login with email and 2fa

[jlopes90]

Email-based Two Factor Authentication (Email2FA) will send a 6-digit code to the user's email address that they must confirm before they can continue.

Login with email and password when entering and is it necessary to confirm email? seems repeated...

Can change without confirmation, just two-factor authentication only?

[kenjis]

Create your action class (or extend CodeIgniter\Shield\Authentication\Actions\Email2FA) and set it in Config\Auth::$actions['login'].

[jlopes90]

So it's like this, it looks like "class EmailActivator". It works fine.

<?php

namespace Shield\Authentication\Actions;

use CodeIgniter\Exceptions\PageNotFoundException;
use CodeIgniter\HTTP\IncomingRequest;
use CodeIgniter\HTTP\RedirectResponse;

use CodeIgniter\Shield\Authentication\Authenticators\Session;
use CodeIgniter\Shield\Entities\User;
use CodeIgniter\Shield\Exceptions\LogicException;
use CodeIgniter\Shield\Exceptions\RuntimeException;
use CodeIgniter\Shield\Models\UserIdentityModel;

/**
 * Class Email2FA
 *
 * Sends an email to the user with a code to verify their account.
 */
class Email2FA extends \CodeIgniter\Shield\Authentication\Actions\Email2FA
{
    private string $type = Session::ID_TYPE_EMAIL_2FA;

    public function show(): string
    {
        /** @var Session $authenticator */
        $authenticator = auth('session')->getAuthenticator();

        $user = $authenticator->getPendingUser();
        if ($user === null) {
            throw new RuntimeException('Cannot get the pending login User.');
        }

        $userEmail = $user->email;
        if ($userEmail === null) {
            throw new LogicException(
                'Email Activation needs user email address. user_id: ' . $user->id
            );
        }

        $code = $this->createIdentity($user);

        // Send the user an email with the code
        helper('email');
        $return = emailer()->setFrom(setting('Email.fromEmail'), setting('Email.fromName') ?? '')
            ->setTo($user->email)
            ->setSubject(lang('Auth.email2FASubject'))
            ->setMessage(view(setting('Auth.views')['action_email_2fa_email'], ['code' => $code]))
            ->send();

        if ($return === false) {
            throw new RuntimeException('Cannot send email for user: ' . $user->email);
        }

        return $this->displayMessage();
    }

    public function handle(IncomingRequest $request)
    {
        throw new PageNotFoundException();
    }

    public function verify(IncomingRequest $request)
    {
        $token = $request->getPost('token');

        /** @var Session $authenticator */
        $authenticator = auth('session')->getAuthenticator();

        // Token mismatch? Let them try again...
        if (!$authenticator->checkAction($this->type, $token)) {
            session()->setFlashdata('error', lang('Auth.invalid2FAToken'));

            return $this->displayMessage();
        }

        // Get our login redirect url
        return redirect()->to(config('Auth')->loginRedirect());
    }

    protected function displayMessage(): string
    {
        /* return view(setting('Auth.views')['action_email_2fa_verify']); */

        helper(['html']);

        return view('\Shield\Views\authentication\actions\email_2fa_show');
    }

    public function afterLogin(User $user): void
    {
        $this->createIdentity($user);
    }

    private function createIdentity(User $user): string
    {
        /** @var UserIdentityModel $identityModel */
        $identityModel = model(UserIdentityModel::class);

        $generator = static fn (): string => random_string('nozero', 6);

        return $identityModel->createCodeIdentity(
            $user,
            [
                'type'  => $this->type,
                'name'  => 'login',
                'extra' => lang('Auth.need2FA'),
            ],
            $generator
        );
    }

    public function getType(): string
    {
        return $this->type;
    }
}

[lonnieezell]

I have no problem with this in general. However, we do have to take into consideration those times when people are using just a username to sign up. While this isn't common, and not something I would have thought would happen, we have had at least one user already trying to make the system work that way. I guess it could work for internal company portals, or something.

So - maybe still showing the form but auto-filling the email address would work?

[datamweb]

@lonnieezell , in my country, phone numbers are usually used as usernames.
So I believe you should consider these conditions.

[MGatner]

My current "company" CI4 project uses a hacked-up version of Myth:Auth to work with usernames primarily because we use a Single Sign On service that returns the unique username (and also email, but those can be aliased so aren't safe for identifying). I haven't made the transition to Shield yet but I'm hoping the extensibility of authenticators will make it less "hacky"... but I do still think it will be in the category of "username-only identifying".