I am looking at adding support for two factor authentication. Rather than replacing the existing authentication mechanism, the second factor would be in addition to the existing mechanism (be it local or a configured external authentication option). I know where in the user.module I would need to modify to do this for my purposes. But that isn't the reason I am writing this post.
My general question is, as I was unable to find any real discussion about it, are there plans in the works to change / modify the way authentication occurs? Right now (as of the 4.7-rc3) tree, it looks like the logic behind authentication is:
1. Check local auth
2. Attempt to guess the type of external auth
3. Loop through each module checking for an _auth hook
Stopping at whichever stage results in a successful login.
Further more, non-local authentication requires the username to be of the forn 'user@server'.
Now, specifically, I recall seeing a discussion about the whole 'user@server' issue being not ideal for things like OpenID, etc. But I can't remember where I saw that discussion. If it is still on going, any pointers would be helpful.
When it comes to authenticating users, I was curious if a "filtered" (or "chained") approach would be considered in the future? Meaning, rather than strictly looping through each module. It would be possible to construct different "authentication filters" that are chained together and a successful login only occurs after each filter is satisfied.