If the tfa module is used with the legal module and TFA is enabled for a role and a user with that role who has already set up their TFA access tries to reset their password they will receive an access denied error on a password reset instead of being prompted for their TFA code after agreeing to the Terms & Conditions from legal.

This issue was addressed in Legal 7.x, but the problem still exists in 8.x

Comments

robcarr created an issue. See original summary.

fjgarlin’s picture

fjgarlin commented

I think there are some related issues with also SSO systems or oauth. The problem is that the legal module clears the session (destroying any existing data) right after accepting the new terms. So that's most likely what's happening here too, or at least it looks like it.

I think the issue is this one: https://www.drupal.org/project/legal/issues/2897486 and these are the key lines from the module that provoke the issue:

// Destroy the current session, and reset $user to the anonymous user.
\Drupal::service('session_manager')->destroy();
greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Reviewed & tested by the community » Needs work

The change in #2 is not a patch so moving back to needs work.

john franklin’s picture

john franklin commented

Does the patch in #2897486: Don't log out users who do not accept the T&C fix TFA?