2FA enforcement: add more validation, fix test

application/src/main/java/org/thingsboard/server/service/security/auth/mfa/config/DefaultTwoFaConfigManager.java

@@ -167,9 +167,20 @@ public class DefaultTwoFaConfigManager implements TwoFaConfigManager {
         for (TwoFaProviderConfig providerConfig : twoFactorAuthSettings.getProviders()) {
             twoFactorAuthService.checkProvider(tenantId, providerConfig.getProviderType());
         }
-        if (tenantId.isSysTenantId() && twoFactorAuthSettings.isEnforceTwoFa() && twoFactorAuthSettings.getProviders().isEmpty()) {
-            throw new DataValidationException("At least one 2FA provider is required if enforcing is enabled");
+        if (tenantId.isSysTenantId()) {
+            if (twoFactorAuthSettings.isEnforceTwoFa()) {
+                if (twoFactorAuthSettings.getProviders().isEmpty()) {
+                    throw new DataValidationException("At least one 2FA provider is required if enforcing is enabled");
+                }
+                if (twoFactorAuthSettings.getEnforcedUsersFilter() == null) {
+                    throw new DataValidationException("Users filter to enforce 2FA for is required");
+                }
+            }
+        } else {
+            twoFactorAuthSettings.setEnforceTwoFa(false);
+            twoFactorAuthSettings.setEnforcedUsersFilter(null);
         }
+
         AdminSettings settings = Optional.ofNullable(adminSettingsService.findAdminSettingsByKey(tenantId, TWO_FACTOR_AUTH_SETTINGS_KEY))
                 .orElseGet(() -> {
                     AdminSettings newSettings = new AdminSettings();

application/src/test/java/org/thingsboard/server/controller/TwoFactorAuthTest.java

@@ -430,7 +430,7 @@ public class TwoFactorAuthTest extends AbstractControllerTest {
 
         // verifying enforced users filter
         createDifferentTenant();
-        doGet("/api/user/" + user.getId()).andExpect(status().isOk());
+        doGet("/api/user/" + savedDifferentTenantUser.getId()).andExpect(status().isOk());
 
         twoFaSettings.setEnforceTwoFa(false);
         twoFaConfigManager.savePlatformTwoFaSettings(TenantId.SYS_TENANT_ID, twoFaSettings);