How to deploy TwoFactorX to front-end / Login

[deJaya]

Hi, I'm just testing this and it's looking really great.

In terms of adding an Authentication Code field to the front-end login form provided by the Login Extra - I don't see any documentation on how to do this.

In GoogleAuthenticatorX we could add something like:

<label class="loginUsernameLabel">[[%gax.authkey? &namespace=`GoogleAuthenticatorX`]]
     <input class="loginUsername" type="text" name="token" />
</label>

Any advice on this?

Thanks

[weboopl]

You can insert 'code' field into LoginTpl like:
<input type="text" name="code"/>

but still won't get logged in. However calling preHooks=TwoFactorXLogin within Login snippet seems to check for Google Authentication Code and validate it, but do not let you log in even if the code is correct.

[[!Login?
  &preHooks=`TwoFactorXLogin`
]]

Anyone to solve this?

[deJaya]

Hi again, thanks for your suggestions @weboopl .. I see this is now reflected in the docs

I've altered my Login call:

[[!login? &preHooks=`TwoFactorXLogin`]]

and added the following field to the login form tpl:

<input type="text" name="code" />

However, although the code field appears - in all cases I can log in without specifying the auth code - just supplying the user & password. Even supplying an incorrect code gets me logged in.

TwoFactorX is enabled and works as expected on the Manager login page.

I'd love to get this working - any help much appreciated.

MODX 3.0.5-pl
TwoFactorX 1.0.5-pl

[deJaya]

in twofactorx\src\Snippets\LoginHook.php .. line 50:

if (!$settings['totp_disabled'] && $settings['inonetime'] == 'yes') {

Is it possible that the logic here may be wrong?

Switching it to:

if (!$settings['totp_disabled'] && $settings['inonetime'] == 'no') {

appears to result in the expected behaviour.

[deJaya]

Or perhaps inonetime does not need to be checked for front-end users?

if (!$settings['totp_disabled']) {

[al5040]

Hello deJaya,

In my opinion, the inonetime parameter should not be checked for front-end users.
The settings for individual users are extended parameters in the user profile. However, since these parameters are encrypted, checking their values ​​is unfortunately not so easy.

Best regards

[deJaya]

Switching line 50 to if (!$settings['totp_disabled']) { certainly works.

[al5040]

Yes, this works.

Checking the inonetime parameter in the hook should depend on the twofactorx.enable_onetime parameter in the system settings. However, that probably won't help either, because even though I enabled this parameter again, inonetime remains set to No. It's really one time.

Conclusion for me. It's best to leave onetime sign-on deactivated from the start.