Problem/Motivation

Hi, how would one go about requiring TFA (with enabled plugins) for other places than login such as deleting own user account or accessing custom webforms/forms/routes with sensitive content?

CommentFileSizeAuthor
#9 3323866-offer-tfa-flow-5.patch42.28 KBbandana
#8 3323866-offer-tfa-flow-4.patch42.28 KBbandana
#6 3323866-offer-tfa-flow-3.patch41.89 KBbandana
#5 3323866-offer-tfa-flow-2.patch40.49 KBbandana
#3 3323866-offer-tfa-flow.patch38.41 KBbandana

Comments

Bandana created an issue. See original summary.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Title: TFA for other use cases than login » Offer TFA flow for other use cases than login
Version: 2.0.0-alpha1 » 2.x-dev
Category: Support request » Feature request

I think this makes sense as a feature concept. I believe its' not currently possible, so marking this as a feature.

The idea you're requesting is hinted at in #2931150: Confirmation forms should not require passwords so you might want to check that out.

bandana’s picture

bandana commented
Status: Active » Needs review
StatusFileSize
new 3323866-offer-tfa-flow.patch38.41 KB

I hope I'm on the right track here..

This is based on an event listener that replaces the current request controller with its own through
the setController() method to redirect and start the tfa process based on the core tfa module

I placed it in a sub-module since it runs on each page request
which you might not want if you are mainly interested in login functionality.

It is limited to authenticated users

It is pluggable to allow for custom route evaluation

It dispatches events before and after plugin evaluation to allow for preemptive and override actions

Minimum valid time between tfa processes is hardcoded to 15 seconds to allow for bad connection/slow page loads

I had to make a few edits in the following core files to make this feature work:
tfa.routing.yml
TfaLoginController.php
EntryForm.php

Status: Needs review » Needs work

The last submitted patch, 3: 3323866-offer-tfa-flow.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

bandana’s picture

bandana commented
StatusFileSize
new 3323866-offer-tfa-flow-2.patch40.49 KB

Added no_cache option to all tfa enabled routes

bandana’s picture

bandana commented
StatusFileSize
new 3323866-offer-tfa-flow-3.patch41.89 KB

Code cleanup and fixing failed tests

bandana’s picture

bandana commented
Status: Needs work » Needs review
bandana’s picture

bandana commented
StatusFileSize
new 3323866-offer-tfa-flow-4.patch42.28 KB

Fixed some bugs and added redirect command for ajax requests.

bandana’s picture

bandana commented
StatusFileSize
new 3323866-offer-tfa-flow-5.patch42.28 KB

Dispatched events fix.

jcnventura’s picture

jcnventura
Primary language English
commented
Status: Needs review » Needs work

I really like this, but not as an optional module. The module should have a major refactor to be event subscriber-based to avoid having to mess so much with Drupal's internals.

bandana’s picture

bandana commented

Does it make sense for that to happen in the current 2.x branch or 3.x?

jcnventura’s picture

jcnventura
Primary language English
commented

2.x branch is very early alpha, so this would be in the current branch.