experience-ui-bundle-mfa-configure

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Enabling MFA on Experience Sites

在Experience Sites上启用MFA

Enable Multi-Factor Authentication for Experience Site (Community) users by deploying the correct permission sets and verifying the platform-handled MFA challenge flow.

通过部署正确的权限集并验证平台处理的MFA挑战流程，为Experience Site（社区）用户启用多因素认证（MFA）。

Scope

适用范围

In scope:

Deploying
```
ForceTwoFactor
```
permission set for community users
Deploying
```
ApiEnabled
```
permission set (required for post-login API calls)
Assigning permission sets to community users
Troubleshooting MFA not appearing on login
Customizing MFA/login page branding via NetworkBranding metadata

Out of scope — delegate elsewhere:

Building custom login UI →
```
experience-ui-bundle-frontend-generate
```
Creating generic permission sets →
```
platform-permission-set-generate
```
Assigning permission sets (if already deployed) →
```
dx-org-permission-set-assign
```
Deploying metadata to org →
```
platform-metadata-deploy
```
Org-wide MFA for internal Salesforce users → Setup > Identity Verification (not a skill)

包含范围：

为社区用户部署
```
ForceTwoFactor
```
权限集
部署
```
ApiEnabled
```
权限集（登录后API调用所需）
为社区用户分配权限集
排查登录时MFA不显示的问题
通过NetworkBranding元数据自定义MFA/登录页面品牌样式

排除范围 — 请委托至其他工具：

构建自定义登录UI →
```
experience-ui-bundle-frontend-generate
```
创建通用权限集 →
```
platform-permission-set-generate
```
分配已部署的权限集 →
```
dx-org-permission-set-assign
```
将元数据部署至组织 →
```
platform-metadata-deploy
```
为Salesforce内部用户配置组织级MFA → 通过Setup > Identity Verification完成（不属于本技能范畴）

Prerequisites

前置条件

Before using this skill, ensure the following are already in place:

Prerequisite	Why
Experience Cloud site deployed and active	MFA applies to community login — no site means no login flow to protect
Community users exist (or will self-register)	Permission sets are assigned to community users; the site must have a community-enabled profile
Customer Community or Customer Community Login license enabled	Required for community user profiles — without it, user creation and profile deployment will fail
Network/Site published at least once	The site must be reachable at its URL for login + MFA challenge to appear

Note: This skill does NOT handle org setup, license provisioning, or Experience Cloud site creation. If these prerequisites are missing, set them up first via Setup > Digital Experiences > All Sites > New, or deploy your site's base app bundle.

使用本技能前，请确保已满足以下条件：

前置条件	原因
Experience Cloud站点已部署并激活	MFA应用于社区登录流程 — 无站点则无需保护登录流程
已存在社区用户（或用户将自行注册）	权限集需分配给社区用户；站点必须启用社区配置文件
已启用Customer Community或Customer Community Login许可证	社区用户配置文件必需 — 无许可证则用户创建和配置文件部署会失败
Network/站点已至少发布一次	站点需可通过其URL访问，才能显示登录+MFA挑战页面

注意： 本技能不处理组织设置、许可证配置或Experience Cloud站点创建。若缺少上述前置条件，请先通过Setup > Digital Experiences > All Sites > New进行设置，或部署站点的基础应用包。

Required Inputs

必要输入

Gather before acting:

Input	How to determine
Target org	Org alias for `sf` CLI commands
Site name	Experience Site (Network) name — resolve via `SELECT Id, Name FROM Network` (see Step 1); this is the site/Network name, NOT the `uiBundles/` app name
Community users	Which users or profiles to assign MFA to

操作前请收集以下信息：

输入项	确定方式
目标组织	sf CLI命令使用的组织别名
站点名称	Experience Site（Network）名称 — 通过 `SELECT Id, Name FROM Network` 查询获取（见步骤1）；此处为站点/Network名称，而非 `uiBundles/` 应用名称
社区用户	需要分配MFA的用户或配置文件

