SMS Two-Step Authentication Contrib Package

Install SmsTwoStepAuthContrib extension

• Configuration:
  • Run the configure script and open up the Security setup section.
    • The {LoginManager} needs to be set to Foswiki::LoginManager::SmsTwoStepLogin
  • Configure additional contrib settings in the Extensions section:
    • White-listed IP addresses, typically used for offices so that employees can log in with a single step at work. Specify a comma-space separated list. Partial IP addresses ending in a dot can be used to specify a range. Example: 1.2.3.4, 5.6.7.
      {SmsTwoStepAuthContrib}{WhitelistAddresses} = '';
    • Maximum age of access code in seconds, default is 600 (10 min):
      {SmsTwoStepAuthContrib}{MaxAge} = 600;
    • Mode of two-step authentication:
      • disabled: Single step authentication.
      • optional: Optional, e.g. user can chose. Attention: The UserForm and UserProfileHeader need to be updated - see instructions below.
      • required: Required for all users. (default)
      {SmsTwoStepAuthContrib}{TwoStepAuth} = 'required';
    • It is possible to send the access code by e-mail instead of SMS if the user has not specified a mobile number and a carrier. Possible values:
      • 0 or empty value: No e-mail sent, user cannot login (more secure).
      • 1: Users with missing mobile and carrier get an e-mail with access code (more flexible).
      • List of users: Specify a comma-space separated list of WikiWord names of users who can get an e-mail. Examples:
        JimmyNeutron - only one specified user
        JimmyNeutron, DonaldDuck - only two specified users
      {SmsTwoStepAuthContrib}{AllowEmail} = '';
    • Name of two-step message template for SMS message:
      {SmsTwoStepAuthContrib}{SmsMessageTmpl} = 'smstwostepmessage';
    • Name of log-in screen template for SMS log-in:
      {SmsTwoStepAuthContrib}{SmsLoginTmpl} = 'smstwosteplogin';
    • Name of two-step message template for e-mail message:
      {SmsTwoStepAuthContrib}{EmailMessageTmpl} = 'smstwostepemailmessage';
    • Name of log-in screen template for e-mail log-in:
      {SmsTwoStepAuthContrib}{EmailLoginTmpl} = 'smstwostepemaillogin';
    • Name of log-in screen template in case of insufficient credentials:
      {SmsTwoStepAuthContrib}{ErrorLoginTmpl} = 'smstwosteperrorlogin';
    • Access code error message:
      {SmsTwoStepAuthContrib}{AcessCodeError} = 'Invalid or outdated access code, please try again.';
  • Note that this extension requires a CGI Session prior to login. If you have turned off guest sessions using the expert setting: {Sessions}{EnableGuestSessions} it needs to be enabled for two-step login to work. The fix for Foswikitask:Item14460 will remove this restriction. This is planned for Foswiki 2.1.5 / 2.2.0.

Update UserForm

| Mobile Carrier | select | 1 | , %INCLUDE{ "%SYSTEMWEB%.SmsTwoStepAuthContrib" section="carrierlist" }% | Mobile carrier | H |

| Two Step Auth | radio | 2 | off, on | Select on to use two-factor authentication | H |

Verify mobile carrier list

Test configuration

• From a location that is white-listed, e.g. has its IP address in {SmsTwoStepAuthContrib}{WhitelistAddresses} do this:
  • Log in with log-in name and password. You should be able to log in with a single step.
  • Edit your user profile topic and specify a mobile number and mobile carrier.

• From a location that is not white-listed do this:
  • Log in with log-in name and password.
  • You should see an "Enter access code" screen, and get an SMS on your mobile phone with the access code.
  • Enter the access code to complete the second authentication step.
  • Repeat the log-in. This time enter an invalid access code to verify failed log-in and one-time-use of access code.