Jetpack SSO redirect fails when 2FA is enabled.

[stevenkword]

After logging into via Jetpack's single sign-on button, we are redirected to http://localhost/wp-login.php?action=jetpack-sso&result=success... where we get a wp_die(), "Error, invalid response data."

[kraftbj]

For further background, the SSO is fully completed, then asks for the 2fa auth code (opinion: what is the expectation? Should JP SSO override 2fa? What if you already use 2fa via wp.com?). After submitting the auth code, we are returned to JP's interstitial URL post-wpcom processing, which has already been processed.

My understanding is Jetpack isn't expecting this and so isn't able to populate the $user_data variable from wp.com resulting in the error.

Occurs via https://github.com/Automattic/jetpack/blob/master/modules/sso.php#L547-L566

I haven't traced how this plugin handles the login to have an idea if there's something this plugin can do different, if this is Jetpack's bag, or both.

[kraftbj]

SSO overhauled quite a bit, but still failing. I haven't had time to dig into it with this project being generally on hold.

If you have 2fa enabled on your wp.com account, you can add this as a work-around for now:

add_action( 'jetpack_sso_handle_login', 'bk_handle_2fa', 10, 2 );

function bk_handle_2fa( $user, $user_data ){
    if ( 1 === (int) $user_data->two_step_enabled ){
        remove_action( 'wp_login', array( 'Two_Factor_Core', 'wp_login' ), 10, 2 );
    }
}

It's a cheap workaround—it doesn't take into account if the local user is supposed to be using 2fa or not, but it's something for those of us running this plugin live :)

[alexclst]

I find it a bit odd that Jetpack SSO still asks for the 2FA code. I think there should be a site-wide setting to decide whether the current behavior occurs, or if Jetpack SSO logins always bypass 2FA.

[kasparsd]

Closing since the original issue appears to be fixed. Please leave a comment if the issue is still present and include steps to replicate it.

[bregman90]

Not sure if this is related, but it seemed close! https://wordpress.org/support/topic/two-factor-with-domain-mapping-bug/