MFA options for Shield: four plugin packages now available via composer

[cloudrepublic-steve]

Hi all,

Following the discussion on the Shield repo about extending 2FA, along with work that we too have duplicated over various projects to accomplish the same thing, we decided to write and share some Shield action 'plugins' that may also be of help to the wider community. Without touching Shield's core, we've built and released four MFA packages, they work with the existing Actions system so there are no breaking changes.

Packages:

shield-totp-mfa - Authenticator-app MFA (Google Authenticator, Microsoft Authenticator, Authy, 1Password, etc.), with Actions, controllers and a route filter
shield-passkey-mfa - Passkey (WebAuthn/FIDO2) MFA, with self-service add/rename/remove of multiple passkeys. It uses web-auth/webauthn-lib for the cryptography
shield-whatsapp-mfa - A 6-digit one-time code sent over WhatsApp/SMS as a second factor, with self-service phone number verification (requires a Twillio account or Meta Cloud credentials)
shield-mfa-dispatcher - Shield's Config\Auth::$actions['login'] accepts only one class. The dispatcher is now that one class, and it picks the right Action per user at request time, so different users can use different methods. The dispatcher allows for multiple active MFA methods and per-user choice, without a schema change to the users table or any breaking API changes. You can even plugin any of your own developed custom actions/activators into the dispatcher so they too can be used inside it.

The packages are MIT licensed, tested on CodeIgniter 4.6 and 4.7 up to PHP 8.5, and available via Composer/packagist under cloudrepublic

• Detailed write-ups on how to install and set them up are available via our website and the package readmes
• GitHub (all repos): https://github.com/orgs/CloudRepublic-io/repositories

Feedback, issues and PRs are very welcome, especially from anyone with a use case the dispatcher doesn't yet cover.

Cheers!

[michalsn]

Nice, thanks for sharing!