Request for apache auth module about google-authenticator HOT 7 CLOSED

I appreciate this has been closed for a while now but wanted to add a reference if someone lands here as I did.

There is a way to add Apache authentication (username & password based on mod_auth_basic, mod_auth-digest etc) and separate TOTP for 2FA authentication. It can be done by leveraging Apache mod_rewrite and some additional scripts. More details and code is available here:

https://github.com/itemir/apache_2fa

from google-authenticator.

Comment #1 originally posted by elstudio3 on 2011-02-22T22:52:03.000Z:

mod_auth_pam allows Apache to use PAM for auth -- doesn't that take care of this?

from google-authenticator.

Comment #2 originally posted by jim.kleckner on 2011-02-24T18:18:50.000Z:

It would be very useful if someone could sketch out the Apache2 PAM integration if they have done it.

Doesn't the authentication model implemented in Apache2 assume name + password, not name + password + totp? What would it take to add it?

from google-authenticator.

Comment #3 originally posted by jim.kleckner on 2011-02-25T05:34:41.000Z:

FYI, from here:
http://pam.sourceforge.net/mod_auth_pam/

It says:
Due to constraints in the "Basic" authentication scheme (RFC 2617), it only supports username/password-style authentication.

and:
mod_auth_pam is not supported and/or developed any longer. The original author moved on and it mostly works for Apache 1.3 and 2.0.

from google-authenticator.

Comment #4 originally posted by [email protected] on 2011-03-09T20:34:58.000Z:

Merging into bug # 39 as it appears that the solution for both bugs would be identical.

from google-authenticator.

Comment #5 originally posted by bkgoodman on 2011-04-28T16:44:01.000Z:

I have written an Apache Authentication module for Google Authenticator.

It works, but I am still working around some inherent difficulties in using this type of authentication with HTTP (short-lived-sessions) vs. something like SSH.

Ideally - I guess I would like to submit it into this project. I don't know how you feel about that - as it's not strictly part of the "PAM" module. It does however reuse a lot of your code.

Please tell me if you'd like to include it here, (or anyone would like to take a look at it), or I should put in in a separate project somewhere.

from google-authenticator.

Comment #6 originally posted by bkgoodman on 2011-05-05T15:57:37.000Z:

Apache module is now available at:

http://code.google.com/p/google-authenticator-apache-module/

from google-authenticator.