search

valohai / django-allauth-2fa

Two-factor authentication for Django Allauth
Other
212 stars 51 forks source link

"staff_member_required"-solution in documentation (section installation at the end) leads to error for non_staff members #102

Open Danane84 opened 3 years ago

Danane84 commented 3 years ago

In the installation section of the documentation at the very end of the page, the following method is proposed to use the allauth authentication workflow (including two-factor authentication) for access the Django admin site: 

admin.site.log = staff_member_required(admin.site.login, login_url = 'accounts/login')
admin.autodiscover()

However, if a registered user, who is not a staff member logs in, the result is an ERR_TOO_MANY_REDIRECTS error. I tried to come up with a solution by looking at the staff_member_required decorator in the django documentation but was not successful. I know it is not a django-allauth-2fa specific question, but since the above code snippet is from the documentation, I thought I give it a try.

clokep commented 3 years ago

I can't say I've run into this sorry!

falc410 commented 3 years ago

I have run into the same problem. When a non staffmember tries to access the admin page, he will get this error instead of a forbbiden. This really is quite a problem, since we definitely need to secure the admin page with 2FA and without this code, 2FA is completely bypassed, but with it, normal users just get a browser error.

Danane84 did you come up with a solution by now? Also, when logging in, I am always redirected to the default redirect_login_url from allauth, the next value is ignored (see #105 )