Does anyone have a working example of identity.schema.json using email + password to log in, with optional SMS MFA enabled?

hello @calm-farmer-87562 see this document: https://www.ory.sh/docs/kratos/mfa/mfa-via-sms#configuration should work the same for latest version of Ory Kratos

Ok, thanks for the help! A couple other weird configuration things I'm trying to achieve: If a user signs up w/ just an email, no verification (this is handled elsewhere) or mfa If a user adds a phone number, mfa is enforced. Any idea what changes I might need to do that?

hey @calm-farmer-87562 thanks for reporting your fix! How can we improve the docs there? add something to the

Find

code

in

selfservice.methods

and set

mfa_enabled

to `true`:

```identity-config.yaml

code:

mfa_enabled: true```

part?

yeah - my problem was trying to figure out how NOT to force mfa after login, but only in special situations. the self-hosted and ory docs seem to diverge a bit https://www.ory.sh/docs/kratos/self-hosted/mfa - doesn't have anything about dynamic mfa https://www.ory.sh/docs/kratos/mfa/step-up-authentication - doesn't tell you what yaml config items you need to update https://www.ory.sh/docs/kratos/reference/configuration makes it seem like the default value for

session_whoami_required_aal

is

1

but seems to actually be 2.