Urgent: 2FA Implementation Issue on iThemes Security Plugin

  • Resolved helpye

    (@helpye)


    2 years, 7 months ago

    Just a heads-up to everyone managing a website: I’ve enabled 2FA on our iThemes Security plugin and unfortunately, it’s broken the admin login. I’m stuck at the login screen and can’t proceed further. Clicking on pass won’t do anything, and continue is grayed out.

    Status:

    • FTP Access: Yes
    • Admin Login: Broken

    I’m working to restore settings from a backup but if anyone has experienced this and has a solution, please share.

    • This topic was modified 2 years, 7 months ago by helpye.
Viewing 10 replies - 1 through 10 (of 10 total)
  • nlpro

    (@nlpro)

    2 years, 7 months ago

    Hi @helpye,

    What version of the plugin are you using?

    Thread Starter helpye

    (@helpye)

    2 years, 7 months ago

    Version 9.0.0

    We experienced difficulties with the Two-Factor Authentication (2FA) first time configuration during the login process. Due to this, we’ve disabled 2FA in the wp.config.php with the following line:

    define( 'ITSEC_DISABLE_TWO_FACTOR', true ); // Disable 2FA

    We also noticed that the for 2FA at login with application option is broken (service unavailable at this moment). We had to use recovery code to login.

    Given these issues, the 2FA feature does not appear to be production-ready.

    • This reply was modified 2 years, 7 months ago by helpye.
    • This reply was modified 2 years, 7 months ago by helpye.
    Thread Starter helpye

    (@helpye)

    2 years, 7 months ago

    Error similar to this:
    The mobile application-based two-factor authentication is temporarily unavailable. Please try another method or contact the site administrator.

    Thread Starter helpye

    (@helpye)

    2 years, 7 months ago

    And when we click on the link, “Learn how to disable 2FA”: 403 Forbidden (solidwp.com)

    403

    • This reply was modified 2 years, 7 months ago by helpye.
    • This reply was modified 2 years, 7 months ago by helpye.
    nlpro

    (@nlpro)

    2 years, 7 months ago

    Hi @helpye,

    The error msg points towards a problem with the user’s secret key. You may need to generate a new secret key in the user profile.

    The “Learn how to disable 2FA” link URL seems to suffer from a typo.

    The current URL is:

    https://go.solidwp.com/help-center-diable-features

    and it should be:

    https://go.solidwp.com/help-center-disable-features

    A bug which needs to be fixed by SolidWP.

    +++ To prevent any confusion, I’m not SolidWP +++

    Thread Starter helpye

    (@helpye)

    2 years, 7 months ago

    Thank you, it work.

    nlpro

    (@nlpro)

    2 years, 7 months ago

    Hi @helpye,

    I believe your question has been answered/issue has been resolved so per the Forum Guidelines, please mark this topic as “Resolved”.

    • This reply was modified 2 years, 7 months ago by nlpro.
    Thread Starter helpye

    (@helpye)

    2 years, 7 months ago

    Done thanks

    nlpro

    (@nlpro)

    2 years, 7 months ago

    @shanedelierrr

    Would be nice if the next release would also include a fix for the typo in the “Learn how to disable 2FA” link. Exact details are outlined in my second post to this topic.

    Just to be sure I checked line #516 of the v9.0.1 core/modules/two-factor/providers/class.two-factor-totp.php file. I can confirm the typo is still there.

    • This reply was modified 2 years, 7 months ago by nlpro.
    Plugin Support chandelierrr

    (@shanedelierrr)

    2 years, 7 months ago

    Hi @helpye, and @nlpro, I appreciate the heads-up! I reported this typo yesterday, and our development team is already aware. I’ll try to bump this to be included in the next release.

    Thank you.

Viewing 10 replies - 1 through 10 (of 10 total)

The topic ‘Urgent: 2FA Implementation Issue on iThemes Security Plugin’ is closed to new replies.