Two step authentication

Question

I'm trying to implement a two factor authenication scheme within a Symfony2 application that I'm writing. Basically, the system currently works normally, with a Doctrine ORM Entity as the user provider. However, I'm running into a problem with figuring out how to properly and most efficiently add this.

Basically, the authentication should work as such. User sees Login form. Types user/password combination, and then enters a OTP (In this case yubikey.)

The standard symfony2 authentication handles the user/password just fine. However, I'd like to add the option of adding OTP support (provided the user has a database entry for the yubikey, and it is enabled sitewide.)

Has anyone had any luck with such schemas? I'd like to avoid reinventing the wheel, and simply just need to figure out how to tie this into the current authentication schema.

Originally, I had thought to use the isPasswordValid() function within the custom password encoder (bcrypt) that I'm using. However, there's seemingly no way to pass the otp to that function.

Answer 1

You'll need to write a custom authentication provider (I'm assuming you're using the default entity based provider) that incorporates the OTP related logic. I'm not going to copy and paste Symfony's example here, but there is one in their documentation for reference.