mickepalm

Okay, I find this …

In the file duo_wordpress.php I think I found the problem. You have an wp_logout() and the code will not running after that.

function duo_start_second_factor($user, $redirect_to=NULL){
if (!$redirect_to){
// Some custom themes do not provide the redirect_to value
// Admin page is a good default
$redirect_to = isset( $_POST[‘redirect_to’] ) ? $_POST[‘redirect_to’] : admin_url();
}

wp_logout();

duo_sign_request($user, $redirect_to);
exit();
}

The problem here is that the dunction duo_sign_request() will never happened here.

I commented this line and replace it with these lines

function duo_start_second_factor($user, $redirect_to=NULL){
if (!$redirect_to){
// Some custom themes do not provide the redirect_to value
// Admin page is a good default
$redirect_to = isset( $_POST[‘redirect_to’] ) ? $_POST[‘redirect_to’] : admin_url();
}

//wp_logout();

wp_destroy_current_session();
wp_clear_auth_cookie();
wp_set_current_user( 0 );

duo_sign_request($user, $redirect_to);
exit();
}

Do you think any developer can check this asap?

/Thanks

I agree there!

They doesn’t have any updated version here but I will see if I can work around it instead.
I tried to remove the filter with any luck so I try this variant instead and it seems to work perfect.

add_filter( ‘rest_authentication_errors’, ‘__return_true’ );

Thanks for the answers …

Hi Kevin,

Yes, I have already test all of this and none is working.

I think you have right with the plugin does not pass its authentication but when I debug I hit v_forcelogin_rest_access filter and if I comment out the WP_Error line all works.

The result is null and is_user_logged_in is false coz I need the tokens ID and in this moment I hasn’t login.

/Regards, Micke

The problem come from this bug. Check it out!
https://core.trac.www.ads-software.com/ticket/41925