Critical Domain Knowledge

关键领域知识

These facts are non-obvious and frequently cause confusion:

Fact	Detail
No custom UI needed	Platform renders the MFA challenge page — no React/LWC component required
ForceTwoFactor permission	The ONLY way to enforce MFA for community users at login
Org Identity Verification checkbox	Does NOT enforce MFA for community/portal users — only for internal users
vforcesite domain	MFA challenge page is always served from the underlying Force.com Site domain — this is expected
Always deploy ApiEnabled	React Experience Sites make post-login REST/Connect API calls ( `sdk.graphql` , `sdk.fetch` ); without `ApiEnabled` they fail with `API_DISABLED_FOR_ORG`
Social Login / SSO is separate from MFA	React sites render configured Auth Providers via the built-in Social Login component (shipped in 264) — driven by Auth Provider setup, not by the MFA permission sets. See `references/social-login.md` .
Login-page branding works for React sites	Since 264, the NetworkBranding "Login & Registration" section is shown in Setup for Site Containers, so logo/color/footer can be customized in the UI — Metadata API still works too.

以下事实并不直观，常引发混淆：

事实	详情
无需自定义UI	平台会渲染MFA挑战页面 — 无需React/LWC组件
ForceTwoFactor权限	这是强制社区用户登录时使用MFA的唯一方式
组织身份验证复选框	不会强制社区/门户用户使用MFA — 仅对内部用户生效
vforcesite域名	MFA挑战页面始终由底层Force.com Site域名提供服务 — 此为预期行为
始终部署ApiEnabled	React Experience Sites会发起登录后REST/Connect API调用（ `sdk.graphql` 、 `sdk.fetch` ）；若无 `ApiEnabled` 权限，调用会因 `API_DISABLED_FOR_ORG` 失败
社交登录/SSO与MFA相互独立	React站点通过内置的社交登录组件（版本264起提供）渲染已配置的身份验证提供商 — 由身份验证提供商设置驱动，与MFA权限集无关。详见 `references/social-login.md` 。
登录页面品牌样式对React站点生效	自版本264起，NetworkBranding的“登录与注册”部分会在Site Containers的设置中显示，因此可在UI中自定义logo/颜色/页脚 — 元数据API同样适用。

Workflow

工作流程

Step 1: Resolve the target site (Network)

步骤1：确定目标站点（Network）

These are React Experience Sites, so both permission sets are always deployed —

ForceTwoFactor

(enforces MFA) and

ApiEnabled

(React sites make post-login API calls).

Resolve the Experience Site's real name and Id from the org — do not assume the

uiBundles/

app folder name is the site name. They are frequently different, and the site name must come from the org (the deploy target), not the local project.

<site-name>

and

<NETWORK_ID>

below come from here:

bash

sf data query --target-org <org-alias> \
  --query "SELECT Id, Name FROM Network" --json

One site → use its
```
Name
```
as
```
<site-name>
```
and
```
Id
```
as
```
<NETWORK_ID>
```
.
Multiple sites → ask the user which one (show the names).
Zero sites → the site isn't deployed yet; stop and tell the user (see Prerequisites).

此处为React Experience Sites，因此始终需部署两个权限集 —

ForceTwoFactor

（强制启用MFA）和

ApiEnabled

（React站点需发起登录后API调用）。

从组织中获取Experience Site的真实名称和Id — 请勿假设

uiBundles/

应用文件夹名称即为站点名称。二者通常不同，站点名称必须来自组织（部署目标），而非本地项目。下方的

<site-name>

和

<NETWORK_ID>

均从此处获取：

bash

sf data query --target-org <org-alias> \
  --query "SELECT Id, Name FROM Network" --json

仅一个站点 → 使用其
```
Name
```
作为
```
<site-name>
```
，
```
Id
```
作为
```
<NETWORK_ID>
```
。
多个站点 → 询问用户选择哪个（显示所有站点名称）。
无站点 → 站点尚未部署；请停止操作并告知用户（见前置条件）。

Step 2: Generate permission set files

步骤2：生成权限集文件

First, detect the project's source directory:

bash

jq -r '.packageDirectories[0].path + "/main/default"' sfdx-project.json

Use the result as

<source-dir>

(e.g.

force-app/main/default

) for all commands below.

