PHP Classes
elePHPant
Icontem

PHP User Credentials: Implement password authentication policies

Recommend this page to a friend!
  Info   View files Documentation   Screenshots Screenshots   View files View files (379)   DownloadInstall with Composer Download .zip   Reputation   Support forum   Blog (1)    
Last Updated Ratings Unique User Downloads Download Rankings
2018-06-29 (17 days ago) RSS 2.0 feedStarStarStarStarStar 80%Total: 1,317 This week: 8All time: 2,881 This week: 46Up
Version License PHP version Categories
user-credentials 1.5.9BSD License5.4PHP 5, User Management, Security
Description Author

This package can implement password authentication policies.

It can perform several types of check to evaluate if user passwords and authentication procedures comply with security recommendations.

The base class can take as parameters a user profile with details like user name, password, full name, password hash, list of password hashes used in the past, account state and policy information.

The class can enforce password length rules, the use of upper and lower case letters, numbers and special characters, number of allowed failed authentication attempts until the account is locked for a period or blocked until further noticed, number of days to require a new password, prevent reusing past passwords, prevent character repetition in password and method for calculating password strength

Innovation Award
PHP Programming Innovation award nominee
May 2015
Number 11


Prize: One downloadable copy of CodeLobster Professional
One of the security weaknesses of many systems is in the way they allow to create user passwords.

If the system allows users to choose passwords that are too easy to guess, the security of the system is weak.

This class can enforce security policies regarding user passwords, not only in the types of characters that the users can enter for their passwords, but also in the accepted number of failed authentication attempts, number of days that a password may be valid, and preventing the reuse of old passwords.

Manuel Lemos
  Performance   Level  
Name: Cyril Ogana <contact>
Classes: 4 packages by
Country: Kenya Kenya
Age: ???
All time rank: 17813 in Kenya Kenya
Week rank: 49 Up1 in Kenya Kenya Up
Innovation award
Innovation award
Nominee: 2x

Details

PHP USERCREDENTIALS

This package can implement password authentication and policy management. It can perform several types of check to evaluate if user passwords and authentication procedures comply with security recommendations

Description

The PHP UserCredential Package is a pluggable service that enables one to validate passwords and policy. It validates against a set of password policies as recommended by OWASP best practice guidelines for Web applications.

The package also provides an Interface that allows plugging in 3rd party libraries, particularly for Multi Factor Authentication methods. To Illustrate how, we have plugged in MultiOTP library (https://github.com/multiOTP/multiotp) for the SMS OTP and Google Authenticator TOTP services that we have provided with this package.

Installing

Install application via Composer

require "cymapgt/usercredential": "1.*"

Usage

Overview

This package is intended for PHP applications which use Password for authentication and are required to maintain a User Credential policy of sorts. We also offer Multi Factor authentication services which utilize the MultiOTP Library.

The objectives of the Package are

  • Implement policy for password encryption and verification (At the moment being PHP's bcrypt library)
  • Implement policy for authentication and password management by implementing authentication guidlines in OWASP Secure Coding Practices (https://www.owasp.org/index.php/OWASP_Secure_Coding_Practices_-_Quick_Reference_Guide
  • Provide an easy way to integrate password policy to your application. When you use the service out of the box without custom configuration, it provides the following

    (Introduced Version 1.2)

    - Temporary lock out account after 4 successive illegal login attempts for 10 minute

    - Indefinately lock out account on 5th successive illegal login attempt

    - User cannot repeat 5 last passwords

    - User passwords expire after 45 days

    - Enforce password change when a password is not of the required entropy

    - Minimum password length required of 8 characters

    - Minimum password entropy is 2 capital case alphabet characters, 2 lower case alphabet characters, 1 numeric character and 1 special character

    - User cannot use their Username, or their real name (or part of) in the Password string

    (Introduced Version 1.3)

    - Password cannot contain more than 2 consecutive characters (e.g. aaa)

    - Password strength checker Class is included (Kudos to Ryan Chouinard for development of the lovely Phpass package (rchouinard/phpass) https://github.com/rchouinard/phpass), which we Forked for the strength functionality checker using NIST and Wolfram algorithms

  • Provide a consistent interface for authentication and policy processes regardless of the backend store used

Implementation of OWASP Guidlines

All authentication controls should fail securely:* The Service is not intrusive. A UserProfile is provided to the service and it does not intervene unless it encounters an issue with the authentication or policy at which point it throws a UserCredentialException, which should then be handled

