Hi,
has anyone setup TFA-module to work with Drupalgap?
I would like to use TFA on the website, but skip the two-factor-authentication in mobile.

README-file of TFA-module has the following example for skipping the authentication by using the loginAllowed()-function:

<?php

class TfaTestLogin extends TfaBasePlugin implements TfaLoginPluginInterface {

  protected $loginUid;

  public function __construct(array $context = array(), $uid) {
    parent::__construct($context);
    $this->loginUid = $uid;
  }

  public function loginAllowed() {
    if ($this->context['uid'] === $this->loginUid) {
      return TRUE;
    }
    return FALSE;
  }
}

Any ideas how should I implement this function with Drupalgap? I'll continue my research with this topic, but I'll gladly take any tips related to it.

Comments

fantastiko created an issue.

fantastiko’s picture

fantastiko CreditAttribution: fantastiko commented

Okey, my first version of the plugin looks like this:

<?php

class TfaBasicLogin extends TfaBasePlugin implements TfaLoginPluginInterface {

  protected $loginUrl;

  public function __construct(array $context = array()) {
    parent::__construct($context);
    $this->loginUrl = 'q=drupalgap/user/login.json';
  }

  public function loginAllowed() {
    if ($_SERVER['QUERY_STRING'] == $this->loginUrl) {
      return TRUE;
    }
    return FALSE;
  }
}

So here we check the request address and if it equals to drupalgap login query which is ?=drupalgap/user/login.json' we return loginAllowed()-function as TRUE.
This plugin is working as desired, if we login with browser the site requires the TFA, but while accesing the site with DG we skip the TFA-process.

I'm still wondering if there is a better way to verify if the user is logging in with services or normal way...