E-mail Two-Step Authentication Contrib Package

Page contents

• Introduction
• Detailed Documentation
• Security Considerations
• Installation Instructions
• Contrib Info

Introduction

A single step log-in may not be sufficient in a high security environment. Two-step verification makes it harder for an intruder to impersonate a user.

This extension adds two-step authentication to TWiki. The first step is the usual log-in with name and password. After that, a second authentication screen is shown prompting the user for an access code. The access code is sent by e-mail to the registered user who just logged in. This access code can be used only once. A white-list can be set so that users can log in with a single step at trusted locations, such as at known office locations.

Detailed Documentation

   Diagram of two-step log-in process:

• TWiki's Login Manager shows the usual log-in screen
• The user logs in with user name and password
• The Login Manager verifies the password - this can be against TWiki's internal password manager or an external one, such as the LDAP password manager
• If the password is OK, the EmailTwoStepAuthContrib checks if the IP address of the user is white-listed
• If white-listed, the EmailTwoStepAuthContrib tells the Login Manager to log in the user
• Else, the EmailTwoStepAuthContrib generates a one-time-use access code, sends that to the registered user via e-mail, and shows an access code log-in screen
• The Login Manager receives the access code and forwards it to the EmailTwoStepAuthContrib
• The EmailTwoStepAuthContrib verifies the access code against the generated one
• If OK, the EmailTwoStepAuthContrib tells the Login Manager to log in the user

Notes:

• White-listed IP addresses are typically used for offices so that employees can log in with a single step at work. The second step is implicit with trusted locations.
• The one-time-use access code has a certain life-span, the default is 10 minutes.

Security Considerations

This extension is primarily intended for access restricted TWiki sites that are installed in a public cloud, such as Amazon AWS. We recommend to install an SSL certificate and to enforce the https protocol.

IP address spoofing cannot be done because establishing an SSL connection requires a handshake. The response to a request is sent to the indicated IP address, and if spoofed, it ends up at the actual address, not the intruder's. Thus a handshake fails because the would-be intruder does not receive the response.

Installation Instructions

You do not need to install anything on the browser to use this contrib package. These instructions are for the administrator who installs the package on the server where TWiki is running.

Show details Hide details

Contrib Info

• One line description, is shown in the TextFormattingRules topic:
  • Set SHORTDESCRIPTION = Two-step authentication using e-mail for the second step

Author:	TWiki:Main.PeterThoeny
Copyright:	© 2014 Wave Systems Corp. © 2014 TWiki:Main.PeterThoeny © 2014 TWiki:TWiki.TWikiContributor
License:	GPL ( GNU General Public License)
Sponsor:	Wave Systems Corp.
Version:	2014-08-25
Change History:
2014-08-25:	TWikibug:Item7539: Initial version
TWiki Dependency:	$TWiki::Plugins::VERSION 6.1
CPAN Dependencies:	none
Other Dependencies:	none
Perl Version:	5.005
Plugin Benchmark:	GoodStyle nn%, FormattedSearch nn%, EmailTwoStepAuthContrib nn%
Home:	http://TWiki.org/cgi-bin/view/Plugins/EmailTwoStepAuthContrib
Feedback:	http://TWiki.org/cgi-bin/view/Plugins/EmailTwoStepAuthContribDev
Appraisal:	http://TWiki.org/cgi-bin/view/Plugins/EmailTwoStepAuthContribAppraisal

Related Topics: TWikiContribs, TWikiPreferences