Automattic / Automattic/jetpack
SSO: Better handling of login interruption by wp_login action
- Dominant language
- PHP
- Stars
- 1.8k
- Forks
- 898
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 774
Description
The Two-Factor Authentication plugin (core feature, aiming for 4.5) looks into the `wp_login` action, which occurs after our SSO fires, but before `wp_signon` returns the user.
In this case, after our SSO fires, the 2fa plugin asks for a 2fa code. Once submitted, it returns the user to the `https://example.com/wp-login.php?action=jetpack-sso&result=success&user_id=XXXXXX&sso_nonce=XXXXXX` URL, which errors out https://github.com/Automattic/jetpack/blob/master/modules/sso.php#L565
Untested thought: If a current user is set, return out early to the `login_redirect` cookie value?
Ref: https://github.com/georgestephanis/two-factor/issues/84
Marking a vFuture as, assuming 2fa marches on toward an 4.5 (~April 2016) merge, we'll need to be sure this is either handled or compatible with whatever ends up being the final approach.
Contributor guide
Assessment
This issue has not been assessed yet.