Write both permission sets (React Experience Sites always need both):

Read

assets/MFA_Required_For_Community.permissionset-meta.xml

Write it to

<source-dir>/permissionsets/MFA_Required_For_Community.permissionset-meta.xml

in the user's project

Read

assets/API_Enabled_For_Community.permissionset-meta.xml

Write it to

<source-dir>/permissionsets/API_Enabled_For_Community.permissionset-meta.xml

首先，检测项目的源目录：

bash

jq -r '.packageDirectories[0].path + "/main/default"' sfdx-project.json

将结果作为

<source-dir>

（例如

force-app/main/default

）用于以下所有命令。

写入两个权限集（React Experience Sites始终需要二者）：

读取

assets/MFA_Required_For_Community.permissionset-meta.xml

将其写入用户项目的

<source-dir>/permissionsets/MFA_Required_For_Community.permissionset-meta.xml

读取

assets/API_Enabled_For_Community.permissionset-meta.xml

将其写入用户项目的

<source-dir>/permissionsets/API_Enabled_For_Community.permissionset-meta.xml

Step 3: Deploy to org

步骤3：部署至组织

bash

sf project deploy start \
  --source-dir <source-dir>/permissionsets \
  --target-org <org-alias> --test-level NoTestRun

bash

sf project deploy start \
  --source-dir <source-dir>/permissionsets \
  --target-org <org-alias> --test-level NoTestRun

Step 3b: Validate community profile is a network member

步骤3b：验证社区配置文件是否为网络成员

Before assigning permission sets to users, verify that the community profile is registered as a site member. Without this, community users cannot log in at all (and MFA will never trigger).

Query current network members:

bash

sf data query --target-org <org-alias> \
  --query "SELECT Id, ParentId FROM NetworkMemberGroup WHERE NetworkId = '<NETWORK_ID>'" --json

Check if the community profile is in the list:

bash

sf data query --target-org <org-alias> \
  --query "SELECT Id, Name FROM Profile WHERE UserType IN ('CspLitePortal', 'PowerCustomerSuccess') AND Name LIKE '%Community%'" --json

If the profile is NOT a member, add it to the
```
.network-meta.xml
```
:

xml

<networkMemberGroups>
    <!-- Replace with the community profile name from Step 3b query above -->
    <profile>YOUR_COMMUNITY_PROFILE_NAME</profile>
    <!-- existing entries -->
</networkMemberGroups>

Deploy the updated network metadata:

bash

sf project deploy start \
  --source-dir <source-dir>/networks \
  --target-org <org-alias> --test-level NoTestRun

IMPORTANT: If the community profile is not a member of the network, users with that profile CANNOT log in — meaning MFA will never be triggered even if permission sets are correctly assigned. This is a common misconfiguration in freshly deployed orgs.

在为用户分配权限集前，请验证社区配置文件已注册为站点成员。若无此配置，社区用户根本无法登录（MFA也永远不会触发）。

查询当前网络成员：

bash

sf data query --target-org <org-alias> \
  --query "SELECT Id, ParentId FROM NetworkMemberGroup WHERE NetworkId = '<NETWORK_ID>'" --json

检查社区配置文件是否在列表中：

bash

sf data query --target-org <org-alias> \
  --query "SELECT Id, Name FROM Profile WHERE UserType IN ('CspLitePortal', 'PowerCustomerSuccess') AND Name LIKE '%Community%'" --json

若配置文件未加入成员，将其添加至
```
.network-meta.xml
```
：

xml

<networkMemberGroups>
    <!-- 替换为步骤3b查询得到的社区配置文件名称 -->
    <profile>YOUR_COMMUNITY_PROFILE_NAME</profile>
    <!-- 现有条目 -->
</networkMemberGroups>

