I am evaluating Duo Two-Factor Authentication (this project) and Two Factor Authentication for Duo Security (TFA project plugin) and will begin some testing this week.

I am curious about the community's thoughts around which module to with and any concerns, issues, etc. that might be important in my further evaluation.

Here are some thoughts I have so far:

Duo Two-Factor Authentication (this project)

  • No Drupal 8 branch - Would like to know the plans here
  • Development appears to be handled on Github. Okay, but would prefer a normal Drupal development patter where work is done on drupal.org
  • The codebase appears to be built outside of Drupal best practices and coding standards. This is a concern for possible bugs, security issues, etc.
  • The project has a stable release and is covered by the security advisory policy
  • 319 sites currently report using this module

Two Factor Authentication for Duo Security (TFA project plugin)

  • No Drupal 8 branch - Would like to know the plans here
  • I like how this is a plugin for what appears to be a very well thought-out TFA system for Drupal (https://www.drupal.org/project/tfa)
  • Would like some input on which branch is best to use based on comments on the project page. "7.x-1.x uses Duo auth API to do the authentication. This may not be usable on non enterprise accounts. 7.x-2.x uses their webapi, but breaks some Drupal best practice."
  • The project has a beta release and is not covered by the security advisory policy
  • 19 sites currently report using this module

Comments

shrop created an issue.