One time password for login

[Mates-K1]

Hi,
is possible to implement one-time-password as another security layer for logging in please?

[sbillard]

I am not clear as to what you are asking. Are you looking for a two-step verification such as Google might use?

[Mates-K1]

For example I use Nextcloud or Wordpress with OTP and when I log in I write user name and password, afther that system ask for six numbers. These numbers are generated offline in my mobile phone and changed every about 30 seconds. Odesláno z telefonu s Windows 10 Od: Stephen Odesláno:středa 4. července 2018 18:08 Komu: ZenPhoto20/ZenPhoto20 Kopie: MartinKroul; Author Předmět: Re: [ZenPhoto20/ZenPhoto20] One time password for login (#804) I am not clear as to what you are asking. Are you looking for a two-step verification such as Google might use? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or mute the thread.

[sbillard]

Yes, this is similar to Google 2 step verification. There seems to be PHP support for that, so I think it will be possible. I will investigate. But there is also the possibility to use Google to log onto the site (if you enable Google Logon.) Then all this authentication would be handled by Google so long as the user has enabled that google feature. Of course this would be a different user id than an existing user.

[sbillard]

Ok, I think I have a working implementation. https://github.com/sbillard/ZenPhoto20-DEV

New plugin: googleTFA implements 2 factor authentication using the Google Authenticator phone app.

Adds new database fields and a new item on the user profile for enabling/disabling 2 factor authentication and showing the user's QR code for Google Authenticator.

Caution when testing--use a secondary user, if it fails you won't be able to log in unless you remove the plugin.

Let me know how it goes.

[Mates-K1]

Sorry, I had short holiday.

There is some bug in autorization.

1. I allow google TFA plugin as administrator.

2. I try login as another user in another browser and I get:
   

3. As admin I choose another user to allow TFA for him.

4. I cant allow it, it is disabled:
   

5. If I set "viewers" group to this user, I still cant allow TFA.
   

6. But if I set him groups "uživatelé" and "viewers" together, I can allow TFA.
   

[Mates-K1]

7. Ok, afther that I can scan my QR code (for me issuer is empty, in plugin setting is set).
8. When I try to login (set name and password), I get blank page with adress

zp-core/zp-extensions/googleTFA/auth_code.php

[Mates-K1]

Thanks, it solved groups issue.
But I still cant login if user have or had TFA enable. I get exception from nr. 2.

[sbillard]

The error can only happen if the login was not successful, e.g. the user or password was not valid. (Still itis a bug that you got the error.)

There was a bug (now fixed) where if the user was not able to alter some of his settings the checkbox for TFA was included so it could not be set. I think that is the problem with your "uživatelé" group.

Did you first run setup after enabling the plugin? That should have set your issuer to your site, e.g. skautskagalerie.cz. You can, of course, change that to the your site "name". Also if you did not run setup, the needed database columns in the administrator table would not be there. This might also be the reason for the blank page.

[sbillard]

I did find a but when logging with a theme form.

current set of fixes are at https://github.com/sbillard/ZenPhoto20-DEV/releases/tag/ZenPhoto20-1.7.0.0

[Mates-K1]

It works! Many thanks for implement this! 🥇

[sbillard]

closed by version 1.7.1