Support self-service TFA reset when locked out [#2497389]

For general locked-out users (those without admin-like roles) I think it's acceptable to relay trust to their email provider. If locked out, these people could initiate a TFA reset process where they're emailed a link that once clicked (and after verifying correct password) simply disables TFA for their account. This process could be limited to certain users (roles or code-based).

Provide a TFA plugin (for final tfa login form that can not be allowed for admin roles & module maintainer) and menu callback that validates link, user password, and does tfa disable.

Comment	File	Size	Author
#9	interdiff-6-9.txt	1.59 KB	banviktor
#9	2497389-9-self-service-reset.patch	12.72 KB	banviktor
#7	interdiff-5-6.patch	2.06 KB	banviktor
#7	2497389-6-self-service-reset.patch	12.63 KB	banviktor
#5	2497389-5-self-service-reset.patch	12.79 KB	banviktor

Comments

Comment #1

drumm

he/him

NY, US

commented 29 May 2015 at 21:08

Issue tags:

+affects drupal.org

Comment #2

coltrane

he/him

commented 29 May 2015 at 21:09

Linking to https://www.drupal.org/node/2481253 since it has a similar purpose, perhaps could be unified.

Comment #3

pjcdawkins commented 2 June 2015 at 08:22

Just so long as this is entirely optional (based on permissions?), as it weakens the point of TFA.

Comment #4

coltrane

he/him

commented 2 June 2015 at 13:49

Yes, it'll be an optional plugin (as well as per role) and it can form alter the admin page so as to warn about the security risk of enabling.

Comment #5

banviktor commented 16 November 2015 at 18:26

Status:

Active

» Needs review

Status	File	Size
new	2497389-5-self-service-reset.patch	12.79 KB

Here is a solution which uses the link generation algorithm from my #2481253: Allow Drush uli login command to bypass TFA patches (=> valid until login or 24 hours - configurable). The plugin is optional and when enabled a set of roles can be selected that can't use this plugin (defaults to administrator).

I had to extract the TFA disable process into tfa_basic_disable_tfa($account) to avoid code duplication.

Comment #6

banviktor commented 16 November 2015 at 19:27

Should the default excluded roles be everything but the authenticated role?

Comment #7

banviktor commented 19 November 2015 at 08:49

Status	File	Size
new	2497389-6-self-service-reset.patch	12.63 KB
new	interdiff-5-6.patch	2.06 KB

Default excluded roles are every role except authenticated. Also a watchdog event is recorded on a succesfull reset link access.

Comment #8

banviktor commented 25 November 2015 at 22:13

Status:

Needs review

» Needs work

It wasn't such a bright idea working on the 2 issues simultaneously while sharing some of the solution's code. I will get back to this when #2481253: Allow Drush uli login command to bypass TFA is committed.