Skip to content

Commit bdf794c

Browse files
markshustmarkshust
committed
Updates per code review for #4 
1 parent 6dc29e2 commit bdf794c

File tree

9 files changed

+125
-91
lines changed

9 files changed

+125
-91
lines changed

‎CHANGELOG.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,15 @@ All notable changes to this project will be documented in this file.
44
The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
55
and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
66

7+
## [1.1.0] - 2020-01-12
8+
9+
### Added
10+
- Support to disable 2FA for API token generation ([#1](https://github.com/markshust/magento2-module-disabletwofactorauth/issues/1)).
11+
12+
### Updated
13+
- Updated docblocks and other minor formatting issues.
14+
- Updated REAMDE to make it more explicit not to disable 2FA within production environments.
15+
716
## [1.0.0] - 2020-08-10
817

918
### Added

‎Plugin/BypassTwoFactorAuth.php‎

Lines changed: 25 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,29 +6,46 @@
66
use Magento\Framework\App\Config\ScopeConfigInterface;
77
use Magento\TwoFactorAuth\Model\TfaSession;
88

9+
/**
10+
* Class BypassTwoFactorAuth
11+
* @package MarkShust\DisableTwoFactorAuth\Plugin
12+
*/
913
class BypassTwoFactorAuth
1014
{
15+
const XML_PATH_CONFIG_ENABLE = 'twofactorauth/general/enable';
16+
1117
/** @var ScopeConfigInterface */
12-
private $scopeConfig;
18+
private ScopeConfigInterface $scopeConfig;
1319

20+
/**
21+
* BypassTwoFactorAuth constructor.
22+
* @param ScopeConfigInterface $scopeConfig
23+
*/
1424
public function __construct(
1525
ScopeConfigInterface $scopeConfig
1626
) {
1727
$this->scopeConfig = $scopeConfig;
1828
}
1929

2030
/**
21-
* If the TwoFactorAuth module Enable setting is set to false, always return true here so all requests bypass 2FA.
22-
* Otherwise, return the original result.
31+
* Enables the bypass of 2FA for admin access.
32+
* This can be useful within development & integration environments.
33+
*
34+
* If 2FA is enabled, return the original result.
35+
* If 2FA is disabled, always return true so all requests bypass 2FA.
36+
*
37+
* NOTE: Always keep 2FA enabled within production environments for security purposes.
2338
*
2439
* @param TfaSession $subject
2540
* @param $result
2641
* @return bool
2742
*/
28-
public function afterIsGranted(TfaSession $subject, $result): bool
29-
{
30-
return !$this->scopeConfig->isSetFlag('twofactorauth/general/enable')
31-
? true
32-
: $result;
43+
public function afterIsGranted(
44+
TfaSession $subject,
45+
$result
46+
): bool {
47+
return $this->scopeConfig->isSetFlag(self::XML_PATH_CONFIG_ENABLE)
48+
? $result
49+
: true;
3350
}
3451
}

‎Plugin/BypassTwoFactorAuthForApiTokenGeneration.php‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
<?php
2+
declare(strict_types=1);
3+
4+
namespace MarkShust\DisableTwoFactorAuth\Plugin;
5+
6+
use Closure;
7+
use Magento\Framework\App\Config\ScopeConfigInterface;
8+
use Magento\Framework\Exception\AuthenticationException;
9+
use Magento\Framework\Exception\InputException;
10+
use Magento\Framework\Exception\LocalizedException;
11+
use Magento\Integration\Api\AdminTokenServiceInterface;
12+
use Magento\TwoFactorAuth\Model\AdminAccessTokenService;
13+
14+
/**
15+
* Class BypassWebApiTwoFactorAuth
16+
* @package MarkShust\DisableTwoFactorAuth\Plugin
17+
*/
18+
class BypassTwoFactorAuthForApiTokenGeneration
19+
{
20+
const XML_PATH_CONFIG_ENABLE_FOR_API_TOKEN_GENERATION = 'twofactorauth/general/enable_for_api_token_generation';
21+
22+
/** @var ScopeConfigInterface */
23+
private ScopeConfigInterface $scopeConfig;
24+
25+
/** @var AdminTokenServiceInterface */
26+
private AdminTokenServiceInterface $adminTokenService;
27+
28+
/**
29+
* BypassTwoFactorAuthForApiTokenGeneration constructor.
30+
* @param AdminTokenServiceInterface $adminTokenService
31+
* @param ScopeConfigInterface $scopeConfig
32+
*/
33+
public function __construct(
34+
AdminTokenServiceInterface $adminTokenService,
35+
ScopeConfigInterface $scopeConfig
36+
) {
37+
$this->scopeConfig = $scopeConfig;
38+
$this->adminTokenService = $adminTokenService;
39+
}
40+
41+
/**
42+
* Enables the bypass of 2FA for API token generation.
43+
* This can be useful for third-party vendors during module development.
44+
*
45+
* NOTE: Always keep 2FA enabled within production environments for security purposes.
46+
*
47+
* @param AdminAccessTokenService $subject
48+
* @param Closure $proceed
49+
* @param $username
50+
* @param $password
51+
* @return string
52+
* @throws AuthenticationException
53+
* @throws InputException
54+
* @throws LocalizedException
55+
*/
56+
public function aroundCreateAdminAccessToken(
57+
AdminAccessTokenService $subject,
58+
Closure $proceed,
59+
$username,
60+
$password
61+
): string {
62+
return $this->scopeConfig->isSetFlag(self::XML_PATH_CONFIG_ENABLE_FOR_API_TOKEN_GENERATION)
63+
? $proceed($username, $password)
64+
: $this->adminTokenService->createAdminAccessToken($username, $password);
65+
}
66+
}

