2

We have a client with fairly extensive security requirements. They have asked us if it is feasible to implement something like Authy in Craft.

I'm provisionally planning to disable the "normal" CP login form and implementing a new login flow via a plugin that checks the OTP first and then hands off to UserSessionService for the actual login. Is there any reason that wouldn't work?

If it will, what's best way to effectively disable the default CP form and direct users to the plugin's form instead?

Lastly, are there any gotchas that I should look out for in terms of maintaining as close to "normal" Craft behaviour as possible.

PS I know there's the userSession.onBeforeLogin event, but unless I'm missing something, that looks fairly limited (only receives the username of the User as a param etc)

  • Any reason why you want to check the OTP first? I would think that using Craft's own login form, then using the userSession.onBeforeLogin event to handle the Authy check would be a simpler way to do it. – Steve Rowling Oct 13 '16 at 10:59
  • @SteveRowling Totally open to that approach as much simpler I agree. I just couldn't see how to redirect to / render the UI I need to capture the OTP from the user from within my userSession.onBeforeLogin handler. That could well be an error on my part though... – Tom Davies Oct 13 '16 at 14:01
  • True, it's tricky. Rendering a template and processing the resulting OTP check means generating a new request that I guess will break passing back anything to the original userSession.onBeforeLogin event. How about using the userSession.onLogin event instead? That way you know they have been authenticated by Craft. You can then set a redirect to a second form to check the OTP. If that fails, then you can logout the user by calling craft()->userSession->logout(false); – Steve Rowling Oct 13 '16 at 14:42
  • Actually for get my previous comment. Just realised that a user could just bypass the second form and remain logged in - not what you want! – Steve Rowling Oct 13 '16 at 14:44
  • Ideally for this type of thing we'd have a way for a plugin to inject their own contents into the actual CP login form. A semi-related feature request here: craftcms.uservoice.com/forums/285221-feature-requests/… – Brad Bell Oct 13 '16 at 17:42
2

I know this is a little late, but i've just build a plugin for TOTP. It is in beta, so beware before using it in a production environment. https://github.com/born05/craft-twofactorauthentication

| improve this answer | |
  • Nice, obviously still early days, but this seems like a neat way to work around the current Craft 2 login process. Still hoping that down the line after 3 ships we'll get hook to inject markup into the login form itself, but this is a great start. – Tom Davies May 7 '17 at 20:32
  • @TomDavies i'm hoping for the same. In the meantime there is an issue about this on Github github.com/craftcms/cms/issues/1471 – Roel May 8 '17 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.