CakeDC/Users gives you TOTP two-factor authentication almost for free: flip one config key and every login grows a "enter your 6-digit code" step. The catch is that word every. The built-in flow is all-or-nothing — turn it on and all your users are forced through the OTP challenge on their next login, whether they ever set up an authenticator app or not. Lock yourself out on a fresh install and you'll find out fast.
What most apps actually want is the model you see everywhere else: 2FA is off by default, and each user opts in from their own account settings. This post shows how to get there with a surprisingly small change — one overridden method — plus a self-service enrolment screen and one QR-code gotcha that will bite you on modern dependencies.
The one insight: isRequired()
CakeDC/Users decides whether to demand the OTP step through an
OneTimePasswordAuthenticationCheckerInterface. The default implementation,
