How to disable Email2FA action for specific user

[d4f3dQnK]

Hello everyone.

I store in database whether user wants email 2fa authentication. The question is simple, how can I apply this control in class?

Sorry to my poor English. 🤗

[datamweb]

Hello,
I didn't understand
Can you explain a little more?

https://lingva.ml/

[d4f3dQnK]

For instance, I want to check user's email 2fa option. Like:

        if ($user->email2fa === true && $authenticator->hasAction()) {
            return redirect()->route('auth-action-show')->withCookies();
        }

But it don't work like that. I think because sessions already set.

@datamweb Thank you

[d4f3dQnK]

*Code example in LoginController

[datamweb]

email2fa Where did it come from? Have you added a column named email2fa to the users table?

Explain what you want to add to the shield?
What made you make these changes?

[d4f3dQnK]

I'm so sorry.

I add a column in database. Named: email2fa.

If user set the email2fa setting false in their profile. I want to check on LoginController and pass the Email2FA action. But I can't in LoginController because (i think) auth action sessions are set.

How can i pass the Email2FA action for each user?

[datamweb]

It seems, the possibility of canceling the action through the LoginController is currently not available.

[ShapeShifter42]

Explain what you want to add to the shield?

I think what he’s looking for is to be able to enable/disable 2FA on a per-user basis. If a user feels that they want the added security of 2FA, they can use it. If they don’t want to be bothered with the extra step, it can be disabled, but only for that particular user.

There are many sites out there that don’t require 2FA, but they do allow a user to set it up for themselves. It’s a feature I may be interested in - the site I’m designing doesn’t really require it, but it would be nice to offer. On the other hand, many prospective users for my site have very limited computer expertise, and would be hampered or put off if it were forced on them. Some of my users tend to be high maintenance, and I know they would have a lot of trouble if they had to use 2FA.

[kenjis]

Extend the Email2FA class so that createIdentity() does nothing and returns if $user->email2fa is false.

[d4f3dQnK]

Thank you so much!

[AndrewDFrazier-SwofMedia]

The createIdentity() function is final and throws a fatal error if you try to override it: "Fatal error: Cannot override final method CodeIgniter\Shield\Authentication\Actions\Email2FA::createIdentity()". How would one go about getting around this?

[kenjis]

Upgrade your Shield.

[santosh-techmarcos]

where can i extend that Email2FA class

[kenjis]

It is better to extend Session::startUpAction() so that it returns false.

[santosh-techmarcos]

How? and which file i have to extent that class

[kenjis]

This.

shield/src/Authentication/Authenticators/Session.php

Line 197 in a38b3cc

public function startUpAction(string $type, User $user): bool

[santosh-techmarcos]

what i do if i want to skip Email2FA for admin's there are any way to achived that functionality.

[santosh-techmarcos]

can you please give me a sample whre i extend StartUpAction class.

[kenjis]

Add code to do nothing when an admin user logs in in your Session::startUpAction() method.
Or extend the Email2FA class so that createIdentity() does nothing and returns.

Do what you can do.