Enforce password complexity requirements established by policy or regulation. Authentication credentials should be sufficient to withstand attacks that are typical of the threats in the deployed environment. (e.g., requiring the use of alphabetic as well as numeric and/or special characters):The service has a method for implementing user defined policy based on length and complexity. However, it does not let one set a Weak policy as it compares the User defined policy to the built in base policy, and if the User defined policy is weak e.g. If Password length is 5 characters in user defined policy, it will fall back to the base (8 characters as per OWASP).NB: Falling back to be introduced and is not yet implemented.*

Enforce password length requirements established by policy or regulation. Eight characters is commonly used, but 16 is better or consider the use of multi-word pass phrases:* See previous point

Enforce account disabling after an established number of invalid login attempts (e.g., five attempts is common). The account must be disabled for a period of time sufficient to discourage brute force guessing of credentials, but not so long as to allow for a denial-of-service attack to be performed:* The service locks the account temporarily (10 minutes in base policy) for repeated attempts. After 10 minutes, the user may successfully log in with the correct password. However, if at any time after this the User provides another wrong password, the service locks the account indefinitely which will require admin intervention to unlock

Enforce the changing of temporary passwords on the next use:* The service will recommend/enforce password change on next attempted login when using a weak password

Prevent password re-use:* The service can support this. By default the last 5 passwords are not allowed to be repeated. User defined policy can increase this. We have seen up to 12 previous passwords being used in some environments.

Enforce password changes based on requirements established in policy or regulation. Critical systems may require more frequent changes. The time between resets must be administratively controlled:* The service has a default expiry period for passwords of 45 days. A stronger User Defined Policy (e.g. 30 days) can be set using the User defined policy methods.

Use MultiFactor Authentication for highly sensitive or high value transactional accounts* The service implements an Interface that can allow for Multi-Factor authentication.

Using the Package

Named Constants

//UserCredential constants for user authentication
const USERCREDENTIAL_ACCOUNTSTATE_LOGGEDOUT   = 1;
const USERCREDENTIAL_ACCOUNTSTATE_LOGGEDIN    = 2;
const USERCREDENTIAL_ACCOUNTSTATE_LOCKED1     = 3;
const USERCREDENTIAL_ACCOUNTSTATE_LOCKED2     = 4;
const USERCREDENTIAL_ACCOUNTSTATE_RESET       = 5;
const USERCREDENTIAL_ACCOUNTSTATE_SUSPENDED   = 6;
const USERCREDENTIAL_ACCOUNTSTATE_AUTHFAILED  = 7;
const USERCREDENTIAL_ACCOUNTSTATE_WEAKPASSWD  = 8;

/
 * UserCredential constants for account policy actions. These also serve as
 * exception codes during the authentication and policy check process.
 * Internal Exception codes are documented in the EXCEPTIONS.md file
 */

const USERCREDENTIAL_ACCOUNTPOLICY_VALID         = 1;
const USERCREDENTIAL_ACCOUNTPOLICY_EXPIRED       = 2;
const USERCREDENTIAL_ACCOUNTPOLICY_ATTEMPTLIMIT1 = 3;
const USERCREDENTIAL_ACCOUNTPOLICY_ATTEMPTLIMIT2 = 4;
const USERCREDENTIAL_ACCOUNTPOLICY_REPEATERROR   = 5;
const USERCREDENTIAL_ACCOUNTPOLICY_WEAKPASSWD    = 6;
const USERCREDENTIAL_ACCOUNTPOLICY_NAMEINPASSWD  = 7;

//Password strength constants
const PHPASS_PASSWORDSTRENGTHADAPTER_NIST = 0;
const PHPASS_PASSWORDSTRENGTHADAPTER_WOLFRAM = 1;

Building Your User's Profile

* This service is decoupled from backend store of user and auth info. It will need an array of the userProfile, which you should build and provide to the Service.

Sample User Profile

array (
    "username" => "james",
    "password" => "m&$1eLe6Ke()", //Password provided by user when loggin in, else null if youre running this in session and not log in
    "fullname" => "James Rodriguez",
    "passhash" => "bcrypt",
    "passhist" => array( //These should be already stored as encrypted in your backend store and would be of required entropy :)
        \password_hash('abc', \PASSWORD_DEFAULT),
        \password_hash('def', \PASSWORD_DEFAULT),
        \password_hash('ghi', \PASSWORD_DEFAULT),
        \password_hash('jkl', \PASSWORD_DEFAULT),
        \password_hash('mno', \PASSWORD_DEFAULT),
        \password_hash('pqr', \PASSWORD_DEFAULT),
        \password_hash('stu', \PASSWORD_DEFAULT),
        \password_hash('vwx', \PASSWORD_DEFAULT),
        \password_hash('xyz', \PASSWORD_DEFAULT)
    ),
    "policyinfo"=>array(
        'failed_attempt_count' => 0,
        'password_last_changed_datetime' => new \DateTime('2014-05-04'),
        'last_login_attempt_datetime'    => new \DateTime('2014-05-16 23:45:10')
    ),
    "account_state" => \USERCREDENTIAL_ACCOUNTSTATE_LOGGEDIN
);

Authenticating A User

The service comes with 3 Password Authenticating Services which you can Choose From. A Wiki for using each of the services as well as on implementing password policy is in the pipeline. This article here http://bit.ly/29m2aWL that explains using a DB as a backend store might assist with getting started on using the package.

