TwoFactor Module

Two-Factor Authentication (2FA) module for CMS Made Simple by Pixel Solutions.

Features

• Multiple Authentication Methods:
  • TOTP (Time-based One-Time Password) - Google Authenticator, Authy, etc.
  • Email Verification - Receive codes via email
  • SMS Verification - Receive codes via Twilio SMS
  • Backup Codes - One-time emergency access codes
• Flexible Configuration:
  • Users can enable/disable methods individually
  • Choose primary authentication method
  • Multiple methods can be enabled as fallback options
• Security Features:
  • Intercepts login after username/password validation
  • Session-based verification flow
  • Audit logging for all 2FA events
  • Secure code generation and validation

Installation

1. Upload the module files to modules/TwoFactor/
2. Install the module from Extensions > Modules
3. The module will automatically:
   • Create the database table mod_twofactor_usermeta
   • Copy admin/twofactor.php verification page
   • Register the Core::LoginPost event handler

Configuration

TOTP (Authenticator App)

1. Navigate to Extensions > TwoFactor
2. Click "Configure" for Authenticator App
3. Scan the QR code with your authenticator app
4. Enter the 6-digit code to verify

Email Verification

1. Click "Configure" for Email Verification
2. Click "Enable Email Verification"
3. Codes will be sent to your admin account email

SMS Verification (Twilio)

1. Create a Twilio account and Verify Service
2. Generate API Key and Secret in Twilio Console
3. Enter credentials in SMS settings:
   • API Key SID
   • API Secret
   • Verify Service SID
4. Enter phone number in E.164 format (e.g., +1234567890)
5. Verify the code sent to your phone

Backup Codes

1. Click "Configure" for Backup Codes
2. Click "Generate Backup Codes"
3. Save the codes in a secure location
4. Each code can only be used once

Usage

Login Flow

1. Enter username and password as normal
2. After successful authentication, you'll be redirected to 2FA verification
3. Enter the code from your primary authentication method
4. Click "Use a backup code" if you need to use an alternative method

Switching Methods

During verification, you can switch between enabled methods using the provider dropdown.

Uninstallation

The module will:

• Remove the database table
• Delete the admin/twofactor.php file
• Remove all user 2FA settings

Requirements

• CMS Made Simple 2.x
• PHP 7.4 or higher
• For TOTP: RobThree/TwoFactorAuth library (included via Composer)
• For SMS: Twilio account with Verify API access

Support

For issues or questions, contact: magal@pixelsolutions.biz