Hi All,
I just released the beta version of Multi-Factor Authentication http://drupal.org/project/multifactor and it's associated module, Multi-Factor Call that uses Voip Drupal for additional authentication. There is also a demo site setup at http://voip.stage.mycrux.net/ so feel free to try it out.
Per the module's page:
This module includes a secure method for multi-factor authentication using VoIP Drupal and phone based pin numbers. This enhancement to basic authentication greatly improves security especially for site admins.
How Multi-Factor Pin Authentication Works:
1. New/Existing user adds a pin and phone number to predefined profile fields.
2. User logs out of the site.
3. User attempts to login with username and password.
4. A call is submitted to VoIP Drupal and the user receives a call.
5. The user will be instructed to enter their pin and will have 60 seconds to do so.
6. If the user enters the pin correctly they're logged in as normal. If the user doesn't know the pin or time runs out they are redirected to the login page.
Comments
Re: Multi-Factor Authentication Module Beta
Hello ben.bunk,
Congratulations on the new module! It looks (ie. sounds) awesome!
What was the hardest part for you re: learning VoIP Drupal?
Let's us know if we can be of any help, ok?
Best,
Leo and the rest of the team
Great Experience
Thank you! You guys have been great in this group and responding to tickets in the issue queue. I'm very appreciative for your hard work on these modules.
My issues were mainly learning curve related:
It took me awhile to realize that the providers we're calling back to a url on my Drupal install. I use cloud flare and they were blocking the traffic because it's a bot. Once I found out this was what was happening I opened the ports and it was a smooth process. http://groups.drupal.org/node/183434
I had trouble figuring out the pattern for loading scripts in code. It took me quite awhile before I realized I needed to pass a VoipScript object into VoipCall::setScript. It might be obvious to others but it didn't jump out to me right away.
Checking the status of the call was also a bit tricky because I didn't realize the VoipCall lifecycle is multi-threaded which also contributed to my issues in number 1 above. I was checking isHangup in a loop but the results were always stale. Eventually, I realized I needed to call VoipCall::load inside my loop which resulted in a fresh object. This is a simple pattern that other developers will need to use when calling isHangup. I updated the docs here: http://drupal.org/node/1079288
I found a weird behavior in VoipScript with addSet's but I need to further test before I create a ticket.
D7 version of multi-factor authentication module
Hi there.
I was wondering if you had any plans to convert this module to D7. I was considering using it as the basis for an owner verification system...user claims ownership of a resource online, VOiP then phones number associated with that resource and delivers (for example) a four-digit code that must then be entered into the site to authenticate ownership of the resource. This doesn't seem like too far a stretch for this module, but maybe I'm oversimplifying things a bit.