Check the test file for these services for some documentation on their workings.

UserCredentialPasswordLoginService

This service does password authentication only. To use this service, you will need to plug it in to the authentication Framework / Plugin that you are using.

UserCredentialSmsTokenLoginService

This service generates Tokens which are sent to the mobile number or email that is mapped to the user. This class extends UserCredentialPasswordLoginService which performs the first step of the authentication.

UserCredentialGoogleAuthLoginService

This service generates TOTP tokens which change in intervals of 30 seconds. Thus, these can support Google Authenticator. This class extends UserCredentialPasswordLoginService which performs the first step of the authentication.

Enforcing Password Policy After Authenticating

use cymapgt\core\application\authentication\UserCredential;
//Build user Profile First (see sample above)

$userCredentialService = new UserCredentialManager($userProfile);

try {
    $usercredentialService->validateEntropy();
    $usercredentialService->validateLength();
    $usercredentialService->validateConsecutiveCharacterRepeat();
    $checkPolicy = true;
} catch (UserCredentialException $enException) {
    $enExceptionId = $enException->getCode();
    $checkPolicy = false;
    //Handle the Exception...
}

if ($checkPolicy) {
    try {
        $usercredentialService->validatePolicy();
    } catch (UserCredentialException $plcyException) {
        //Handle the Exception...
    }
}

//Yay, we made it. Do something Amazing ... :)

Enforcing Password Policy During Sessions

* Usage during sessions is as above, except you cannot use validateEntropy() etc .... only validatePolicy() e.g on accessing a resource it may calculate that the 45 days have elapsed and throw exception requiring password change

Verifying Password Strength with Phpass

The strength checker method is static, to allow for usage without needing instantiation of the UserCredentialManager class. Thus, it can also be used in assisting users when they are changing passwords or setting up new passwords.

use cymapgt\core\application\authentication\UserCredential; 
    
$passwordStrength = UserCredentialManager::passwordStrength($passwordString);

//do something like show strength bar, or enforce stronger password

Testing

PHPUnit Tests are provided with the package

Contribute

  • Email @rhossis or contact via Skype
  • Fork the repository on GitHub to start making your changes to the master branch (or branch off of it).
  • You will be added as author for contributions

License

BSD 3 CLAUSE

Screenshots  
  • screenshot/usingNameInPassword.png
  • screenshot/tempSuspension2.png
  • screenshot/tempSuspension1.png
  Files folder image Files  
File Role Description
Files folder imagebuild (1 directory)
Files folder imagedocs (1 directory)
Files folder imageimages (4 files)
Files folder imagejavascripts (1 file)
Files folder imagelib (1 directory)
Files folder imageplugins (1 directory)
Files folder imagesrc (1 file, 7 directories)
Files folder imagestylesheets (2 files)
Files folder imagetests (1 file, 3 directories)
Accessible without login Plain text file composer.json Conf. Composer bootstrap file
Accessible without login Plain text file composer.lock Data Activate Github sync
Accessible without login Plain text file EXCEPTIONS.md Doc. Code refactoring - Quality Check Exception code documentation
Accessible without login HTML file index.html Doc. Documentation
Accessible without login Plain text file LICENSE Data Activate Github sync
Accessible without login Plain text file license.txt Lic. License file
Accessible without login Plain text file params.json Data Auxiliary data
Accessible without login Plain text file phpdox.xml Data Auxiliary data
Accessible without login Plain text file README.md Doc. Activate Github sync
Accessible without login Plain text file readme.txt Doc. Documentation for UserCredential

  Files folder image Files  /  build  
File Role Description
Files folder imagephpdox (1 directory)

  Files folder image Files  /  build  /  phpdox  
File Role Description
Files folder imagexml (2 files, 3 directories)

  Files folder image Files  /  build  /  phpdox  /  xml  
File Role Description
Files folder imageclasses (5 files)
Files folder imageinterfaces (1 file)
Files folder imagetokens (1 file, 4 directories)
  Accessible without login Plain text file index.xml Data Auxiliary data
  Accessible without login Plain text file source.xml Data Auxiliary data

