I'm using the tfa module for a project with my work at Xequals. We also use the email_tfa as a way to authenticate users over email, but compared to tfa, it doesn't offer a lot of the features and integration we really want for a proper login experience. Plus, it is really hard to get the two to play nicely together as if they were a single interface.

After exploring the code for this project, I think we would be interested in building and contributing a plugin and/or additional module on top of tfa for using email as a way to deliver one time passwords, while also taking advantage of features like trusted browser validation.

I've been trying to get a sense of the best way to go about this. I can see that 2.0.x is in development, and I can see that there are some maintainer changes in this project.

Would you recommend I build a module based off of the 1.2.x series, or 2.0.x, or both? I'd not want to end up a situation where we put a bunch of time into an integration and it's useless in a few months.

Furthermore, would you recommend that I contribute this feature directly back to tfa, or as a separate module? I'm not totally wise on all of the inner workings of the future plans for this project, so I thought I'd at least make sure.

Ideally, I'd like for there to be a way for tfa to be the only module we have to use in the future to solve this problem, but I just don't know of any contrib modules that actually build on top of what tfa does.

Comments

abenbow created an issue. See original summary.

acbramley’s picture

acbramley commented

@abenbow that sounds like an interesting feature, right now as you say the maintenance of this module is in flux a bit. I have joined to try and get some movement on the 8.x-1.x branch but I am still new to the codebase so would not be looking at any new features at this time (mostly focussing on bug fixes and stabilisation).

I think your best option is to make a new contrib project that adds the plugin, ideally one that works with 8.x-1.x since 2.x is not production ready and I doubt anyone will look at it any time soon.

We can possibly look at bringing the contrib plugin into this module in the future when things settle.

acbramley’s picture

acbramley commented
Status: Active » Closed (won't fix)

I just realised this already exists https://www.drupal.org/project/tfa_email_otp

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

abenbow’s picture

abenbow
He/Him/His
Primary language English
commented

Yeah, I just discovered this the other day. It was a little tricky to find as I hadn't searched for OTP in particular. Regardless looks like this is ready to go! Thanks for the callout.

One note: is it possible to make mention of this project (and other tfa plugins) on the project description so they're easy to find?

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Closed (won't fix) » Needs work

#5 makes sense to me, yeah. Can you propose some copy/HTML for that?

cmlara’s picture

cmlara
he/him
commented

@abenbow:
To help you in the future, D.O. does provide an ecosystem list that modules can opt into. It is labeled “Projects that extend this” on the modules page and for TFA is located at https://www.drupal.org/project/tfa/ecosystem.

I recommend it as first-start anytime you’re looking for extensions. It’s not 100% of them for every project as it requires the third party module to “opt in” to being listed, however in my experience usually any serious contender will be listed and only minor modules will be missing.

abenbow’s picture

abenbow
He/Him/His
Primary language English
commented
Component: Code » Documentation
Assigned: Unassigned » abenbow
Status: Needs work » Needs review

Cheers, @greggles

Here's a proposal for the front page:

  <h2>Modules that extend TFA</h2>
  <p>Below is a list of currently maintained modules that integrate with a current release of tfa and extend its capabilities</p>
  <ul>
    <li><a href="https://www.drupal.org/project/tfa_smsapi">TFA SMSAPI</a>: authenticate users over SMS</li>
    <li><a href="https://www.drupal.org/project/tfa_migration">TFA Migration</a>: provides a migration interface to help move TOTP seeds from Drupal 7 to 8 and above</li>
    <li><a href="https://www.drupal.org/project/tfa_headless">TFA Headless</a>: exposes the authentication routes from TFA as REST API endpoints</li>
     <li><a href="https://www.drupal.org/project/tfa_email_otp">TFA Email OTP Plugin</a>: provides email OTP as a TFA auth method</li>
    <li><a href="https://www.drupal.org/project/tfa_email_support">TFA Email Support</a>*: provides email OTP as an TFA auth method</li>
     <li><a href="https://www.drupal.org/project/tfa_duo">TFA Duo</a>:* provides a TFA plugin for Duo security</li>
  </ul>
<p>* : not covered by security policy</p>
<p>Also see the list of modules listed in the <a href="https://www.drupal.org/project/tfa/ecosystem">TFA Ecosystem</a>. Please be aware that some modules in this list are outdated, unsupported, or don't directly integrate with the tfa module.</p>

And here's a human-readable preview:

Modules that extend TFA

Below is a list of currently maintained modules that integrate with a current release of tfa and extend its capabilities

* : not covered by security policy

Also see the list of modules listed in the TFA Ecosystem. Please be aware that some modules in this list are outdated, unsupported, or don't directly integrate with the tfa module.

acbramley’s picture

acbramley commented
Status: Needs review » Fixed

Thanks so much @abenbow! I've added that to the project page.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.