two-factor authentication

Scriptcase 9 Discussion
#1

Hi, has anyone implemented two-factor authentication in scriptcase? I’m already using the LDAP security module. I’d like to add another layer of security, in my case, using a service such as google authenticator or https://duo.com

Thank you

#2

Yes, I have created an option of sending an email with an additional code, and connected a login to a service provider that sends sms text. In general it’s not that difficult as you can integrate api’s pretty easy…

#3

yes, I think I overthink the whole thing at first. I managed to get it done by adding a blank application and utilizing external libraries. :cool:

#4

Hi bwalugo, any chance of sharing, am curious to know what you set as an alternative :slight_smile:

#5

sure, I’m using duo (https://duo.com/docs/duoweb)

here’s a pseudocode explanation of the setup:

I set up a simple control application, basically to duplicate a login form. In events - onValidateSuccess, you put a code sc_redir to a blank application.
I also set up external libraries (tools >> external libraries), I put the duo library here.

here’s how I set up the blank application, in onExecute:

define all the duo keys
define duo host
sc_include_library() - this is to pull in the duo library I set up in external libraries
check if $_POST duo response is set
if set, verify the response,
if success, continue to protected content.
if fail, do nothing or you can redirect back to login page
if not set, display duo iframe

I hope that helps, shoot me a message if you need more details.

#6

Hello bwalujo,
Can you explain and show me some code to implement duo on scriptcase?

thank you

#7

Hello,

I have a problem, when run the blank aplication with duo code works fine but if I run from app_login appears a invalid data error.

Can you help me?

#8

Hi there, basically I created a blank application with all the duo post code, I also used sc_include_library() for the duo website (I think this was the code, https://github.com/duosecurity/duo_php)

A snippet of the code in my duo blank application:


if (isset($_POST['sig_response'])) {
    $resp = Duo\Web::verifyResponse(IKEY, SKEY, AKEY, $_POST['sig_response']);
    if ($resp === [user]) {
        sc_redir('menu');
    }
}

I redirect to this duo blank application from onValidateSuccess event in app_login.php

#9

Finally it worked by activating the direct call by url in the blank application.
Thanks

#10

Did you guys manage to authenticate users via automatic push notification to smartphones?
I.e. prompt users to approve or deny the login request with a simple tap or fingerprint on the smartphone.
I have a working implementation of a two-factor authentication using TOTP (not with DUO) that must be manually read on the smartphone and inserted on my application login page, but I’d really like to use push notifications