I have a running website (a membership system created using phprunner 9.7 enterprise) and i want to upgrade the project using phprunner 9.8 enterprise. Perhaps the most interesting feature comes with version 9.8 is "Two Factor Authentication (TFA)" and it's working perfectly.
However I am having trouble using TFA in current system, where more than 1000 members have been registered.
Enable "Use two-factor authentication" option on PHPRunner IDE means Forcing all 1000+ registered members to use TFA after successfully login. Problems that may occur are, there are many members who can not login because they didn't fill the phone number correctly, or have changed their the phone number, or lost their smartphone.
Some ideas to resolve this problem:
- There should be a field in user table ("tfa" for example) where logged in members can choose to enable or disable TFA
- When a registered member choose to enable TFA, there should be a process to verify his phone number.
- Incase a member cannot receive SMS or lost his smartphone, there should be a procedure to disable TFA from login page (something like resetting password procedure)
I have tried to intercept the login process to enable or disable TFA based on a field value in user table ("tfa" field) but with no luck <img src='https://asprunner.com/forums/file.php?topicimage=1&fieldname=question&id=24825&image=1&table=forumtopics' class='bbc_emoticon' alt=':)' />
I found that the only way to disable or enable TFA in generated code:
- Edit file classes/loginpage.php in line 43 set $this->twoFactAuth = false;
- Edit file include/appsettings.php in line 453 set $globalSettings["bTwoFactorAuth"] = false;
Is there any solution for this problem?