部署更新后的网络元数据：

bash

sf project deploy start \
  --source-dir <source-dir>/networks \
  --target-org <org-alias> --test-level NoTestRun

重要提示： 若社区配置文件未加入网络成员，使用该配置文件的用户无法登录 — 意味着即使权限集分配正确，MFA也永远不会触发。这是新部署组织中常见的配置错误。

Step 3c: Validate guest profile has Apex class access for login

步骤3c：验证访客配置文件是否拥有登录Apex类访问权限

The site login page runs as the guest user (unauthenticated). If the guest profile doesn't have access to login Apex classes, users will get

FORBIDDEN: You do not have access to the Apex class named: UIBundleLogin

and can never reach the MFA challenge.

Find the site guest user profile:

bash

sf data query --target-org <org-alias> \
  --query "SELECT Id, Username, Profile.Name, Profile.Id FROM User WHERE UserType = 'Guest' AND IsActive = true" --json

Grant access to any missing UIBundle login classes. The six classes are
```
UIBundleLogin
```
,
```
UIBundleAuthUtils
```
,
```
UIBundleForgotPassword
```
,
```
UIBundleChangePassword
```
,
```
UIBundleRegistration
```
, and
```
UIBundleSocialLoginConfig
```
. Run the anonymous Apex in
```
references/setup.md
```
("Grant Guest Profile Apex Class Access") — it diffs existing access and inserts only what's missing — or deploy
```
<classAccess>
```
entries for the same classes to the guest profile metadata XML.

IMPORTANT: This is NOT MFA-specific, but without it the login page itself is broken. The skill must validate this to ensure MFA can actually be triggered. Common in freshly deployed orgs where the guest profile didn't get full class access.

站点登录页面以访客用户（未认证身份）运行。若访客配置文件无登录Apex类访问权限，用户会收到

FORBIDDEN: You do not have access to the Apex class named: UIBundleLogin

错误，永远无法进入MFA挑战页面。

查找站点访客用户配置文件：

bash

sf data query --target-org <org-alias> \
  --query "SELECT Id, Username, Profile.Name, Profile.Id FROM User WHERE UserType = 'Guest' AND IsActive = true" --json

为缺失的UIBundle登录类授予访问权限。六个类分别为
```
UIBundleLogin
```
、
```
UIBundleAuthUtils
```
、
```
UIBundleForgotPassword
```
、
```
UIBundleChangePassword
```
、
```
UIBundleRegistration
```
和
```
UIBundleSocialLoginConfig
```
。执行
```
references/setup.md
```
中的匿名Apex代码（“授予访客配置文件Apex类访问权限”）—— 该代码会对比现有权限并仅添加缺失的部分；或向访客配置文件元数据XML中部署上述类的
```
<classAccess>
```
条目。

重要提示： 此操作并非MFA专属，但若无此配置，登录页面本身会失效。本技能必须验证此配置以确保MFA可正常触发。新部署组织中常出现访客配置文件未获得完整类访问权限的情况。

Step 4: Assign permission sets

步骤4：分配权限集

Find community users:

bash

sf data query --target-org <org-alias> \
  --query "SELECT Id, Username, Name, Profile.Name FROM User WHERE UserType IN ('CspLitePortal', 'PowerCustomerSuccess', 'CustomerSuccess') AND IsActive = true" --json

查找社区用户：

bash

sf data query --target-org <org-alias> \
  --query "SELECT Id, Username, Name, Profile.Name FROM User WHERE UserType IN ('CspLitePortal', 'PowerCustomerSuccess', 'CustomerSuccess') AND IsActive = true" --json

If community users exist:

若存在社区用户：

Find the permission set IDs:

bash

sf data query --target-org <org-alias> \
  --query "SELECT Id, Name FROM PermissionSet WHERE Name IN ('MFA_Required_For_Community', 'API_Enabled_For_Community')" --json

