9.7 Google Authenticator

Scriptcase 9
#1

Is there a video or better docs on how the google authenticator is supposed to work.

I already stumbled on a bug:
When you redo your security in 9.7, it is creating a menu entry in the administrator’s main menu that has 2 items related to the MFA. The links go to (with language codes in brackets):
sec_add_2fa {lang_2fa}
sec_control_force_2fa {lang_force_2fa}

There is no sec_control_force_2fa it seems to be called sec_control_2fa

I can’t seem to get the authentication item (when clicked) to work. I have tried email using smtp (which works from my own code so I know it works OK). There needs to be a way to test the smtp some place when you set it up.

I also tried google auth - still not working.

#2

I didn’t realize that the api settings are now in the production environment, so I just had to login to the back end again and put those for smtp in. MFA using email now works. I have not gone back to check the google authenticator yet.

Please add more explainations and details in the SC documentation. This is a bit confusing.

The sec_control_force_2fa being added automatically to the main menu app is a BUG. There is no app called that, nor does that even make sense there. The sec_control_2fa is generated and that is called from sec_Login app when someone starts logging in with passwd but need MFA code sent to them.

The other app sec_add_2fa is in the main menu and should be there. Note that app should have security enabled IMHO and set for each group that you want to have control over mfa, since the user has to initiate or reset it from the main menu. sec_control_2fa should not be under security, as it needs to be used before logging in.

The other BUG I see is that there are php functions that scriptcase uses that send the mfa using email. But when the popup says Sent OK or whatever, that message is CRAP! It is not checking on any error condition. It should. It could do so like this:
$result = sc_send_mail_api(array(
‘profile’ => ‘hive2starsmtp’, //‘grp__NM__hive2starsmtp’,
‘message’ => [
‘html’ => sprintf({lang_sec_2fa_mail_msg},$_code_tmp),
‘text’ => ‘’,
‘to’ => [usr_email],
‘subject’ => sprintf({lang_sec_2fa_mail_subject},$_code_tmp)
]
));

Then you could use the $result which is true if sent and false if not sent, to correctly display a meaningful message for us.

Hope this might help someone struggling as I have with mfa.

1 Like