Using with JWT authentication

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Author Kaspars

    (@kasparsd)

    6 years, 9 months ago

    There is no standard way to use two factor authentication for API calls.

    We disabled API-level authentication for users with two-factor enabled in this pull request.

    There is a filter to remove this restriction and allow password based authentication for users with two-factor enabled:

    add_filter( 'two_factor_user_api_login_enable', '__return_true' );

    You can also adjust the return value for the filter based on the user ID value that is passed as the second parameter to this filter.

    I strongly suggest you install and use the Application Passwords plugin instead of sharing your regular user password with applications.

    • This reply was modified 6 years, 9 months ago by Kaspars. Reason: Mention the user ID param for the filter
    Thread Starter menathor

    (@menathor)

    6 years, 9 months ago

    Thanks for the reply Kaspars. Just to clarify, does the ‘two_factor_user_api_login_enable’ filter allow API authentication without requiring the OTP? Or does the OTP need to be supplied along with the username and password?

    I’m creating a single mobile app for my multisite membership site that needs to work without manually configuring settings for each user. I’m making the experience similar to other mobile apps, i.e. login with email address and password. That’s why I was leaning towards JWT authentication.

    I was hoping to somehow add OTPs on top of this. Perhaps there’s a hack that would let me do it in the app? For example after a successful token auth, is there a way to retrieve the authenticator secret via the options API or something? That would allow me to validate the same OTP codes in the app.

    Cheers

    • This reply was modified 6 years, 9 months ago by menathor.
    Plugin Author Kaspars

    (@kasparsd)

    6 years, 9 months ago

    does the ‘two_factor_user_api_login_enable’ filter allow API authentication without requiring the OTP?

    Yes, correct. It will essentially disable the second factor for API authentication.

    I was hoping to somehow add OTPs on top of this. Perhaps there’s a hack that would let me do it in the app?

    I’m not aware of any application or service doing this. Even Google requires you to use application passwords for apps to get around the two-factor restrictions.

    Thread Starter menathor

    (@menathor)

    6 years, 9 months ago

    Ok cool, thank you!

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘Using with JWT authentication’ is closed to new replies.