Assign to each user:

bash

sf data create record --target-org <org-alias> --sobject PermissionSetAssignment \
  --values "AssigneeId='<USER_ID>' PermissionSetId='<PERM_SET_ID>'" --json

Alternatively, delegate to

dx-org-permission-set-assign

skill:

bash

sf org assign permset --name MFA_Required_For_Community --target-org <org-alias> --json
sf org assign permset --name API_Enabled_For_Community --target-org <org-alias> --json

查找权限集ID：

bash

sf data query --target-org <org-alias> \
  --query "SELECT Id, Name FROM PermissionSet WHERE Name IN ('MFA_Required_For_Community', 'API_Enabled_For_Community')" --json

为每位用户分配权限集：

bash

sf data create record --target-org <org-alias> --sobject PermissionSetAssignment \
  --values "AssigneeId='<USER_ID>' PermissionSetId='<PERM_SET_ID>'" --json

或委托给

dx-org-permission-set-assign

技能：

bash

sf org assign permset --name MFA_Required_For_Community --target-org <org-alias> --json
sf org assign permset --name API_Enabled_For_Community --target-org <org-alias> --json

If no community users found:

若未找到社区用户：

Ask the user: "No active community users found in this org. Would you like me to create a test community user so you can verify MFA is working?"

If user agrees, create a test community user:

Find the community profile from the site's network configuration:

bash

sf data query --target-org <org-alias> \
  --query "SELECT Id, Name FROM Profile WHERE UserType IN ('CspLitePortal', 'PowerCustomerSuccess') AND Name LIKE '%Customer Community%'" --json

Create an Account (required as community user parent):

bash

sf data create record --target-org <org-alias> --sobject Account \
  --values "Name='MFA Test Account'" --json

Create a Contact (linked to the Account):

bash

sf data create record --target-org <org-alias> --sobject Contact \
  --values "FirstName='MFA' LastName='Test User' Email='mfa.testuser@<site-name>.test' AccountId='<ACCOUNT_ID>'" --json

Create the User with the community profile:

bash

sf data create record --target-org <org-alias> --sobject User \
  --values "FirstName='MFA' LastName='Test User' Email='mfa.testuser@<site-name>.test' Username='mfa.testuser@<site-name>.test' Alias='mfatest' ProfileId='<PROFILE_ID>' ContactId='<CONTACT_ID>' EmailEncodingKey='UTF-8' LanguageLocaleKey='en_US' LocaleSidKey='en_US' TimeZoneSidKey='America/Los_Angeles'" --json

Set a password for the test user:

bash

sf data update record --target-org <org-alias> --sobject User \
  --where "Username='mfa.testuser@<site-name>.test'" \
  --values "IsActive=true" --json

bash

sf org generate password --target-org <org-alias> --on-behalf-of mfa.testuser@<site-name>.test --json

Assign both permission sets to the new user:

bash

sf org assign permset --name MFA_Required_For_Community --target-org <org-alias> --on-behalf-of mfa.testuser@<site-name>.test --json
sf org assign permset --name API_Enabled_For_Community --target-org <org-alias> --on-behalf-of mfa.testuser@<site-name>.test --json

Report the credentials to the user so they can test:

"Created test user:
mfa.testuser@<site-name>.test
with password:
<generated-password>
. You can use these credentials to verify MFA on your site."

IMPORTANT: Community users require Account → Contact → User hierarchy. Creating a User without a linked Contact on a community profile will fail.