‎Plugin/BypassWebApiTwoFactorAuth.php‎

Lines changed: 0 additions & 67 deletions
This file was deleted.

‎README.md‎

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -42,14 +42,25 @@ bin/magento setup:upgrade
4242
This module keeps 2FA enabled by default. This is to prevent any unexpected side effects or security loopholes from
4343
being introduced during automated installation processes.
4444

45-
After installing the module, one can disable 2FA by going to **Admin > Stores > Settings > Configuration >
46-
Security > 2FA**, and setting *Enable 2FA* to **No**.
45+
### Disable 2FA
4746

48-
This setting can also be toggled to a 1 or 0 to respectively enable or disable 2FA from the command-line console:
47+
Enables the bypass of 2FA for admin access. This can be useful within development & integration environments.
4948

50-
```
51-
bin/magento config:set twofactorauth/general/enable 0
52-
```
49+
Visit **Admin > Stores > Settings > Configuration > Security > 2FA** and set *Enable 2FA* to **No**.
50+
51+
CLI: `bin/magento config:set twofactorauth/general/enable 0`
52+
53+
*NOTE: Always keep 2FA enabled within production environments for security purposes.*
54+
55+
### Disable 2FA for API Token Generation
56+
57+
Enables the bypass of 2FA for API token generation. This can be useful for third-party vendors during module development.
58+
59+
Visit **Admin > Stores > Settings > Configuration > Security > 2FA** and set *Enable 2FA for API Token Generation* to **No**.
60+
61+
CLI: `bin/magento config:set twofactorauth/general/enable_for_api_token_generation 0`
62+
63+
*NOTE: Always keep 2FA enabled within production environments for security purposes.*
5364

5465
## License
5566

‎composer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"magento/framework": ">=103"
77
},
88
"type": "magento2-module",
9-
"version": "1.0.0",
9+
"version": "1.1.0",
1010
"license": [
1111
"MIT"
1212
],

‎etc/adminhtml/system.xml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,15 @@
11
<?xml version="1.0"?>
2-
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3-
xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Config:etc/system_file.xsd">
2+
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Config:etc/system_file.xsd">
43
<system>
54
<section id="twofactorauth">
65
<group id="general">
7-
<field id="enable" translate="label" type="select" sortOrder="1" showInDefault="1" canRestore="1">
6+
<field id="enable" translate="label" type="select" sortOrder="100" showInDefault="1" canRestore="1">
87
<label>Enable 2FA</label>
98
<source_model>Magento\Config\Model\Config\Source\Yesno</source_model>
109
<comment>Warning: Enabling 2FA will immediately prompt admin user for OTP code.</comment>
1110
</field>
12-
<field id="enable_api" translate="label" type="select" sortOrder="100" showInDefault="1" canRestore="1">
13-
<label>Enable 2FA for token service</label>
11+
<field id="enable_for_api_token_generation" translate="label" type="select" sortOrder="200" showInDefault="1" canRestore="1">
12+
<label>Enable 2FA for API Token Generation</label>
1413
<source_model>Magento\Config\Model\Config\Source\Yesno</source_model>
1514
</field>
1615
<field id="force_providers">

‎etc/config.xml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,10 @@
11
<?xml version="1.0"?>
2-
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3-
xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd">
2+
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd">
43
<default>
54
<twofactorauth>
65
<general>
76
<enable>1</enable>
8-
<enable_api>1</enable_api>
7+
<enable_for_api_token_generation>1</enable_for_api_token_generation>
98
</general>
109
</twofactorauth>
1110
</default>

‎etc/di.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,6 @@
44
<plugin name="bypassTwoFactorAuth" type="MarkShust\DisableTwoFactorAuth\Plugin\BypassTwoFactorAuth"/>
55
</type>
66
<type name="Magento\TwoFactorAuth\Model\AdminAccessTokenService">
7-
<plugin name="bypassWebApiTwoFactorAuth" type="MarkShust\DisableTwoFactorAuth\Plugin\BypassWebApiTwoFactorAuth"/>
7+
<plugin name="bypassTwoFactorAuthForApiTokenGeneration" type="MarkShust\DisableTwoFactorAuth\Plugin\BypassTwoFactorAuthForApiTokenGeneration"/>
88
</type>
99
</config>

0 commit comments

Comments
 (0)