We have a client with fairly extensive security requirements. They have asked us if it is feasible to implement something like Authy in Craft.
I'm provisionally planning to disable the "normal" CP login form and implementing a new login flow via a plugin that checks the OTP first and then hands off to
UserSessionService for the actual login. Is there any reason that wouldn't work?
If it will, what's best way to effectively disable the default CP form and direct users to the plugin's form instead?
Lastly, are there any gotchas that I should look out for in terms of maintaining as close to "normal" Craft behaviour as possible.
PS I know there's the
userSession.onBeforeLogin event, but unless I'm missing something, that looks fairly limited (only receives the username of the User as a param etc)