询问用户：“在此组织中未找到活跃的社区用户。是否需要创建一个测试社区用户以验证MFA功能正常？”

若用户同意，创建测试社区用户：

从站点网络配置中查找社区配置文件：

bash

sf data query --target-org <org-alias> \
  --query "SELECT Id, Name FROM Profile WHERE UserType IN ('CspLitePortal', 'PowerCustomerSuccess') AND Name LIKE '%Customer Community%'" --json

创建Account（社区用户的父记录必需）：

bash

sf data create record --target-org <org-alias> --sobject Account \
  --values "Name='MFA Test Account'" --json

创建Contact（关联至Account）：

bash

sf data create record --target-org <org-alias> --sobject Contact \
  --values "FirstName='MFA' LastName='Test User' Email='mfa.testuser@<site-name>.test' AccountId='<ACCOUNT_ID>'" --json

使用社区配置文件创建用户：

bash

sf data create record --target-org <org-alias> --sobject User \
  --values "FirstName='MFA' LastName='Test User' Email='mfa.testuser@<site-name>.test' Username='mfa.testuser@<site-name>.test' Alias='mfatest' ProfileId='<PROFILE_ID>' ContactId='<CONTACT_ID>' EmailEncodingKey='UTF-8' LanguageLocaleKey='en_US' LocaleSidKey='en_US' TimeZoneSidKey='America/Los_Angeles'" --json

为测试用户设置密码：

bash

sf data update record --target-org <org-alias> --sobject User \
  --where "Username='mfa.testuser@<site-name>.test'" \
  --values "IsActive=true" --json

bash

sf org generate password --target-org <org-alias> --on-behalf-of mfa.testuser@<site-name>.test --json

为新用户分配两个权限集：

bash

sf org assign permset --name MFA_Required_For_Community --target-org <org-alias> --on-behalf-of mfa.testuser@<site-name>.test --json
sf org assign permset --name API_Enabled_For_Community --target-org <org-alias> --on-behalf-of mfa.testuser@<site-name>.test --json

向用户报告凭证以便测试：

“已创建测试用户：
mfa.testuser@<site-name>.test
，密码：
<generated-password>
。您可使用此凭证验证站点上的MFA功能。”

重要提示： 社区用户需要Account → Contact → User的层级结构。若创建用户时未关联至社区配置文件的Contact，操作会失败。

Step 5: Add permission sets to site Members (networkMemberGroups)

步骤5：将权限集添加至站点成员（networkMemberGroups）

This ensures new community users automatically get MFA assigned at the site level.

Find the existing
```
.network-meta.xml
```
in the project:

bash

find . -name "*.network-meta.xml" -not -path "*/node_modules/*"

Read the file and locate the
```
<networkMemberGroups>
```
section.
Add the permission set entries (if not already present):

xml

<networkMemberGroups>
    <!-- Replace with the community profile name from Step 3b query -->
    <profile>YOUR_COMMUNITY_PROFILE_NAME</profile>
    <!-- Add MFA and API permission sets -->
    <permissionSet>MFA_Required_For_Community</permissionSet>
    <permissionSet>API_Enabled_For_Community</permissionSet>
</networkMemberGroups>

IMPORTANT: Network metadata deploys are declarative — whatever you deploy becomes the full state. Do NOT create a new
.network-meta.xml
from scratch. Always read the existing file and add entries to it.

Deploy the updated network metadata:

bash

sf project deploy start \
  --source-dir <source-dir>/networks \
  --target-org <org-alias> --test-level NoTestRun

此配置确保新社区用户在站点级别自动获得MFA权限。

在项目中查找现有的
```
.network-meta.xml
```
：

bash

find . -name "*.network-meta.xml" -not -path "*/node_modules/*"

读取文件并定位
```
<networkMemberGroups>
```
部分。
添加权限集条目（若尚未存在）：

xml

<networkMemberGroups>
    <!-- 替换为步骤3b查询得到的社区配置文件名称 -->
    <profile>YOUR_COMMUNITY_PROFILE_NAME</profile>
    <!-- 添加MFA和API权限集 -->
    <permissionSet>MFA_Required_For_Community</permissionSet>
    <permissionSet>API_Enabled_For_Community</permissionSet>
</networkMemberGroups>

重要提示： 网络元数据部署为声明式操作 — 部署的内容即为完整状态。请勿从头创建新的
.network-meta.xml
。请始终读取现有文件并添加条目。

部署更新后的网络元数据：

bash

sf project deploy start \
  --source-dir <source-dir>/networks \
  --target-org <org-alias> --test-level NoTestRun

