3

Is there a 2-factor authentication plugin for Craft? Or is there a way to secure the login for Craft CMS beyond the common installation instructions? I want to build a system that someone on a dynamic IP could access, so static IP's are a bit harder.

I was also thinking if there was a way to add another field to the login page, which was a decryption key, then use one the twig decryption method. If you don't have it, you'd see the data, but it would be all garbled up.

4

Is there a 2-factor authentication plugin for Craft?

I've heard of one in private testing, but I'm not aware if they plan to release it publicly or not.

Until the official Craft plugin store becomes a thing, the most comprehensive list of Craft plugins available I know of is over on the awesome Straight Up Craft.

I want to build a system that someone on a dynamic IP could access, so static IP's are a bit harder.

O.K. What's the reasoning there, if you don't mind me asking?

I was also thinking if there was a way to add another field to the login page, which was a decryption key, then use one the twig decryption method. If you don't have it, you'd see the data, but it would be all garbled up.

Not currently, but we've discussed giving plugins the ability to control the HTML of the login page. Probably worth making an official feature request for that.

It is worth mentioning that there is an onBeforeLogin event a plugin can already listen to and apply their own custom password business logic (i.e. must be 200 characters long, have 40 emojis, 20 Egyptian hieroglyphs, be purple and only work on Tuesday).

3
  • We'd like to make a project management system that's specific to our particular work flow. We've tried various products on the market, the closest one to our needs being TeamWork, but it still doesn't have some of the things we need in a PMS. We have an employee working out of salt lake who would need to log in to the system who logs in over static IP's. We may end up just setting up a local server, and find a solution which would add IP's to the server whitelist.
    – Dustin C
    Jan 15 '16 at 22:12
  • An IP whitelist is definitely the way to go. There is no inherent way to for PHP to determine if a request's IP address was statically assigned or dynamically assigned to the client.
    – Brad Bell
    Jan 16 '16 at 5:55
  • 1
    For reference here is a plugin (currently in beta) for 2-facor authentication. github.com/born05/craft-twofactorauthentication
    – zizther
    May 17 '17 at 14:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.