I propose a module that provides some hooks that can be implemented by specific authentication mechanisms (e.g. TAN, OTP). Users with the appropriate permissions could add 'additional authentication mechanisms' to certain nodes (e.g. for editing or viewing), to certain forms (e.g. voting on certain (or all) polls), changing profile-fields, submitting new date, etc), or add some kind of 'anonymous user authentication' (e.g. allowing anonymous users to submit new content - but only when providing some kind of pre-generated OTP), or whatever else. "Node based" settings could be expanded to "Content-Type settings" (e.g. need TAN when editing any node of type xyz, provide "Needs TAN for viewing/editing" on all edit-forms for nodes of type xyz, etc)
The "specific modules" would have to take care of validating the provided data (e.g. an iTAN-module would have to take care of generating, revoking and validating TANs) - but the integration with Drupal (e.g. altering submission forms, providing settings, etc) would be done by this module. Authentification modules could include (i)TAN, OTP, some kinds of hardware-based authentication (see Swekey, but for certain actions, instead of login), etc
A more detailed example:
For one project I need the following:
- Provide anonymous users with the possibility to add some content - after receiving a "One Time Password" from an administrator and entering this OTP on the node-submission.
- Restrict certain polls to a certain user-group and add (i)TAN-based authentication to them
- Add (i)TAN-based authentication to profile-modifications
- Be able to (easily) migrate to OTP in the future
This module would provide everything needed to select WHAT to protect (e.g. certain nodes, forms or content-types) and provides an API to integrate (different) authentication mechanisms (now: iTAN, later: OTP) without changing any other setting.
Opinions?
I didn't find anything that could do something like this - but if I missed something, please tell me :)