Two Factor Authentication module

Edition

Incubator (services)

Issues

TWOFAUTH

Git

Git

Latest

1.0

Compatible with Magnolia 6.2.

The Two Factor Authentication module enables two factor authentication (2FA) via Time-Based One-Time Password (TOTP). for Magnolia’s default login form.

A private key is generated and sent to the sent to the user’s email as a QR code. The user scans this code in a suitable password generating app such as Google Authenticator, Microsoft Authenticator, or another 2FA tool.

On log in, users are required to enter the latest code generated by the app using their secret key. Only when the correct code is provided can the user log in.

Prerequisites

  • You must have the Mail module installed and the mail server configured in order to proceed.

Administrators need to generate QR codes for users and verify them before enabling the 2FA feature.

If you have already enabled two-factor authentication:

  1. Disable 2FA by decorating the module config.

  2. Generate the QR code for your user and add to a token generating application.

  3. Re-enable 2FA.

Installing with Maven

Maven is the easiest way to install the module. Add the following to your bundle:

<dependency>
  <groupId>info.magnolia.security</groupId>
  <artifactId>two-factor-authentication</artifactId>
  <version>1.0</version>
</dependency>

Configuration

There are a few configuration areas that this module modifies.

securityCallback

At /server/filters/securityCallback/clientCallbacks/form/ the loginForm property is changed from:

/defaultMagnoliaLoginForm/login.html

to

/defaultMagnoliaLoginForm/2fa-login.html

At the same location, the class property is changed from:

info.magnolia.cms.security.auth.callback.FormClientCallback

to

info.magnolia.security.twofactorauth.auth.callback.TwoFactorAuthenticationFormClientCallback

loginHandlers

At /server/filters/login/loginHandlers/Form the class property is changed from:

info.magnolia.cms.security.auth.login.FormLogin

to

info.magnolia.security.twofactorauth.auth.login.TwoFactorAuthenticationFormLogin

qrCodeEmailTemplate

This module provides a new email template, 2faQrCodeEmailTemplate.

Property Description

subject

required

The subject line of the email that will be sent to users when a code is generated for them.

Module Configuration

Property Description

enable2FA

required

Flag to toggle on and off the requirement for a valid TOTP password at log in.

optIssuer

required

Name for the code issuer that will be displayed in the user’s password generating tool.

Usage

This sections covers how to use the module.

Generate token

  1. In AdminCentral, go to the Security app.

  2. Go to System Users.

  3. Select the desired user.

    1. In the edit panel, click Generate Security Token.

      2fa generate

User interaction

Once the security token is generated, the selected user receives an email prompting them to scan an attached QR code with a one-time key generating tool.

2fa email

Use the token

For the flow to be completed:

  1. The user scans the QR code with their app.

  2. The user receives a time-sensitive code in their app.

  3. The user enters the code in the corresponding field of the Magnolia login screen.

2fa login

Changelog

Version Notes

1.0

Initial release of the module
Feedback

Incubators

×

Location

This widget lets you know where you are on the docs site.

You are currently perusing through the Two Factor Authentication module docs.

Main doc sections

DX Core Headless PaaS Legacy Cloud Incubator modules