The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.For most sites, keys generated by Google Authenticator refresh automatically once per minute. However, the key generated for this module must be manually refreshed each time. Can you explain why this is? I'm assuming the authentication mechanism used by ga_login is somewhat different from other sites, possibly counter-based instead of time-based?
| Comment | File | Size | Author |
|---|---|---|---|
| #5 | ga_login-1906414-5.patch | 529 bytes | danepowell |
Comments
Comment #1
attiks commentedThis module supports time based and it works in the D7 version, but it's been a while that I tried the D6 version. Can you try the D7 version and report the os your using the app on?
Comment #2
danepowell commentedI only run this on one site, and it's D6, so I can't really test the D7 version. I'm using the Google Authenticator Android app.
Briefly looking through the ga_login code, it looks like the ga4php library supports TOTP but defaults to HOTP, and when ga_login creates a new user key, it doesn't specify TOTP or HOTP.
I'm not an expert but I think TOTP should be preferred because it's more secure and less hassle for the user, since he/she doesn't have to manually refresh the code. But maybe the user can at least be given the choice on the key creation form.
Comment #3
attiks commentedYou can try changing line 82 in ga_login.module from
$key = $ga->setUser($username);to$key = $ga->setUser($username, "TOTP");Comment #4
danepowell commentedGreat- I deleted my existing key and applied #3, and a TOTP-based URL was generated. Thanks!
I guess this is really a feature request then to add TOTP support.
Comment #5
danepowell commentedHere's a temporary workaround based on #3.
Comment #6
danepowell commentedIt looks like this was fixed with the following commit:
http://drupalcode.org/project/ga_login.git/commit/dd04ea3