StripeCon EU 2020 - MFA

In StripeCon EU 2020, I talked about using Multi-Factor Authentication (MFA) in Silverstripe. MFA provides an extra layer of security for CMS Administrators, Content Editors, and Stack Managers.

Transcript

2. Sherry Shahbazi Multi-Factor Authentication (MFA)
3. $ composer require silverstripe/mfa ^4.0 $ composer require silverstripe/totp-authenticator ^4.0 $ composer require silverstripe/webauthn-authenticator ^4.0 How to install MFA for Silverstripe
4. SS_MFA_SECRET_KEY should be set up within your `.env` file What to Configure Configuring Encryption Key For TOTP Authenticator $ php -r 'echo substr(base64_encode(random_bytes(32)), 0, 32) . "\n";' Generating Random Secret Key
5. Demo Time
6. Complexities Across Multiple Envs • Existing registered TOTP methods for users will not be usable on environments with different values for SS_MFA_SECRET_KEY than they were registered in • WebAuthn is being tied to a domain, so logins won’t work when PROD database is copied to UAT
7. References https://www.silverstripe.org/blog/multi-factor-authentication-on-silverstripe/ https://github.com/silverstripe/silverstripe-mfa https://github.com/silverstripe/silverstripe-totp-authenticator https://github.com/silverstripe/silverstripe-webauthn-authenticator
8. Thank you!