We externally authenticate our users externally and the routine that does that sets up a bunch of items in the session and creates a special user block. When we use TFA, the session_destroy() call in tfa_user_login wipes all this out. I've commented it out and all seems to work fine, but I'm curious about whether I'm creating a security flaw.

Thanks,
Mike

Comments

cashwilliams’s picture

cashwilliams commented
Status: Active » Postponed (maintainer needs more info)

Mike,

I think rather then disability things in TFA, you could try to write a hook_user_login function (http://api.drupal.org/api/drupal/modules%21user%21user.api.php/function/...) which would setup the items in session your referencing. This would get called after a user is validated through the full TFA process at http://drupalcode.org/project/tfa.git/blob/refs/heads/7.x-1.x:/tfa.pages...

coltrane’s picture

coltrane
he/him
commented
Status: Postponed (maintainer needs more info) » Closed (works as designed)

The session_destroy() is important for protection against session fixation attacks so it should not be removed.