hiqdev / yii2-mfa
Multi-factor authentication for Yii2 projects
Installs: 9 600
Dependents: 2
Suggesters: 0
Security: 0
Stars: 10
Watchers: 8
Forks: 5
Open Issues: 2
Type:yii2-extension
Requires
- robthree/twofactorauth: ^1.5.1
Requires (Dev)
- hiqdev/hidev-hiqdev: <2.0 || dev-master
- hiqdev/hidev-php: <2.0 || dev-master
This package is auto-updated.
Last update: 2024-10-12 16:20:42 UTC
README
Multi-factor authentication for Yii2 projects
This package provides:
- TOTP - Time-based One-time Password Algorithm used for two factor authentication
- checking for user allowed IPs
- generation and checking recovery codes (PLANNED)
Uses:
- robthree/twofactorauth for TOTP
- hiqdev/php-confirmator for confirmation tokens
Can be plugged into any exising Yii2 project. See how it is used in hiqdev/hiam.
Installation
The preferred way to install this yii2-extension is through composer.
Either run
php composer.phar require "hiqdev/yii2-mfa"
or add
"hiqdev/yii2-mfa": "*"
to the require section of your composer.json.
Configuration
This extension provides pluggable configuration to be used with composer-config-plugin.
Also you can use it usual way by copy-pasting config. See src/config/web.php for configuration example.
Available configuration parameters:
organization.name
For more details please see src/config/params.php.
Usage
This plugin provides behavior and configuration attaches it
to user component on beforeLogin
event.
And then the behavior validates IPs and TOTP on every login.
To use this plugin you have to instantiate your \Yii->app->user->identity
class from
hiqdev\yii2\mfa\base\MfaIdentityInterface
and implement all of the methods,
which will return or set MFA properties. For example:
use hiqdev\yii2\mfa\base\MfaIdentityInterface;
class Identity implements MfaIdentityInterface
{
...
/**
* @inheritDoc
*/
public function getUsername(): string
{
return $this->username;
}
/**
* @inheritDoc
*/
public function getTotpSecret(): string
{
return $this->totp_secret ?? '';
}
...
IPs and TOTP functions are independent and you can provide just one of properties to have only corresponding functionality.
Usage with OAuth2
Also there is a configuration to provide MFA for OAuth2.
-
Require suggested
"bshaffer/oauth2-server-php": '~1.7'
package -
Use
hiqdev\yii2\mfa\GrantType\UserCredentials
for configuring/oauth/token
command via totp code. For example:'modules' => [ 'oauth2' => [ 'grantTypes' => [ 'user_credentials' => [ 'class' => \hiqdev\yii2\mfa\GrantType\UserCredentials::class, ], ], ], ]
-
Extend you
Identity
class fromApiMfaIdentityInterface
. -
Use actions:
POST /mfa/totp/api-temporary-secret - Proviedes temporary secret to generate QR-code POST /mfa/totp/api-enable - Enables totp POST /mfa/totp/api-disable - Disables totp
Back redirection
For any MFA route, you can add a GET param ?back=https://some.site.com
.
It will redirect the user after a successful operation to the needed site.
To avoid open redirect vulnerability, you need to validate the back
param.
It should be done with \hiqdev\yii2\mfa\validator\BackUrlValidatorInterface
which has a default implementation.
You have to create your own and reinitialize it with the container definition:
config/web.php:
'container' => [ 'singletons' => [ \hiqdev\yii2\mfa\validator\BackUrlValidatorInterface::class => \your\own\validator::class, ], ],
License
This project is released under the terms of the BSD-3-Clause license. Read more here.
Copyright © 2016-2018, HiQDev (http://hiqdev.com/)