I have installed TFA and TFA Basic Plugins, and this is basically working. But... fallback options are not working. When a user cannot access the code to authenticate there is no option to access the fallback - whether that fallback is recovery codes or email. At the site wide level I have set both fallback options, but nothing is available for a user to access these when they can't access their authentication device. From a chat with AI, it seems that the problem is these fallback options need to be set 'per user' but I don't see how to do that. Can anyone help?
Backdrop LIVE
October 22nd-24th, 2026
An interactive online event for anyone interested in Backdrop CMS. Everyone is welcome.
Weekly office hours
Bring your questions to our weekly virtual office hours, every Wednesday. Everyone is welcome.
Recent topics
Posted 4 days 2 hours ago by (clarkac) in How-To and Troubleshooting
Posted 5 days 10 hours ago by (indigoxela) in Weekly Meetings
Posted 2 weeks 9 hours ago by Martin Price | System Horizons Ltd (yorkshirepudding) in Meet-Ups and Events
Posted 2 weeks 5 days ago by (ian) in How-To and Troubleshooting
Posted 2 weeks 6 days ago by (clarkac) in How-To and Troubleshooting
Recent comments
Thanks, the /tmp folder was the problem. I moved it elsewhere and then the updated worked. Thanks again!
Update 1.35.1 appears to install but hasn't
Probably not the reason, but worth to do a quick check: Sometimes the update cache interferes, so if something's odd with updates - some module (or core) claims to have updated, but then...
Update 1.35.1 appears to install but hasn't
Nope, not touched any permissions!
Update 1.35.1 appears to install but hasn't
Did it on my end on some sites without problem. I don't know why this update would be different for you. Perhaps some file permission changes?
Update 1.35.1 appears to install but hasn't
The issue with checking for updates in the BackdropCMS dashboard makes website development and maintenance more difficult. I manage more than ten websites hosted by two different providers, one...
Comments
I'll test this tomorrow to see if I can replicate the problem and report back.
It's not "per user" so it should be working.
Thanks for the response, Herb!
Since I posted that I did some more testing and have posted this issue https://github.com/backdrop-contrib/tfa_basic/issues/33
In fact, if both email and recovery codes fallbacks are checked, a user who can't access their account can use fallbacks. If you unset email fallback, they can't get to any fallback. That's the problem. The client doesn't want email as a fall back since it defeats the security of TOTP.