How to integrate Duo Two Factor Authentication with CakePHP3

So recently I wanted to integrate Duo two-factor authentication into one of the client’s projects but I didn't find much documentation support on CakePhp3. Afte

So recently I wanted to integrate Duo two-factor authentication into one of the client’s projects but I didn't find much documentation support on CakePhp3. Afte

So recently I wanted to integrate Duo two-factor authentication into one of the client’s projects but I didn't find much documentation support on CakePhp3. After struggling for a couple of days to figure out how to integrate DUO 2FA with CakePhp3, I achieved success in integration and so decided to write this blog so that I can genuinely contribute and offer a glimpse to all those developers who are looking out for similar blogs to resolve their issues.

However, before jumping on to the solution right away, let’s first understand what two-factor authentication is all about.

What is Two-Factor Authentication?

Two-factor authentication (commonly abbreviated as 2FA) is a security system that requires two separate, distinct forms of identification to access something.

It is a specific type of multi-factor authentication (MFA) that strengthens access security by requiring two methods (also referred to as authentication factors) to verify your identity. These factors can include:

• Things you know (a personal identification number (PIN), a password, answers to "secret questions" or a specific keystroke pattern)
• Things you have (such as a text with a code sent to your smartphone or other devices, or a smartphone authenticator app)
• Things you are (biometric pattern of a fingerprint, face, retina scan, or a voice print)

2FA protects against phishing, social engineering, and password brute-force attacks. It secures your logins from attackers exploiting weak or stolen credentials.

By integrating two-factor authentication with your applications, attackers are unable to access your accounts without possessing your physical device needed to complete the second factor.

While 2FA does improve security, it is not foolproof. These following instructions will guide you through how to do two factor authentication with Cake PHP.

DUO SDK Workflow

1. Call health_check() Create a Client() object
 

try {

      $duo_client = new Client(

      $duoconfig['client_id'],

      $duoconfig['client_secret'],

      $duoconfig['api_hostname'],

      $duoconfig['redirect_uri']

        );

     } catch (DuoException $e) {

       throw new ErrorException("*** Duo config error. Verify the values in duo.conf are correct ***\ " . $e->getMessage());

 }

2. Call health_check()

 try {

      $duo_client->healthCheck();                        

      } catch (DuoException $e) {

        $logger->error($e->getMessage());

      if ($duo_failmode == "OPEN") {

          $this->Flash->error(__('Login Successful, but 2FA Not Performed. Confirm Duo client/secret/host values are correct'));

          return $this->redirect($this->Auth->redirectUrl(['controller' => 'prequals','action' => 'index']));

      } else {

        $this->Flash->error(__('2FA Unavailable. Confirm Duo client/secret/host values are correct'));

        return  $this->redirect($this->Auth->logout());

        }

    }

3. Call generate_state()

$duostate = $duo_client->generateState();

4. Call create_auth_url()

$prompt_uri = $duo_client->createAuthUrl($user[0]->username, $duostate);

5. Redirect the Client

$this->redirect($prompt_uri);

6. Wait for the Redirect from Duo back to your Redirect URI. 

It redirects you to redirect URI mentioned in duo config. For example: https://yourdomain.com/duo-callback

7. Validate the state Parameter

  $state=$this->request->query['state'];

 $saved_state = $this->Auth->user('duostate');

 if ($state != $saved_state) {

     $this->Flash->error(__('Duo state does not match saved state'));

     return $this->redirect($this->Auth->redirectUrl(['controller'=>'users','action' => 'login']));

}

8. Call exchange_authorization_code_for_2fa_result()

if ($state == $saved_state) {

         try {

              $decoded_token =  $duo_client->exchangeAuthorizationCodeFor2FAResult(

            $code,

              $username

              );

              } catch (DuoException $e) {

          $this->Flash->error(__('Error decoding Duo result. Confirm device clock is correct.'));

          return $this->redirect($this->Auth->redirectUrl(['controller'=>'users','action' => 'login']));

       }                

}

Steps to integrate DUO 2FA into your web application

1. Sign up to DUO and generate a Web SDK.
   You can either follow the below steps or refer to DUO official documentation
   1. Create an account on DUO
   2. Login to the DUO admin panel
   3. Under applications and navigate to Applications. Click Protect an Application and locate the 2FA-only entry for Web SDK in the applications list.
   4. Click Protect to the far-right to configure the application and get your Client ID, Client Secret, and API hostname. You'll need this information to complete your setup. See Protecting Applications for more information about protecting applications in Duo and additional application options.
      Previously, the Client ID was called the "Integration key" and the Client secret was called the "Secret key".
       
2. Add the duo-universal Dependency to your Project.
   In order to communicate with the Duo 2FA service, we will need to link the DUO web SDK with the web application.