tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-22 14:05:37 +02:00
Code Issues Projects Releases Wiki Activity

DOCS MFA authentication (#9536)

Browse Source 
See https://github.com/silverstripe/silverstripe-installer/issues/280
This commit is contained in:
Ingo Schommer 2020-08-20 18:33:36 +12:00 committed by GitHub
commit f8b4570cb1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
docs/en/02_Developer_Guides/09_Security/03_Authentication.md
View File

@ -9,6 +9,18 @@ icon: users-cog
By default, SilverStripe provides a [MemberAuthenticator](api:SilverStripe\Security\MemberAuthenticator\MemberAuthenticator) class which hooks into its own internal
authentication system.
Silverstripe projects created with CMS Recipe 4.7.0 onwards include Multi Factor Authentication (MFA)
through the [silverstripe/mfa](https://github.com/silverstripe/silverstripe-mfa) module.
This increases login security by asking for a code generated on another device,
through TOTP with the [silverstripe/totp-authenticator](https://github.com/silverstripe/silverstripe-totp-authenticator)
module. This step is optional for users, and can be disabled or required by CMS
administrators ([instructions](https://userhelp.silverstripe.org/en/4/optional_features/multi-factor_authentication/)).
To further increase login security, you can install support
for hardware tokens through the [silverstripe/webauthn-authenticator](https://github.com/silverstripe/silverstripe-webauthn-authenticator)
module. These tokens virtually eliminiate the risk of [credential phishing](https://en.wikipedia.org/wiki/Phishing),
but also require a bit of care during setup.
## User Interface
SilverStripe comes with a default login form interface,