Step 6: Publish and verify

步骤6：发布并验证

bash

sf community publish --name "<site-name>" --target-org <org-alias>

Verification steps:

Open incognito browser
Navigate to site login page
Enter credentials → MFA challenge page should appear (on vforcesite domain)
Complete MFA → should land on the site, logged in

bash

sf community publish --name "<site-name>" --target-org <org-alias>

验证步骤：

打开隐身浏览器窗口
导航至站点登录页面
输入凭证 → 应显示MFA挑战页面（来自vforcesite域名）
完成MFA验证 → 应成功登录并进入站点

Rules

规则

Rule	Rationale
Never use the org-wide Identity Verification checkbox for community MFA	It only affects internal users — has no effect on community login
Always deploy `ApiEnabled` for React sites	Post-login API calls ( `sdk.graphql` , `sdk.fetch` ) will fail without it
Permission set names are exact — do not rename	`MFA_Required_For_Community` and `API_Enabled_For_Community` are the canonical names
Do not build custom MFA UI components	Platform handles the entire MFA challenge flow — custom UI would duplicate and conflict
Always assign before testing	Deployment alone does not activate MFA — assignment to specific users is required

规则	理由
切勿为社区MFA使用组织级身份验证复选框	该设置仅影响内部用户 — 对社区登录无作用
始终为React站点部署 `ApiEnabled`	若无此权限，登录后API调用（ `sdk.graphql` 、 `sdk.fetch` ）会失败
权限集名称必须精确 — 请勿重命名	`MFA_Required_For_Community` 和 `API_Enabled_For_Community` 为标准名称
请勿构建自定义MFA UI组件	平台会处理整个MFA挑战流程 — 自定义UI会重复功能并引发冲突
测试前必须完成权限分配	仅部署权限集不会激活MFA — 需分配给特定用户才生效

Gotchas

常见问题

Symptom	Cause	Fix
No MFA challenge on login	`ForceTwoFactor` permission not assigned to user	Verify PermissionSetAssignment exists for the user
`API_DISABLED_FOR_ORG` after login	Missing `ApiEnabled` permission	Assign `API_Enabled_For_Community` permission set
MFA page shows default Salesforce branding	No `NetworkBranding` metadata deployed	Read `references/branding.md` and deploy custom branding
`vforcesite` in MFA page URL	Expected behavior — not a bug	Platform serves login/MFA from Force.com Site domain
Identity Verification enabled but no community MFA	Wrong mechanism used	Use `ForceTwoFactor` via Permission Set instead
User already has MFA but isn't challenged	Active session exists	Test in incognito/private browser
Permission set deployed but MFA not enforced	Deployed but not assigned	Run assignment step — deploy != assign
No community users found in org	Users haven't been created or self-registered yet	Offer to create a test community user (Account → Contact → User hierarchy) for verification. Permission sets are still deployed and networkMemberGroups updated — org is MFA-ready for when users exist.
`FORBIDDEN: You do not have access to the Apex class named: UIBundleLogin`	Site guest profile missing Apex class access	Run Step 3c to grant guest profile access to all UIBundle login classes
Community user can't log in (redirects silently or gets `portal user email settings` error)	Community profile not a network member, or email deliverability not set to All Email	Add profile to `.network-meta.xml` `<networkMemberGroups>` and redeploy (Step 3b). Verify email deliverability is set to "All Email" in Setup → Email → Deliverability.

