Download the PHP package krixon/multi-factor-auth without Composer

On this page you can find all versions of the php package krixon/multi-factor-auth. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of krixon/multi-factor-auth

Informations about the package multi-factor-auth

Multi Factor Authentication

Build Status Coverage Status Code Climate Latest Stable Version Latest Unstable Version License

SensioLabsInsight

A library for generating and verifying the codes used in multi-factor authentication systems.

Features:

This library implements the following RFCs:

It has been tested against the following multi-factor authentication tools:

Prerequisites

Installation

Install via composer

To install this library with Composer, run the following command:

You can see this library on Packagist.

Install from source

Quick Start

Let's say you have a server side application which you want to protect using multi-factor authentication.

There are three main steps involved:

  1. Generate a secret which is shared between the server and the user.
  2. Configure a client application (such as Google Authenticator) with the shared secret.
  3. Verify codes generated by the client application whenever the user needs to authenticate.

This library makes these steps easy.

The quickest way to get up and running is to create a new instance of the MultiFactorAuth class. This takes various arguments to its constructor, but there is a static factory provided which creates an instance with sensible and secure defaults. The only thing you need to provide is an "issuer" string. This is just a label which identifies the provider or service managing a user's account - i.e. your application.

Next you need to generate the shared secret. By default the code below will generate a 160-bit, base32-encoded string:

In order for the user to configure their client application, they need to enter the secret that was just generated. Often the user's client application will be running on their mobile phone. Entering a 160-bit secret by hand is certainly possible, but we can make it easier by providing the user with a barcode to scan. This barcode contains all of the information required to configure the client.

When generating a barcode you must also provide an account identifier. This can be any string which allows the user to distinguish between multiple accounts in their client application. A good value for this is the user's email address.

The generateTimeBasedBarcode() method returns a Barcode instance. This can be used to ultimately render the image, for example on a webpage:

Once the user has scanned the barcode, they should be prompted to enter a code which can be verified to determine that the configuration process was successful.

If the code is verified successfully, the secret can be securely persisted on the server, for example in a database.

From now on, when the user authenticates they should be prompted to enter a code along with their other credentials such as username and password. This code should be verified using the stored shared secret and authentication denied if verification fails.

Generating Backup Codes

If a user loses their device or otherwise cannot generate codes, you can allow them to login via a pre-generated backup code. Event-based (HOTP) codes are perfect for this.

The following example generates 10 backup codes which the user can write down or otherwise store.

Generating Secrets

By default, secrets are generated using the RandomBytesSecretGenerator. This generates cryptographically secure secrets using PHP's random_bytes function. If a different method is required, simply implement the SecretGenerator interface.

The RandomBytesSecretGenerator takes a Codec instance which determines how generated secrets are encoded. For maximum compatibility with Google Authenticator and similar apps, secrets should be base32 encoded, so the Base32Codec is used if no alternative is specified.

To generate a secret, either use a SecretGenerator directly, or use the MultiFactorAuth facade.

Sandbox

There is a simple sandbox script in the examples directory which can be used to generate secrets and barcodes and to verify codes generated by a client application.

The sandbox can be run with the PHP built-in webserver. Make sure to specify the correct path to the examples directory:

You can now visit http://localhost:8080/sandbox.php to use the sandbox.

TODO

All versions of multi-factor-auth with dependencies

PHP Build Version
Package Version
Requires php Version >=7.2
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package krixon/multi-factor-auth contains the following files

Loading the files please wait ....