Using MFA with Wagtail

[jhonatan-lopes]

Hi,

I'm trying to integrate MFA with Wagtail. Right now, I have a login page for regular users that goes through django-allauth and has MFA enabled, and that is working well. However, I also have another login page for editors on my admin page, which uses Wagtail's own login view based on Django's login view, which means that it bypasses the MFA. People that have MFA enabled can login without putting their code in on the Wagtail page because it is using the regular login.

My goal right now is that:

• Users that have the "wagtailadmin.access_admin" permission can access the admin page
• Users that have MFA get asked to input their MFA code when logging in through the admin interface
• Users that can access the admin page but do not have MFA, can do so by only putting their email/password combo
• Users that cannot access the admin page, are redirected back to the login page after a successful login with an error message ("You do not have permissions to access the admin") -> this is the default Wagtail behaviour

I've tried replacing Wagtail's Login view with an allauth based login view:

from django.http import HttpResponseRedirect
from django.urls import reverse
from django.utils.translation import gettext as _

from wagtail.admin import messages

from allauth.account.views import LoginView
from allauth.core.exceptions import ImmediateHttpResponse
from allauth.mfa.views import AuthenticateView


class WagtailLoginView(LoginView):
    template_name = "wagtail_customisation/login.html"
    redirect_authenticated_user = False

    def get_success_url(self):
        return reverse("wagtailadmin_home")

    def dispatch(self, request, *args, **kwargs):
        if request.user.is_authenticated and request.user.has_perm(
            "wagtailadmin.access_admin"
        ):
            redirect_to = self.get_success_url()
            return HttpResponseRedirect(redirect_to)
        if (
            request.user.is_authenticated
            and not request.user.has_perm("wagtailadmin.access_admin")
            and not request.path == reverse("wagtailadmin_login")
        ):
            messages.error(request, _("You do not have permission to access the admin"))
            self.redirect_authenticated_user = True
            return HttpResponseRedirect(reverse("wagtailadmin_login"))
        return super().dispatch(request)

    def form_valid(self, form):
        redirect_url = self.get_success_url()
        try:
            response = form.login(self.request, redirect_url=redirect_url)
            if response.url == reverse("mfa_authenticate"):
                # Replace it with our own authenticate view
                response = HttpResponseRedirect(reverse("wagtail_mfa_authenticate"))
            return response
        except ImmediateHttpResponse as e:
            return e.response


class WagtailAuthenticateView(AuthenticateView):
    template_name = "wagtail_customisation/mfa_authenticate.html"

# urls.py
from django.urls import path

from . import views


urlpatterns = [
    path("login/", views.WagtailLoginView.as_view(), name="wagtailadmin_login"),
    path(
        "2fa/authenticate/",
        views.WagtailAuthenticateView.as_view(),
        name="wagtail_mfa_authenticate",
    ),
]

I'm not sure if this is the best approach, but it works well with users that have MFA enabled. However, for users that do not have MFA and can't access the admin page, it gets stuck on a redirection loop to the wagtailadmin_login view.

I would appreciate any help in getting this working 🙏

[pennersr]

Instead of creating a new view deriving from LoginView, I think it would be more robust to create a simple redirect view at the path of where the Wagtail login view normally resides that:

• redirects authenticated admin users to the admin home.
• raises a PermissionDenied for authenticated users that are not admins.
• redirects to the standard allauth login view otherwise, passing along the next URL (/accounts/login?next=/this/view)
  Then, you don't need to do things like if response.url == reverse("mfa_authenticate"): -- which looks a little brittle to me.