Protect only admin paths, without forced logout.

Created on 18 June 2018, almost 7 years ago
Updated 18 January 2025, 3 months ago

Use Case: A site using a passwordless primary authentication method like shibauth, the combination of shibauth and TFA creates a situation of infinite redirects because it forces a logout until TFA is successful, but that immediately bounces to shibauth which bounces back (repeat infinitely).

One solution I have worked out is to not force the initial TFA logout, but check for TFA upon trying to access any /admin/* paths.

Disclaimer: This is a bit of a hack that should probably not be rolled into the module, but I offer it as a patch solution to anyone in a similar situation.

✨ Feature request
Status

Closed: outdated

Version

2.0

Component

Code

Created by

πŸ‡ΊπŸ‡ΈUnited States swirt Florida

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • πŸ‡ΊπŸ‡ΈUnited States cmlara

    Drupal 7 end-of-life triage:
    Drupal 7 reached end of life on January 5th.

    The 7.x branches of TFA do not have any additional planned releases.

Production build 0.71.5 2024