[4.1] Extend 2FA Enforcement option to select usergroups

[zero-24]

Pull Request for Issue #29321 cc @conconnl

Summary of Changes

Extend 2FA Enforcement option to select usergroups

Testing Instructions

• Apply this patch
• enable atleast one 2fa plugin
• go to Users -> Manage -> Options
• Set Enforce Two Factor Authentication to both
• Add an usergroup (Superuser for example)
• save and close the settings
• you are now beeing forced to setup 2fa
• login as an non-superuser
• you are not forced to setup 2fa

Actual result BEFORE applying this Pull Request

You could not force 2fa to a specific usergroup

Expected result AFTER applying this Pull Request

You can now force 2fa to a specific usergroup

Documentation Changes Required

Additional option has to be documented.

Backports

That feature has been backported to 3.9+ here: https://github.com/zero-24/plg_system_force2fausergroup/releases/latest

[zero-24]

Drone fails unrealted to the changes done here. It seems 4.1 composer stuff is broken: https://ci.joomla.org/joomla/joomla-cms/35096/1/8

[brianteeman]

Thinking out aloud here but shouldnt it be a minimum usergroup. IT wouldnt make sense to force 2fa on a manager but not on an administrator

[zero-24]

I get your point but i'm not sure whether we should implement such hierachie reading given that on bigger sites this could get quite complex. And that would lock every site owner to that rule without (for whatever reason) exception.

There might be someone above Administrator in the Hierarchie but they are not allowed to do com_users so they choose to not force 2fa to them but all other groups above Administrator should be forced to setup 2fa.

With the solution provided here both is possible with us writing non complex code and it is transparent to the site admin which group is forced to setup 2fa

[ghost]

I have tested this item ✅ successfully on c9f2ae6

Works as expected.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/30522.}

[conconnl]

I have tested this item ✅ successfully on c9f2ae6

It works as expected.

• Force "both" without groups selected, force it for everybody.
• "Frontend" or "Backend" the same for either side.
• Selecting user groups makes the enforcement only active on those groups.

  ---

  _{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/30522.}

[zero-24]

RTC Thanks!

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/30522.}

[laoneo]

Restartet drone

[zero-24]

Drone seems to be a more general problem with the 4.1 branch: https://ci.joomla.org/joomla/joomla-cms/35141/1/8 unrealted to this PR for sure.

[wilsonge]

I just merged 4.0-dev into 4.1-dev. can you merge in latest 4.1-dev here and see if it fixes the issue please?

[zero-24]

PR has been updated.

[wilsonge]

Thanks!