Two Factor Authentication

SocialStack has a pluggable user authentication mechanism so each authentication provider is modular and can work together. This is particularly useful for two factor authentication where a user and password combination is used, followed by entering a generated value from a physical device. This is just an example combination of course, and this article covers how you might implement it.

Google authenticator

To quickly get started with Google Authenticator based 2FA, install the following modules:

socialstack install UI/TwoFactorGoogleSetup Api/TwoFactorGoogleAuth UI/QrCode

The first provides the UI's which display to the user when they require either setting up or inputting a 2FA pin. The second is the backend module which provides the authentication module itself in to the SocialStack authentication pipeline.

This small module is typically compatible with any other authentication mechanism such as the default password based mechanism.

Note that you do not need to change anything in the actual login UI if you are using the default login component or a variant of it. This is because it is designed to handle any generic secondary authentication system and the server instructs it to specifically display the UI/TwoFactorGoogleSetup component when the 2FA requirement is triggered.

When installed, it has two configuration options which are set via the SocialStack administration panel configuration area. Install the modules and restart to see the new configuration appear. By default it will require 2FA on all administration accounts. Optionally you can set it to also require 2FA on all user accounts including non-administrators.