症状	原因	解决方法
登录时无MFA挑战	`ForceTwoFactor` 权限未分配给用户	验证用户是否存在PermissionSetAssignment记录
登录后出现 `API_DISABLED_FOR_ORG` 错误	缺少 `ApiEnabled` 权限	分配 `API_Enabled_For_Community` 权限集
MFA页面显示Salesforce默认品牌样式	未部署 `NetworkBranding` 元数据	阅读 `references/branding.md` 并部署自定义品牌样式
MFA页面URL包含 `vforcesite`	预期行为 — 并非bug	平台通过Force.com Site域名提供登录/MFA服务
已启用身份验证但社区无MFA	使用了错误的机制	改为通过权限集使用 `ForceTwoFactor`
用户已配置MFA但未触发挑战	存在活跃会话	使用隐身/隐私浏览器测试
权限集已部署但未强制启用MFA	已部署但未分配	执行权限分配步骤 — 部署≠分配
组织中未找到社区用户	用户尚未创建或自行注册	提议创建测试社区用户（Account → Contact → User层级）以验证。权限集仍会部署并更新networkMemberGroups — 组织已为用户创建后的MFA使用做好准备。
出现 `FORBIDDEN: You do not have access to the Apex class named: UIBundleLogin` 错误	站点访客配置文件缺少Apex类访问权限	执行步骤3c为访客配置文件授予所有UIBundle登录类的访问权限
社区用户无法登录（静默重定向或出现 `portal user email settings` 错误）	社区配置文件未加入网络成员，或邮件可送达性未设置为All Email	将配置文件添加至 `.network-meta.xml` 的 `<networkMemberGroups>` 并重新部署（步骤3b）。验证邮件可送达性是否在Setup → Email → Deliverability中设置为“All Email”。

Output Expectations

输出预期

Files generated in the user's project:

File	When
`permissionsets/MFA_Required_For_Community.permissionset-meta.xml`	Always
`permissionsets/API_Enabled_For_Community.permissionset-meta.xml`	Always

用户项目中生成的文件：

文件	生成时机
`permissionsets/MFA_Required_For_Community.permissionset-meta.xml`	始终生成
`permissionsets/API_Enabled_For_Community.permissionset-meta.xml`	始终生成

Cross-Skill Integration

跨技能集成

When	Delegate to
User only needs to assign (already deployed)	`dx-org-permission-set-assign`
User needs to deploy all project metadata	`platform-metadata-deploy`
User wants to customize the login page UI	`experience-ui-bundle-frontend-generate`
User needs to create a new generic permission set	`platform-permission-set-generate`
User wants IDP/Social Login (different from MFA)	Supported on React sites — the built-in Social Login component renders configured Auth Providers on the login page automatically (shipped in 264). Configure Auth Providers in Setup; no custom code needed. See `references/social-login.md` .

场景	委托至
用户仅需分配已部署的权限集	`dx-org-permission-set-assign`
用户需要部署所有项目元数据	`platform-metadata-deploy`
用户希望自定义登录页面UI	`experience-ui-bundle-frontend-generate`
用户需要创建新的通用权限集	`platform-permission-set-generate`
用户需要IDP/社交登录（与MFA不同）	React站点支持该功能 — 内置的社交登录组件会自动在登录页面渲染已配置的身份验证提供商（版本264起提供）。请在设置中配置身份验证提供商；无需自定义代码。详见 `references/social-login.md` 。

Reference File Index

参考文件索引

File	When to read
`assets/MFA_Required_For_Community.permissionset-meta.xml`	Step 2 — writing permission set to project
`assets/API_Enabled_For_Community.permissionset-meta.xml`	Step 2 — always deployed
`references/branding.md`	When user wants to customize MFA/login page appearance
`references/social-login.md`	When user wants IDP/SSO/Social Login on a React site alongside or instead of MFA
`references/setup.md`	Steps 3–5 — detailed assignment, network membership, and publish reference

文件	阅读时机
`assets/MFA_Required_For_Community.permissionset-meta.xml`	步骤2 — 将权限集写入项目时
`assets/API_Enabled_For_Community.permissionset-meta.xml`	步骤2 — 始终部署
`references/branding.md`	用户希望自定义MFA/登录页面外观时
`references/social-login.md`	用户希望在React站点上配置IDP/SSO/社交登录（可与MFA搭配或替代MFA）时
`references/setup.md`	步骤3–5 — 详细的权限分配、网络成员资格和发布参考