login with email and 2fa

[jlopes90]

Email-based Two Factor Authentication (Email2FA) will send a 6-digit code to the user's email address that they must confirm before they can continue.

Login with email and password when entering and is it necessary to confirm email? seems repeated...

Can change without confirmation, just two-factor authentication only?

[kenjis]

Create your action class (or extend CodeIgniter\Shield\Authentication\Actions\Email2FA) and set it in Config\Auth::$actions['login'].

[jlopes90]

So it's like this, it looks like "class EmailActivator". It works fine.

<?phpnamespaceShield\Authentication\Actions;
useCodeIgniter\Exceptions\PageNotFoundException;
useCodeIgniter\HTTP\IncomingRequest;
useCodeIgniter\HTTP\RedirectResponse;
useCodeIgniter\Shield\Authentication\Authenticators\Session;
useCodeIgniter\Shield\Entities\User;
useCodeIgniter\Shield\Exceptions\LogicException;
useCodeIgniter\Shield\Exceptions\RuntimeException;
useCodeIgniter\Shield\Models\UserIdentityModel;
/** * Class Email2FA * * Sends an email to the user with a code to verify their account. */class Email2FA extends \CodeIgniter\Shield\Authentication\Actions\Email2FA
{
privatestring$type = Session::ID_TYPE_EMAIL_2FA;
publicfunctionshow(): string
{
/** @var Session $authenticator */$authenticator = auth('session')->getAuthenticator();
$user = $authenticator->getPendingUser();
if ($user === null) {
thrownewRuntimeException('Cannot get the pending login User.');
}
$userEmail = $user->email;
if ($userEmail === null) {
thrownewLogicException(
'Email Activation needs user email address. user_id: ' . $user->id
);
}
$code = $this->createIdentity($user);
// Send the user an email with the codehelper('email');
$return = emailer()->setFrom(setting('Email.fromEmail'), setting('Email.fromName') ?? '')
->setTo($user->email)
->setSubject(lang('Auth.email2FASubject'))
->setMessage(view(setting('Auth.views')['action_email_2fa_email'], ['code' => $code]))
->send();
if ($return === false) {
thrownewRuntimeException('Cannot send email for user: ' . $user->email);
}
return$this->displayMessage();
}
publicfunctionhandle(IncomingRequest$request)
{
thrownewPageNotFoundException();
}
publicfunctionverify(IncomingRequest$request)
{
$token = $request->getPost('token');
/** @var Session $authenticator */$authenticator = auth('session')->getAuthenticator();
// Token mismatch? Let them try again...if (!$authenticator->checkAction($this->type, $token)) {
session()->setFlashdata('error', lang('Auth.invalid2FAToken'));
return$this->displayMessage();
}
// Get our login redirect urlreturnredirect()->to(config('Auth')->loginRedirect());
}
protectedfunctiondisplayMessage(): string
{
/* return view(setting('Auth.views')['action_email_2fa_verify']); */helper(['html']);
returnview('\Shield\Views\authentication\actions\email_2fa_show');
}
publicfunctionafterLogin(User$user): void
{
$this->createIdentity($user);
}
privatefunctioncreateIdentity(User$user): string
{
/** @var UserIdentityModel $identityModel */$identityModel = model(UserIdentityModel::class);
$generator = staticfn (): string => random_string('nozero', 6);
return$identityModel->createCodeIdentity(
$user,
[
'type' => $this->type,
'name' => 'login',
'extra' => lang('Auth.need2FA'),
],
$generator
);
}
publicfunctiongetType(): string
{
return$this->type;
}
}

[lonnieezell]

I have no problem with this in general. However, we do have to take into consideration those times when people are using just a username to sign up. While this isn't common, and not something I would have thought would happen, we have had at least one user already trying to make the system work that way. I guess it could work for internal company portals, or something.

So - maybe still showing the form but auto-filling the email address would work?

[datamweb]

@lonnieezell , in my country, phone numbers are usually used as usernames.
So I believe you should consider these conditions.

[MGatner]

My current "company" CI4 project uses a hacked-up version of Myth:Auth to work with usernames primarily because we use a Single Sign On service that returns the unique username (and also email, but those can be aliased so aren't safe for identifying). I haven't made the transition to Shield yet but I'm hoping the extensibility of authenticators will make it less "hacky"... but I do still think it will be in the category of "username-only identifying".