Automattic / Automattic/jetpack

SSO: Better handling of login interruption by wp_login action

Open
#2,836 3 comments 0 reactions 1 assignee Claimed by @kraftbj View on GitHub
[Feature] SSO [Status] In Progress Enhancement
Dominant language
PHP
Stars
1.8k
Forks
898
Avg merge
1d 18h
Merged PRs (30d)
774

Description

The Two-Factor Authentication plugin (core feature, aiming for 4.5) looks into the `wp_login` action, which occurs after our SSO fires, but before `wp_signon` returns the user.

In this case, after our SSO fires, the 2fa plugin asks for a 2fa code. Once submitted, it returns the user to the `https://example.com/wp-login.php?action=jetpack-sso&result=success&user_id=XXXXXX&sso_nonce=XXXXXX` URL, which errors out https://github.com/Automattic/jetpack/blob/master/modules/sso.php#L565

Untested thought: If a current user is set, return out early to the `login_redirect` cookie value?

Ref: https://github.com/georgestephanis/two-factor/issues/84
Marking a vFuture as, assuming 2fa marches on toward an 4.5 (~April 2016) merge, we'll need to be sure this is either handled or compatible with whatever ends up being the final approach.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.