Symfony API Two Step Authentication

Question

I am developing a Symfony API application with two-step authentication. First step is json_login form with username and password and second step is OTP with SMS service. After json_login succeeded, json_login authenticator has to create JWT. Because, I use tokens instead of PHP sessions. It's configured in security.yaml file by stateless: true option.

# security.yaml
stateless: true
json_login:
check_path: app_login
     username_path: email
     password_path: password

It is possible making many different authenticators and firewalls with Symfony Framework. In the first step (json_login), the user is authenticated and is authorized to access the whole system. However, the user must have access to the entire system after the OTP step. Which method can I use for two-factor authentication?

Mahefa · Accepted Answer · 2021-03-13 15:48:06Z

1

Here are some tips that have helped me in the past :

Google Authenticator : https://github.com/sonata-project/GoogleAuthenticator (Which is implementation of original code provided by google but dedicated for PHP)
2fa : https://github.com/scheb/2fa,
- Note that https://github.com/scheb/two-factor-bundle is outdated, instead, it is recomended to use https://github.com/scheb/2fa for recent symfony version
- 2fa is explain by the author here : https://www.christianscheb.de/archives/14
SMS|Email verification, you can use Authy bundle for Symfony used with twilio, but the recommended way is to use Verify API (https://www.twilio.com/docs/verify/api)

After the implementation of these bricks, you need to add the business logic of your API

answered Mar 13, 2021 at 15:48

Mahefa

4084 silver badges12 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

karatas.hakan Over a year ago

I have to configurate 2fa bundle for JWT. I can't use external user systems like Twillio for security reasons. I will share results of my working. Thanks @Mahefa

Mahefa Over a year ago

Thanks @karatas.hakan

Collectives™ on Stack Overflow

Symfony API Two Step Authentication

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related