Summary

Currently the LDAP Authentication plugin does not enforce two-factor authentication, this fixes that.

Notes

This is just a copy-paste of the logic from the Joomla! Authentication plugin. Although it is beyond the scope of this pull request, it might be beneficial to add a method to a core authentication library/helper as this code would be usable for any future core shipped authentication plugin or one developed by the community.

In the Joomla! Authentication plugin, the block for getting the database object (lines 166-174 of the file changed in this PR) happens near the top before any authentication checking happens. That is because the authentication checking for the Joomla! Authentication plugin requires information from that object. However, the LDAP Authentication plugin only requires this object if two-factor authentication is enabled for this user. Therefore this query shouldn't happen every time this plugin is triggered, instead only when the user has two-factor authentication enabled. Thus it has been moved after the two-factor method conditional.

Testing

1. Configure LDAP Authentication Plugin
2. Ensure LDAP Authentication is functioning properly
3. Enable a two-factor authentication plugin
4. Add two-factor authentication to this user
   • Take note of a one time emergency password (used later in testing)
5. Attempt login without supplying secret
   • Should fail, with notice that secret key is invalid
6. Attempt login with appropriate secret key
   • Should Succeed
7. Attempt login with one time password copied in step 3
   • Should succeed