login as an admin Verify that you are unable to authenticate. 3. Cohort factor test In "Site admin" browser go to Site admin > Users > Cohorts Click on Add new cohort to add new cohort Assign some users like admin and s1 Go to Site admin > plugins > admin tools Enable the Cohort factor and click on the factor's Settings Do not select the created cohort yet Go to "Testing" browser and try to login Verify that you can still login with the users that have been assigned to the cohort Back to "Site admin" browser select the created cohort in cohort factor setting page then save it Back to "Testing" browser and login with the assigned user in cohort Verify that you are unable to authenticate. 4. E-Mail factor test Make sure you have mail server installed like Mailpit and run Go to Site admin > Server > Outgoing mail configuration Set the SMTP hosts to "0.0.0.0:1025" Set the No-reply address to an email then save it Go to Site admin > plugins > admin tools Enable the E-mail factor and click on the factor's Settings Change the Validity duration to 10 seconds then save it Go to "Testing" browser then login with any users but admin "Verify that you are taken to a page that requires you to enter the verification code Enable your Mailpit through "http://localhost:8025/" Look for the latest email, get the verification code in the email then enter the code in the verification code input "Verify" that you can pass the factor and taken to home page Logout then login again, but this time you need to wait until the time you set for Validity duration in email factor's settings expired Go to Mailpit and look for the latest email, get the code and enter the code Verify that you cannot login due to the code being expired and you have some trials left Try to use that old code until the trials finished Try to get a new code by logging in again Verify that you have been locked out by the factor and cannot authenticate anymore 5. Grace period factor test Go to Site admin > plugins > admin tools Enable the Grace period and click on the factor's Settings Set the Grace period to 1 minutes then save Go to "Testing" browser then login with any users Verify that you get a warning that says "Your grace period expires in n secs." Logout then wait until the grace period ended, then login again Verify that you have been blocked by the factor unless you set another authentication factor to pass the grace factor Go back to "Site admin" browser then go to Site admin > Admin tools Multi-factor authentication Click on Reset user authentication factors link to reset any blocked users Make sure you select Grace period" for Select factor to reset Enter the username you want to unblock then click on the Reset user factor button Go to grace factor setting again Enable the Force factor setup then save it Go back to "Testing" browser then login with any users Verify that you are taken to "Multi-factor authentication preferences" page and you see a message "You must complete setup for Multi-factor authentication before you can proceed." 6. Role factor test For teachers, students, managers and others other than admin, you need to create a course and assign them Go to Site admin > plugins > admin tools Enable the Role factor and click on the factor's Settings Block any user levels by selecting them in Non-passing roles like student and click save Go to "Testing" browser and login with a student level Verify that you are unable to authenticate. 7. TOTP factor test (Authenticator app) - Only applied to Admins Go to Site admin > plugins > admin tools Enable the Authenticator app factor and just leave the default Settings Still in "Site admin" browser, click on user profile picture in header, the click on Preferences Click on Multi-factor authentication preferences in User account block Look for Authenticator app block under Available factors the click on the Setup App button Set Device label to any names (This field is required) Scan the QR code displayed in that page using any authenticator app Once it's added, you will get code from the app Enter the code from the app in Enter verification code for confirmation then save changes Go to "Testing" browser and login as admin Verify that you are taken to a page where you need to enter the code from the authenticator app and enter the code in Enter verification code for confirmation Verify that once the code is entered, you are taken straight to home page without pressing the Verify code button 8. WebAuthn factor test (Security key) - Only applied to Admins Go to Site admin > plugins > admin tools Enable the Security key factor and just leave the default Settings Still in "Site admin" browser, click on user profile picture in header, the click on Preferences Click on Multi-factor authentication preferences in User account block Look for Security key block under Available factors the click on the Setup authenticator button Set Security key  Name to any names (This field is required) Click on Register autheticator and you will be ask to choose the authentication device You can choose any or finger print if you have that in your machine then Save changes Go to "Testing" browser, then login as admin user Verify that you are taken to a page where you will authenticate using the WebAuthn Click on Verify authenticator button then follow the same steps when you registered the authenticator Verify that once the authentication succeed, you are taken to the home page 9. Non-administrator factor test Go to Site admin > plugins > admin tools Enable the Non-administrator factor and just leave the default Settings Go to "Testing" browser and login as admin Verify that you are not able to authenticate then click logout button Login again but this time with non admin users Verify that you can login with no authentication 10. No other factors factor test Go to Site admin > plugins > admin tools Enable the No other factors factor and just leave the default Settings Go to "Testing" browser and with any users Verify that you can login with no authentication 11. Trust this device factor test - It has to go with a single authenticator factor so for this test just use the authenticator app Go to Site admin > plugins > admin tools Enable the Trust this device and Authenticator app factors and just leave the default Settings Make sure you have set Authenticator app for admin user Go to "Testing" browser and login as admin Verify that you are taken to a page that requires you to enter code from the authenticator app Enter the code in Enter verification code for confirmation Make sure that Trust this device is enabled so next time you don't need to get the code from the authenticator app Press Verify code if the authentication is not processed directly. Once logged in, logout then login again Verify that when you press the " I don't have my device " and not putting any code, you still can authenticate and login 12. IP range factor test Prerequisites for Mac users only Make sure you are connected to a same network and so is the other devices that will be used to test. Get the IP address of your Mac in which the Moodle instance is running Go to System preference > Wi-Fi Click on "Details" of the connected network and note down the IP address Open the config.php file in your Moodle instance root then replace the " http://localhost_ " of " $CFG->wwwroot_" with your IP, which will look something like: $CFG ->wwwroot = 'http://YOUR_IP/SITE_NAME' ; For non Mac users who use ngrok or other tunneling servers, you just need to set it up then continue to testing Testing Go to Site admin > plugins > admin tools Enable IP range factor and click on the factor's Settings If your IP is not in the Safe IP ranges yet, you will need to enter it: Verify that you see a warning message of "Your IP (YOUR_CURRENT_IP) is not in the list and you will not pass this factor." Get the IP in the warning message and set it in Safe IP ranges (Mac only) To make all the IPs covered, you need to put like "192.168.1.0/24" based on your IP Save changes Go to "Testing" browser and login with an admin user Remember to use the IP address from the $CFG->wwwroot  Verify that you should be able to authenticate and login Go back to "Site admin" browser Go to Site admin > plugins > admin tools Click on IP range factor Settings Delete your IP address from the list in Safe IP ranges then save changes Go back to "Testing" browser and login with an admin user Verify that you are not able to authenticate 13. Test factor weight This test will cover the use of different weights in multiple enabled factors. Enable Non-administration , WebAuthn and Authenticator app factors Make sure the weights are all 100 in each of the factor Go to "Testing" browser and login as student Verify that you are able to authenticate and login Go back to "Site admin", change the weight for the Non-administration factor to 50 then save it Go back to "Testing" browser then login as student again Verify that are not able to authenticate to login 14. Test using site policy with email factor Go to Site Administration > Users > Privacy and policies > Policy settings Select Policies (tool_policy) in _Site policy handler and Save changes Go to Site Administration > Users > Privacy and policies > Manage policies Click on Create new policy then input all the required fields Set Active in Policy status then Save Continue with #4 E-Mail factor test Verify all went well