<p>I know this is a little late, but i've just build a plugin for TOTP. It is in beta, so beware before using it in a production environment.
<a href="https://github.com/born05/craft-twofactorauthentication" rel="nofollow noreferrer">https://github.com/born05/craft-twofactorauthentication</a></p>

CC BY-SA 3.0
2017-05-07T20:32:28.177Z
Nice, obviously still early days, but this seems like a neat way to work around the current Craft 2 login process. Still hoping that down the line after 3 ships we'll get hook to inject markup into the login form itself, but this is a great start.
Tom Davies
CC BY-SA 3.0
2017-05-08T11:54:50.213Z
@TomDavies i'm hoping for the same. In the meantime there is an issue about this on Github https://github.com/craftcms/cms/issues/1471
Roel
CC BY-SA 3.0
2017-05-05T10:54:30.237Z
2017-05-05T10:54:30.237Z
Roel
<p>We have a client with fairly extensive security requirements. They have asked us if it is feasible to implement something like <a href="https://github.com/authy/authy-php" rel="nofollow">Authy</a> in Craft.</p>

<p>I'm provisionally planning to disable the "normal" CP login form and implementing a new login flow via a plugin that checks the OTP first and then hands off to <code>UserSessionService</code> for the actual login. Is there any reason that wouldn't work?</p>

<p>If it will, what's best way to effectively disable the default CP form and direct users to the plugin's form instead?</p>

<p>Lastly, are there any gotchas that I should look out for in terms of maintaining as close to "normal" Craft behaviour as possible.</p>

<p>PS I know there's the <code>userSession.onBeforeLogin</code> event, but unless I'm missing something, that looks fairly limited (only receives the username of the User as a param etc)</p>

CC BY-SA 3.0
2016-10-13T10:59:50.920Z
Any reason why you want to check the OTP first? I would think that using Craft's own login form, then using the `userSession.onBeforeLogin` event to handle the Authy check would be a simpler way to do it.
Steve Rowling
CC BY-SA 3.0
2016-10-13T14:01:27.860Z
@SteveRowling Totally open to that approach as much simpler I agree. I just couldn't see how to redirect to / render the UI I need to capture the OTP from the user from within my `userSession.onBeforeLogin` handler. That could well be an error on my part though...
Tom Davies
CC BY-SA 3.0
2016-10-13T14:42:56.250Z
True, it's tricky. Rendering a template and processing the resulting OTP check means generating a new request that I guess will break passing back anything to the original `userSession.onBeforeLogin` event. How about using the `userSession.onLogin` event instead? That way you know they have been authenticated by Craft. You can then set a redirect to a second form to check the OTP. If that fails, then you can logout the user by calling `craft()->userSession->logout(false);`
Steve Rowling
CC BY-SA 3.0
2016-10-13T14:44:02.200Z
Actually for get my previous comment. Just realised that a user could just bypass the second form and remain logged in - not what you want!
Steve Rowling
CC BY-SA 3.0
2016-10-13T17:42:23.847Z
Ideally for this type of thing we'd have a way for a plugin to inject their own contents into the actual CP login form. A semi-related feature request here: https://craftcms.uservoice.com/forums/285221-feature-requests/suggestions/9463260-control-panel-admin-login-two-factor-authenticatio
Brad Bell
<plugin-development><authentication>
Implementing two factor authentication / TOTP for CP logins
# Implementing two factor authentication / TOTP for CP logins

(Asked by: username_0 on 2016-10-13)

We have a client with fairly extensive security requirements. They have asked us if it is feasible to implement something like [Authy](https://github.com/authy/authy-php) in Craft.

I'm provisionally planning to disable the "normal" CP login form and implementing a new login flow via a plugin that checks the OTP first and then hands off to `UserSessionService` for the actual login. Is there any reason that wouldn't work?

If it will, what's best way to effectively disable the default CP form and direct users to the plugin's form instead?

Lastly, are there any gotchas that I should look out for in terms of maintaining as close to "normal" Craft behaviour as possible.

PS I know there's the `userSession.onBeforeLogin` event, but unless I'm missing something, that looks fairly limited (only receives the username of the User as a param etc)

**Tags:** plugin-development, authentication

> **Comments:**
> **username_1**: Any reason why you want to check the OTP first? I would think that using Craft's own login form, then using the `userSession.onBeforeLogin` event to handle the Authy check would be a simpler way to do it.  
> **username_0**: @SteveRowling Totally open to that approach as much simpler I agree. I just couldn't see how to redirect to / render the UI I need to capture the OTP from the user from within my `userSession.onBeforeLogin` handler. That could well be an error on my part though...  
> **username_1**: True, it's tricky. Rendering a template and processing the resulting OTP check means generating a new request that I guess will break passing back anything to the original `userSession.onBeforeLogin` event. How about using the `userSession.onLogin` event instead? That way you know they have been authenticated by Craft. You can then set a redirect to a second form to check the OTP. If that fails, then you can logout the user by calling `craft()->userSession->logout(false);`  
> **username_1**: Actually for get my previous comment. Just realised that a user could just bypass the second form and remain logged in - not what you want!  
> **username_2**: Ideally for this type of thing we'd have a way for a plugin to inject their own contents into the actual CP login form. A semi-related feature request here: https://craftcms.uservoice.com/forums/285221-feature-requests/suggestions/9463260-control-panel-admin-login-two-factor-authenticatio  

---

## 1 answers

### Answer by username_3 on 2017-05-05. Score: 2 | Accepted answer

I know this is a little late, but i've just build a plugin for TOTP. It is in beta, so beware before using it in a production environment.
<https://github.com/born05/craft-twofactorauthentication>

> **Comments:**
> **username_0**: Nice, obviously still early days, but this seems like a neat way to work around the current Craft 2 login process. Still hoping that down the line after 3 ships we'll get hook to inject markup into the login form itself, but this is a great start.  
> **username_3**: @TomDavies i'm hoping for the same. In the meantime there is an issue about this on Github https://github.com/craftcms/cms/issues/1471  

---

