Authenticator links clean up

Created on 13 September 2023, 10 months ago
Updated 26 October 2023, 8 months ago

Problem/Motivation

Google Authenticator link is broken.

Steps to reproduce

  1. Enable TFA
  2. Navigate to view profile
  3. Click on TFA tab
  4. Click on Set up application link
  5. Click on Google Authenticator link

Proposed resolution

  1. Update link to include options for Android and iOS
  2. Change โ€˜Authyโ€™ to โ€˜Twilio Authyโ€™ to avoid confusion/make sure people donโ€™t download the wrong app

Remaining tasks

User interface changes

API changes

Data model changes

๐Ÿ› Bug report
Status

Fixed

Version

1.0

Component

Code

Created by

๐Ÿ‡ฆ๐Ÿ‡บAustralia yeniatencio

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

  • Issue created by @yeniatencio
  • ๐Ÿ‡ฆ๐Ÿ‡บAustralia yeniatencio

    Please review patch.

  • Open in Jenkins โ†’ Open on Drupal.org โ†’
    Core: 9.5.x + Environment: PHP 8.1 & MariaDB 10.3.22
    last update 10 months ago
    21 pass
  • ๐Ÿ‡ฆ๐Ÿ‡บAustralia yeniatencio

    Please review patch for 2.x version

  • Open in Jenkins โ†’ Open on Drupal.org โ†’
    Core: 10.1.x + Environment: PHP 8.1 & MariaDB 10.3.22
    last update 10 months ago
    21 pass
  • Status changed to Needs work 10 months ago
  • ๐Ÿ‡บ๐Ÿ‡ธUnited States cmlara
    1. +++ b/src/Plugin/Tfa/TfaHotp.php
      @@ -30,7 +30,7 @@ use Symfony\Component\DependencyInjection\ContainerInterface;
      + *    "Google Authenticator (Android/iOS)" = "https://support.google.com/accounts/answer/1066447?sjid=8469089794140994367-AP&co=GENIE.Platform%3DAndroid&oco=0",
      

      This link appears to have tracking data that should not be included.

    2. +++ b/src/Plugin/Tfa/TfaTotp.php
      @@ -30,11 +30,12 @@ use Symfony\Component\DependencyInjection\ContainerInterface;
      + *    "Google Authenticator (Android/iOS)" = "https://support.google.com/accounts/answer/1066447?sjid=8469089794140994367-AP&co=GENIE.Platform%3DAndroid&oco=0",
      

      Same as the HOTP comment.

    3. +++ b/src/Plugin/Tfa/TfaTotp.php
      @@ -30,11 +30,12 @@ use Symfony\Component\DependencyInjection\ContainerInterface;
      - *    "GAuth Authenticator (Desktop)" = "https://github.com/gbraadnl/gauth",
      

      Why the removal?

    4. +++ b/src/Plugin/Tfa/TfaTotp.php
      @@ -30,11 +30,12 @@ use Symfony\Component\DependencyInjection\ContainerInterface;
      + *    "Protecc - 2FA Authenticator (Windows)" = "https://apps.microsoft.com/store/detail/protecc-2fa-authenticator-totp/9PJX91M06TZS?hl=en-au&gl=au&rtc=1",
      + *    "Authenticator 2FA | Sentinel (MAC)" = "https://apps.apple.com/au/app/authenticator-2fa-sentinel/id1189922806"
      

      Adding new records should probably be done in a separate feature request. I'm not sure what the existing entries had to go through to get on the list, but considering were talking security tokens I don't personally want to add any new entries without a discussion about them on why they should be on the list (we obviously can't and shouldn't list every token that exists in this help link list.)

  • ๐Ÿ‡ฆ๐Ÿ‡บAustralia yeniatencio

    Thanks cmlara. I have removed the tracking data from the links as point out.
    Uploading new patch for version 8.x-1.x

    Regarding, adding new links, completely makes sense. However, adding those for a very specific use case on my side.

  • ๐Ÿ‡บ๐Ÿ‡ธUnited States cmlara

    @yeniatencio It general it is helpful if patches don't have local environment use changes in them.

    However, adding those for a very specific use case on my side.

    Just in case you mean you are using D.O. to host patches that you use as part of your composer deployment I will note this is generally not recommended for both security and stability reasons. D.O could be compromised at any time meaning patches hosted on D.O. could pose a risk to a site, additionally there have been times during security windows where load has caused D.O. to go offline preventing deployment.

  • Status changed to Needs review 8 months ago
  • ๐Ÿ‡ฎ๐Ÿ‡ณIndia Bhanu951

    I am resubmitting my patch from ๐Ÿ› Wrong domain name for Google Authenticator on TOTP and HOTP setup page Needs review as it was closed as duplicate.

    Please review the patch. It has different links from the other patches submitted here earlier.

  • Status changed to Needs work 8 months ago
  • ๐Ÿ‡บ๐Ÿ‡ธUnited States cmlara

    This will still need the Twillo name change from the original patch as that is in scope.

    As for the links:
    At first I was inclined for a single link of the first patch to keep the UI less cluttered. however reading the text on the KB page, and acknowledging it is a KB not a product page I think the links provided by @Bhanu951 are the better choice.

    Side note:
    We recently switched to Fully GitlabCi so we canโ€™t actually test patch files in this project going forward.

  • Status changed to Needs review 8 months ago
  • ๐Ÿ‡ฎ๐Ÿ‡ณIndia Bhanu951

    Updated the patch addressing the review comments and created the new MR.

  • ๐Ÿ‡ฎ๐Ÿ‡ณIndia Bhanu951

    Updated the MR addressing the review comments please re-review.

  • Status changed to Downport 8 months ago
  • ๐Ÿ‡บ๐Ÿ‡ธUnited States cmlara

    Committed to 2.x, doesn't apply cleanly to 8.x-.1.x.

  • ๐Ÿ‡ฎ๐Ÿ‡ณIndia Bhanu951
  • Status changed to Needs review 8 months ago
  • ๐Ÿ‡ฎ๐Ÿ‡ณIndia Bhanu951

    Ported patch to 8.x-.1.x please review MR #55

  • Status changed to Fixed 8 months ago
  • ๐Ÿ‡บ๐Ÿ‡ธUnited States cmlara

    LGTM, merged to dev.

    Thank you!

  • Automatically closed - issue fixed for 2 weeks with no activity.

Production build 0.69.0 2024