Two Factor Auth vs WP Cassify

Secure WordPress login with this two factor auth. Users will have to enter an One Time Password when they log in. Why You Need This Users can have common or weak passwords that lets hackers/bots brute-force your WordPress site and gain access to your files and place malware there. Just like happend not that long ago: Article on TechCrunch If all sites would have used this plugin, this would never happend. It doesn’t matter how weak your users passwords are, no one can gain access to your WordPress site without already having access to the users mobile phone or email inbox (depending on how the user gets his OTP). How Does It Work? This plugin uses the industry standard algorithm TOTP or HOTP for creating One Time Passwords. A OTP is valid for a certain time and after that a new code has to be entered. You can now choose to use third party apps like Google Authenticator which is available for most mobile platforms. You can really use any third party app that supports TOTP/HOTP that generates 6 digits OTP’s. Or, as before, you can choose to get your One Time Passwords by email. Since you have to enter a secret code to third party apps, email is the default way of delivering One Time Passwords. Your users will have to activate delivery by third party apps themselves. Easy To Use Just install this plugin and you’re all set. There’s really nothing more to it. If you want to use a third party app, goto Two Factor Auth in the admin menu and activate it and set up your app. General settings can be found uner Settings -> Two Factor Auth in admin menu. Settings for each individual user can be found at the root level of the admin menu, in Two Factor Auth. A bit more work to get logged in, but a whole lot more secure! If you use WooCommerce or other plugins that make custom login forms, you will not be able to login through those anymore. I will be adding a plugin that puts a One Time Password field to WooCommerce. If you use some other plugin that needs support for this, let me know in the support forum. TOTP or HOTP Which algorithm you and your users choose doesn’t really matter. The time based TOTP is a bit more secure since a One Time Password is valid only for a certain amount of time. But this requires the server time to be in sync the clients time (if the OTP isn’t delivered by email). This is often hard to do with embedded clients and the event based HOTP is then a better choice. If you have a somewhat slow email server and have chosen email delivery, you might not get the TOTP in time. Conslusion: Choose which ever you want. TOTP is a little bit safer since OTP:s only are valid for a short period. Note that email delivery users always uses the site default algorithm, which you can set on the settings page. Third party apps users can choose which one they want. Is this really Two Factor Auth? Before version 3.0 this plugin had ‘kind of’ two factor auth where the OTP was delivered to an email address. Since version 3.0 you can have real two factor auth if you activate the Third Party Apps delivery type. Read more about what two factor auth means >>. See http://oskarhane.com/plugin-two-factor-auth-for-wordpress/ for more info.

If you’re happy with this plugin : As a reward for my efforts, I would like to receive T-shirts (or other goodies) as gifts from the universities or companies that use it. My size is L. Best regards. This Apereo CAS authentication plugin has no phpCas library dependency. This is not only an authentication plugin. You can build custom authorization rules according to cas user attributes populated. If user don’t exist in WordPress database, it can be created automatically. There are many features. You can customize everything. Website https://wpcassify.wordpress.com/ Development and release environment This plugin is now developed and tested from a github repository. You can find it here : https://github.com/WP-Cassify/wp-cassify-develop Don’t hesitate to contribute to this project. You can fork it and make pull requests ! Requirements Require at least PHP version 7.0 Require at least PHP CURL package Features included SLO (Single Log Out) support (thanks to dedotombo and me) Adding NCONTAINS operator (thanks to blandman) Fix bug on Gateway mode (autologin) (thanks to dedotombo again). Now it’s now necessary to hack theme files to fire it. Adding option logout on authentication failure to not disturb users Initialize PHP session at a later stage (on wp_loaded not on init) Adding some customs hooks and filters. Tested with Apereo CAS Server version 7.3.5 Compatible with CAS Protocol version 2 and 3 Automatic user creation if not exist in WordPress database. Synchronize WordPress User metas with CAS User attributes. Add support for multivaluate cas user fields. Now multivaluate fields can be serialized to be stored in custom WP User meta. Backup / Restore plugin configuration options settings You can choose CAS User attributes you want to populate. Then you can access them via PHP Session. Be careful, to access to CAS User Attributes from your theme file (from 1.8.4), use code below : wp_cassify_get_cas_user_datas() ); } ?> Set up WordPress Roles to User according to CAS User attributes. If plugin is network activated, you can define User Role Rule scope by blog id. Authorization rule editor. Compatible with WordPress Access Control Plugin. Manage URL White List to bypass CAS Authentication on certain pages. Much simpler bypass authentication with post method provided by Susan Boland (See online documentation). Create wordpress authentication form with redirect attribute like this (works only if URL bypass is enabled in settings) : true, 'remember' => true, 'redirect' => site_url( '/?wp_cassify_bypass=bypass' ), 'form_id' => 'loginform', 'id_username' => 'user_login', 'id_password' => 'user_pass', 'id_remember' => 'rememberme', 'id_submit' => 'wp-submit', 'label_username' => __( 'Username' ), 'label_password' => __( 'Password' ), 'label_remember' => __( 'Remember Me' ), 'label_log_in' => __( 'Log In' ), 'value_username' => '', 'value_remember' => false ); wp_login_form( $args ); ?> Receive email notifications when trigger is fired (after user account creation, after user login/logout). Define notifications rules based on user attributes values. Purge user roles before applying user role rules. Define user account expiration rules bases on CAS User attributes. Network activation allowed You can set Service Logout URL (Needs to have CAS Server with followServiceRedirects option configured). Add support for web application hosted behind a reverse proxy. (Thanks to franck86) Add custom hooks : wp_cassify_after_cas_authentication, wp_cassify_before_auth_user_wordpress, wp_cassify_before_redirect, wp_cassify_after_redirect. (See online documentation) Custom filter to perform custom cas server response parsing. Hook name : wp_cassify_custom_parsing_cas_xml_response (See online documentation) Custom shortcode to generate CAS login/logout link into your blog. (See online documentation) Debug settings, dump last xml cas server response. Detect if user has already authenticated by CAS from your public pages and perform auto-login with gateway mode Add ‘-IN’ and ‘-NOTIN’ operators to process array attributes values returned from CAS. When you have : $cas_user_datas['title'] = array( 'Student', 'Professor' ); Then you can use : (CAS{title} -IN "professor")