Preconditions and environment

Encountered during install and configuration of 2.4.8 (Community)

Steps to reproduce

Run bin/magento config:set --lock-env twofactorauth/general/force_providers google.

Observe that env.php now contains:

'twofactorauth' => [
    'general' => [
        'force_providers' => [
            'google'
        ]
    ]
]

Run bin/magento.
Run bin/magento with a command specified.

Expected result

bin/magento lists commands without error.
bin/magento with a command specified does not produce an error.

Actual result

bin/magento output ends with:

Type Error occurred when creating object: Magento\TwoFactorAuth\Model\Provider\Engine\DuoSecurity, explode(): Argument #2 ($string) must be of type string, array given 

bin/magento with a command specified yields:

There are no commands defined in the "config" namespace.  
                                                            
  Did you mean one of these?                                
      module:config                                         
      setup:config                                          
      setup:store-config 

Additional information

Dug in a bit - vendor/magento/module-two-factor-auth/Model/Provider/Engine/DuoSecurity.php L:199 is returned the array from env.php if --lock-env was used during the config:set.

isDuoForcedProvider expects a string, not an array.

Can be worked around by manually setting env.php:

'twofactorauth' => [
    'general' => [
        'force_providers' => 'google'
    ]
]

Haven't dug in enough yet to determine if the underlying issue is with vendor/magento/module-config/Console/Command/ConfigSet/LockProcessor.php or vendor/magento/module-two-factor-auth/Model/Config/Backend/ForceProviders.php.

Release note

No response

Triage and priority

• Severity: S0 - Affects critical data or functionality and leaves users without workaround.
• Severity: S1 - Affects critical data or functionality and forces users to employ a workaround.
• Severity: S2 - Affects non-critical data or functionality and forces users to employ a workaround.
• Severity: S3 - Affects non-critical data or functionality and does not force users to employ a workaround.
• Severity: S4 - Affects aesthetics, professional look and feel, “quality” or “usability”.