As a site administrator, I would like to be able to use TFA with a non-password based SSO/authentication like shibauth. Unfortunately the password verification in the first step of a user setting up the TFA application prompts them for a Drupal password that they do not have.
I propose creating an option that would be available to other plugins to allow for bypassing that password check. The plugins would have to account for handling it safely, but the option would need to exist in this module.
No harm in declining this, it can just reside here as possible patch for anyone else facing the use case I have described.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | bypass-password-checks-at-setup-2979978-2.patch | 1.18 KB | swirt |
Comments
Comment #2
swirtThis patch establishes the framework for bypassing the password check when a user sets up their 2FA application.
Comment #3
swirtHere is an example of other plugins using the password bypass.
https://www.drupal.org/project/tfa_basic/issues/2979983
Comment #4
damienmckennaAs a reminder, the "assigned" field should be set to "unassigned" when you're done working on changes - it's for indicating you're actively working on something, so if you're done it's polite to reset it. Thanks :)
Comment #5
cmlaraWith D7 EOL approaching closing as a duplicate of #2931150: Confirmation forms should not require passwords that is already open for the 2.x branch