What is Multiple Factor Authentication?

• 💭 Knowledge
• 🔑 Possession
• 🖐 Inherence

Get money from an ATM

• 🔑 Credit card
• 💭 PIN

Classic web login

• 💭 Username
• 💭 Password
• 🔑 Security Key

The Security Key

The One-Time-Password

• ✅ Can be verified
• 👤 Includes key identity

One-Time-Password Authentication

Security in Symfony

Token

AnonymousToken,UsernamePasswordToken,RememberMeToken

AuthenticationProvider

Are the username and password valid? Does the given cookie exists is session? ...

FirewallListener

✨ Where the magic operate ✨

Factory

Define configuration for security.yml!

Username + Password + OTPauthentication system

UsernamePasswordOTPToken

Extends UsernamePasswordToken and adds a OneTimePassword attribute.

class UsernamePasswordOTPToken extends UsernamePasswordToken {
    /**
     * @var string
     */
    private $oneTimePassword;

    /**
     * {@inheritdoc}
     */
    public function __construct($user, $credentials, $oneTimePassword, $providerKey, array $roles = array())
    {
        parent::__construct($user, $credentials, $providerKey, $roles);

        $this->oneTimePassword = $oneTimePassword;
    }
}

Authenticate the token

SimpleForm, Guard or full custom provider

• 👤 Load the user by username
• 💭 Check if the provided password is valid
• ✅ Validate the OTP via Yubico third-party services
• ↔️ Ensure OTP key belongs to the user

Sample implementation

// Check that the user exists.
try {
    $user = $userProvider->loadUserByUsername($token->getUsername());
} catch (UsernameNotFoundException $e) {
    throw new BadCredentialsException('User not found.');
}

// Check that the provided password is valid.
if (!$this->encoder->isPasswordValid($user, $token->getCredentials())) {
    throw new BadCredentialsException('The presented password is invalid.');
}

$oneTimePassword = $token->getOneTimePassword();

// Check that the provided one-time-password is valid.
if (!$this->yubico->isValid($oneTimePassword)) {
    throw new BadCredentialsException('Invalid OTP.');
}

// Check that the provided one-time-password belongs to the user.
if ($this->getYubikey($user) !== $this->yubico->getIdentity($oneTimePassword)) {
    throw new BadCredentialsException('Yubico identities mismatch.');
}

// Everything's in order, move along.
return new UsernamePasswordOTPToken(
    $user,
    $user->getPassword(),
    $oneTimePassword,
    $providerKey,
    $user->getRoles()
);

Demo Time!

Going further...

Two-Factor voter

Protect sensitive part of your apps with mandatory Two-Factor Auth

is_granted('IS_AUTHENTICATED_TWO_FACTOR')

UserSecurityKey Constraint

Ask for a OTP for a form to be valid(just like UserPassword constraint)