This module is not compatible with the Password Policy module (and possibly other modules that use drupal_goto inside of hook_user_login(). One way to experience a problem is to use that module's "Password Expiration Warning" setting. The resulting effect of this is that a user who has a password that about to expire will be redirected upon user_login, and will not be required to provide 2-factor auth. Duo.module gives itself a very high weight in the system table (4000), and any other modules redirecting the user during login will avoid triggering the Duo 2-factor login.

Why a weight of 4000? -4000 would make more sense (in this scenario).

Comments

Leeteq’s picture

Leeteq commented
Version: 7.x-1.8 » 7.x-1.9
Related issues: +#2507409: Immediately logged out when using password reset form

Ref. #2507409: Immediately logged out when using password reset form ..:

"I think that it would be generally useful if we took this discussion on a general level that would constitute a "best practise" behaviour and guideline for other module developers that are also figuring out such workflow and cross-module compatibilities."

chousmith’s picture

chousmith commented
Status: Active » Needs work

I just ran in to this issue again today with Password Policy set to Expire Passwords after 90 days, admin-level user password was to expire within the next 7 days, which bypassed Duo 2-factor auth. Some 4 years after the issue was initially reported.

Drupal 7.59 + Duo v7.x-1.1 + Password Policy 7.x-1.15