Apex Based User Admin - Remove One-Time Password Generator

Question

We are establishing a SF Community and Requiring Community Users to have two factor authentication. We have an Apex Batch that creates new Users, deactivates Users who no longer have assignments that require community access, and then reactivates existing Users that are delegated new assignments. All of this works correctly.

However, when an inactive User is made active, they still retain their old One-Time Password Generator. We would like the ability to remove those Generators when we re-activate the User. When I look through the WSDL I don't see a field or flag that would allow me to do that. Where/How is that One-Time Password Generator stored? Is there a way to remove that Generator via Apex?

Answer 1

For future reference, the One-Time Password Generator information is stored in the TwoFactorInfo object. This can be queried by the UserId and the object can be deleted. Deleting the object will remove the Generator from the User. Sample Code:

// Where uid is the UserId for the User from which you wish to remove the token generator.
TwoFactorInfo tfi = [ SELECT Id, UserId FROM TwoFactorInfo WHERE UserId = :uid ];
Database.Delete( tfi );