MultiFactor Authentication for SilverStripe

Requirements

• PHP ^7.1
• SilverStripe ^4.1
• defuse/php-encryption ^2.2 and OpenSSL PHP extension

Installation

Install with Composer:

composer require silverstripe/mfa ^4.0

You should also install one of the additional multi-factor authenticator modules:

• silverstripe/totp-authenticator
• silverstripe/webauthn-authenticator

Setup

After installing this module and a supported factor method module (e.g. TOTP), the default member authenticator
will be replaced with the MFA authenticator instead. This will provide no change in the steps taken to log in until
an MFA Method has also been configured for the site. The TOTP and WebAuthn modules will configure themselves
automatically.

After installing the MFA module and having at least one method configured, MFA will automatically be enabled. By default
it will be optional (users can skip MFA registration). You can make it mandatory via the Settings tab in the admin area.

The MFA flow will only be applied to members with access to the CMS or administration area. See 'Broadening the scope of MFA' for more detail.

Configuring custom methods

If you have built your own MFA method, you can register it with the MethodRegistry to enable it:

SilverStripe\MFA\Service\MethodRegistry:
  methods:
    - MyCustomMethod
    - Another\Custom\Method\Here

Documentation

This module provides two distinct processes for MFA; verification and registration. This module provides a decoupled
architecture where front-end and back-end are separate. Provided with the module is a React app that interfaces with
default endpoints added by this module. Please refer to the docs for specific information about the included
functionality:

• Debugging
• Creating new MFA methods
  • Frontend
  • Backend
• Local development
• Encryption providers
• Data store interfaces
• Security
• Integrating with other authenticators

License

See license.

Versioning

This library follows Semver. According to Semver, you will be able to upgrade to any minor or
patch version of this library without any breaking changes to the public API. Semver also requires that we clearly
define the public API for this library.

All methods, with public visibility, are part of the public API. All other methods are not part of the public API.
Where possible, we'll try to keep protected methods backwards-compatible in minor/patch versions, but if you're
overriding methods then please test your work before upgrading.

Reporting issues

Please create an issue for any bugs you've found, or
features you're missing.