2 factor login for experience user

Help
1

Can 2 factor login be setup for an experience user?

2

Hi @Lars_Andersson,

The logic for two-factor authentication could be configured within a workflow, did you have a specific method or service in mind?

There is also an interesting forum post where a user created a login and CAPTCHA within their experience. It may provide some inspiration, so if you’re interested, you can check it out here!

Thanks,
Julia

1 Like
3

Hi @JuliaKempf
I’m also interested in how to do MFA (two-factor authentication) for experience users. Can it be done using Microsoft Authenticator or Google?

thanks

Josh

6

@Josh_Bell, @Lars_Andersson,

We’ve been doing some thinking and research for you.

These are the general instructions but I’m adding this to our list of examples to make. You should be able to accomplish 2FA through a couple of methods:

SMS & Email

This route requires some effort. Depending on your preference of SMS and Email (the process would be very similar), you can implement your own 2FA flow in Losant.

You could use Twilio or SendGrid as the services to send the messages.

You would need to build at least two experience workflows.

  1. Generate Token Workflow - This workflow will generate the token for the user, and send via email or SMS.
  2. Verify Token Workflow - This workflow accepts a token from a user, verifies it, and set their authentication cookie.

I recommend using JWT Tokens for the secrets. You can learn more about JWT Tokens here. You will have to store a secret or one-time code for the user. The best place for this is Experience User Tags.

2FA via Rest API

I think this one would be the easiest to integrate. You can use the HTTP Node to talk to the Authy API.

7

I’m trialing the 2FA verification service with Twilio. I managed to use their service with cURL from their documentation.
But I’m having issues with the formatting in the Losant HTTP node. Can you check what I’m doing wrong ? I get a 400 error with the message “Missing required parameter To in the post body”

image
image560Ă—576 21.9 KB

10

Hey @jbwaihe,

Could you please provide a link to the documentation you’re referring to?

It looks like one thing in your string is “%2B” which is the + symbol when URL encoded. Have you tried using the + symbols directly?

11

Yes I did try + directly also.

The documentation I referred to is here: