Answers.Body: <p>I know this is a little late, but i've just build a plugin for TOTP. It is in beta, so beware before using it in a production environment.
  <a href="https://github.com/born05/craft-twofactorauthentication" rel="nofollow noreferrer">https://github.com/born05/craft-twofactorauthentication</a></p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-07T20:32:28.177Z
Answers.Text: Nice, obviously still early days, but this seems like a neat way to work around the current Craft 2 login process. Still hoping that down the line after 3 ships we'll get hook to inject markup into the login form itself, but this is a great start.
Answers.UserDisplayName: Tom Davies
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-08T11:54:50.213Z
Answers.Text: @TomDavies i'm hoping for the same. In the meantime there is an issue about this on Github https://github.com/craftcms/cms/issues/1471
Answers.UserDisplayName: Roel
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-05T10:54:30.237Z
Answers.LastActivityDate: 2017-05-05T10:54:30.237Z
Answers.UserDisplayName: Roel
Body: <p>We have a client with fairly extensive security requirements. They have asked us if it is feasible to implement something like <a href="https://github.com/authy/authy-php" rel="nofollow">Authy</a> in Craft.</p>
  
  <p>I'm provisionally planning to disable the "normal" CP login form and implementing a new login flow via a plugin that checks the OTP first and then hands off to <code>UserSessionService</code> for the actual login. Is there any reason that wouldn't work?</p>
  
  <p>If it will, what's best way to effectively disable the default CP form and direct users to the plugin's form instead?</p>
  
  <p>Lastly, are there any gotchas that I should look out for in terms of maintaining as close to "normal" Craft behaviour as possible.</p>
  
  <p>PS I know there's the <code>userSession.onBeforeLogin</code> event, but unless I'm missing something, that looks fairly limited (only receives the username of the User as a param etc)</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-10-13T10:59:50.920Z
Comments.Text: Any reason why you want to check the OTP first? I would think that using Craft's own login form, then using the `userSession.onBeforeLogin` event to handle the Authy check would be a simpler way to do it.
Comments.UserDisplayName: Steve Rowling
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-10-13T14:01:27.860Z
Comments.Text: @SteveRowling Totally open to that approach as much simpler I agree. I just couldn't see how to redirect to / render the UI I need to capture the OTP from the user from within my `userSession.onBeforeLogin` handler. That could well be an error on my part though...
Comments.UserDisplayName: Tom Davies
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-10-13T14:42:56.250Z
Comments.Text: True, it's tricky. Rendering a template and processing the resulting OTP check means generating a new request that I guess will break passing back anything to the original `userSession.onBeforeLogin` event. How about using the `userSession.onLogin` event instead? That way you know they have been authenticated by Craft. You can then set a redirect to a second form to check the OTP. If that fails, then you can logout the user by calling `craft()->userSession->logout(false);`
Comments.UserDisplayName: Steve Rowling
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-10-13T14:44:02.200Z
Comments.Text: Actually for get my previous comment. Just realised that a user could just bypass the second form and remain logged in - not what you want!
Comments.UserDisplayName: Steve Rowling
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-10-13T17:42:23.847Z
Comments.Text: Ideally for this type of thing we'd have a way for a plugin to inject their own contents into the actual CP login form. A semi-related feature request here: https://craftcms.uservoice.com/forums/285221-feature-requests/suggestions/9463260-control-panel-admin-login-two-factor-authenticatio
Comments.UserDisplayName: Brad Bell
Tags: <plugin-development><authentication>
Title: Implementing two factor authentication / TOTP for CP logins
ThreadText: # Implementing two factor authentication / TOTP for CP logins
  
  (Asked by: username_0 on 2016-10-13)
  
  We have a client with fairly extensive security requirements. They have asked us if it is feasible to implement something like [Authy](https://github.com/authy/authy-php) in Craft.
  
  I'm provisionally planning to disable the "normal" CP login form and implementing a new login flow via a plugin that checks the OTP first and then hands off to `UserSessionService` for the actual login. Is there any reason that wouldn't work?
  
  If it will, what's best way to effectively disable the default CP form and direct users to the plugin's form instead?
  
  Lastly, are there any gotchas that I should look out for in terms of maintaining as close to "normal" Craft behaviour as possible.
  
  PS I know there's the `userSession.onBeforeLogin` event, but unless I'm missing something, that looks fairly limited (only receives the username of the User as a param etc)
  
  **Tags:** plugin-development, authentication
  
  > **Comments:**
  > **username_1**: Any reason why you want to check the OTP first? I would think that using Craft's own login form, then using the `userSession.onBeforeLogin` event to handle the Authy check would be a simpler way to do it.  
  > **username_0**: @username_1 Totally open to that approach as much simpler I agree. I just couldn't see how to redirect to / render the UI I need to capture the OTP from the user from within my `userSession.onBeforeLogin` handler. That could well be an error on my part though...  
  > **username_1**: True, it's tricky. Rendering a template and processing the resulting OTP check means generating a new request that I guess will break passing back anything to the original `userSession.onBeforeLogin` event. How about using the `userSession.onLogin` event instead? That way you know they have been authenticated by Craft. You can then set a redirect to a second form to check the OTP. If that fails, then you can logout the user by calling `craft()->userSession->logout(false);`  
  > **username_1**: Actually for get my previous comment. Just realised that a user could just bypass the second form and remain logged in - not what you want!  
  > **username_2**: Ideally for this type of thing we'd have a way for a plugin to inject their own contents into the actual CP login form. A semi-related feature request here: https://craftcms.uservoice.com/forums/285221-feature-requests/suggestions/9463260-control-panel-admin-login-two-factor-authenticatio  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_3 on 2017-05-05. Score: 2 | Accepted answer
  
  I know this is a little late, but i've just build a plugin for TOTP. It is in beta, so beware before using it in a production environment.
  <https://github.com/born05/craft-twofactorauthentication>
  
  > **Comments:**
  > **username_0**: Nice, obviously still early days, but this seems like a neat way to work around the current Craft 2 login process. Still hoping that down the line after 3 ships we'll get hook to inject markup into the login form itself, but this is a great start.  
  > **username_3**: @username_0 i'm hoping for the same. In the meantime there is an issue about this on Github https://github.com/craftcms/cms/issues/1471  
  
  ---
  
  