# Custom authentication conditions

**URL:** <https://meta.discourse.org/t/custom-authentication-conditions/124579>\
**Category:** Feature\
**Created:** [August 1, 2019, 6:04am UTC](https://meta.discourse.org/t/custom-authentication-conditions/124579 "2019-08-01T06:04:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![haroldus](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/haroldus/32/150859_2.png) [@haroldus](https://meta.discourse.org/u/haroldus)\
**Post date:** [August 1, 2019, 6:04am UTC](https://meta.discourse.org/t/custom-authentication-conditions/124579/1 "2019-08-01T06:04:50Z")

</div>

There are a number of ways a user can be logged on and it is difficult to add conditions via a plugin which a user might have to satisfy before being logged on.  
Some examples of conditions a plugin author might wish to add to authentication:

- ensures user’s email domain follows a certain pattern e.g. [university.edu](http://university.edu)
- passes second factor from 2FA provider (there seem to be quite a few)
- ensures user has an active subscription via a payments provider

Current conditions are variously checked (or not checked) depending on context (non-exhaustive list):

- [Session Controller](https://github.com/discourse/discourse/blob/master/app/controllers/session_controller.rb)

- [Users Controller](https://github.com/discourse/discourse/blob/master/app/controllers/users_controller.rb)

- [Invites Controller](https://github.com/discourse/discourse/blob/master/app/controllers/invites_controller.rb)

A way to insert a custom condition is to prepend a custom module modifying each method, which is not a desirable result from the perspective of maintaining compatibility with discourse, and is also quite ugly.

_Suggestion_  
It would be easier to develop around authentication if it were less distributed throughout the code base. All of the conditions (and error messages in response) one might want to check could be defined as separate methods in the one place. A user who wanted to log in would have to pass each enabled condition. You could add your own methods as a plugin author to this class, which the `log_on_user` method would then check. If you wanted to skip a condition in some particular context you could pass a parameter to do so.

---

<div class="post-metadata">

**Author:** ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)\
**Post date:** [August 1, 2019, 1:51pm UTC](https://meta.discourse.org/t/custom-authentication-conditions/124579/2 "2019-08-01T13:51:14Z")

</div>

> [@haroldus](#):
>
> - ensures user’s email domain follows a certain pattern e.g. [university.edu](http://university.edu)

This can be done using the “`email domains whitelist`” site setting.