  Files folder image Files  /  build  /  phpdox  /  xml  /  classes  
File Role Description
  Accessible without login Plain text file cymapgt_core_appli...dentialAbstract.xml Data Auxiliary data
  Accessible without login Plain text file cymapgt_core_appli...ordLoginService.xml Data Auxiliary data
  Accessible without login Plain text file cymapgt_core_appli...edentialManager.xml Data Auxiliary data
  Accessible without login Plain text file cymapgt_Exception_...entialException.xml Data Auxiliary data
  Accessible without login Plain text file Exception.xml Data Auxiliary data

  Files folder image Files  /  build  /  phpdox  /  xml  /  interfaces  
File Role Description
  Accessible without login Plain text file cymapgt_core_appli...cationInterface.xml Data Auxiliary data

  Files folder image Files  /  build  /  phpdox  /  xml  /  tokens  
File Role Description
Files folder imageabstractclass (2 files)
Files folder imageconfig (1 file)
Files folder imageException (1 file)
Files folder imageservices (1 file)
  Accessible without login Plain text file UserCredentialManager.php.xml Data Auxiliary data

  Files folder image Files  /  build  /  phpdox  /  xml  /  tokens  /  abstractclass  
File Role Description
  Accessible without login Plain text file UserCredentialAbstract.php.xml Data Auxiliary data
  Accessible without login Plain text file UserCredentialAuth...onInterface.php.xml Data Auxiliary data

  Files folder image Files  /  build  /  phpdox  /  xml  /  tokens  /  config  
File Role Description
  Accessible without login Plain text file NamedConstant.php.xml Data Auxiliary data

  Files folder image Files  /  build  /  phpdox  /  xml  /  tokens  /  Exception  
File Role Description
  Accessible without login Plain text file UserCredentialException.php.xml Data Auxiliary data

  Files folder image Files  /  build  /  phpdox  /  xml  /  tokens  /  services  
File Role Description
  Accessible without login Plain text file UserCredentialPass...oginService.php.xml Data Auxiliary data

  Files folder image Files  /  docs  
File Role Description
Files folder imagehtml (5 files, 4 directories)

  Files folder image Files  /  docs  /  html  
File Role Description
Files folder imageclasses (5 files, 4 directories)
Files folder imagecss (2 files)
Files folder imageinterfaces (1 file, 1 directory)
Files folder imagesource (2 files, 4 directories)
  Accessible without login Plain text file classes.xhtml Data Auxiliary data
  Accessible without login Plain text file index.xhtml Data Auxiliary data
  Accessible without login Plain text file interfaces.xhtml Data Auxiliary data
  Accessible without login Plain text file namespaces.xhtml Data Auxiliary data
  Accessible without login Plain text file traits.xhtml Data Auxiliary data

  Files folder image Files  /  docs  /  html  /  classes  /  cymapgt_core_application_authentication_UserCredential_abstractclass_UserCredentialAbstract  
File Role Description
  Accessible without login Plain text file canChangePassword.xhtml Data Auxiliary data
  Accessible without login Plain text file getBaseEntropy.xhtml Data Auxiliary data
  Accessible without login Plain text file getBaseEntropyOverride.xhtml Data Auxiliary data
  Accessible without login Plain text file getBasePasswordPolicy.xhtml Data Auxiliary data
  Accessible without login Plain text file getPasswordEntropyDescription.xhtml Data Auxiliary data
  Accessible without login Plain text file getPasswordLengthDescription.xhtml Data Auxiliary data
  Accessible without login Plain text file getPasswordPolicyDescription.xhtml Data Auxiliary data
  Accessible without login Plain text file getUdfEntropy.xhtml Data Auxiliary data
  Accessible without login Plain text file getUdfPasswordPolicy.xhtml Data Auxiliary data
  Accessible without login Plain text file passwordStrength.xhtml Data Auxiliary data
  Accessible without login Plain text file setBaseEntropyOverride.xhtml Data Auxiliary data
  Accessible without login Plain text file setUdfEntropy.xhtml Data Auxiliary data
  Accessible without login Plain text file setUdfPasswordPolicy.xhtml Data Auxiliary data
  Accessible without login Plain text file validateConsecutiveCharacterRepeat.xhtml Data Auxiliary data
  Accessible without login Plain text file validateEntropy.xhtml Data Auxiliary data
  Accessible without login Plain text file validateLength.xhtml Data Auxiliary data
  Accessible without login Plain text file validatePolicy.xhtml Data Auxiliary data
  Accessible without login Plain text file validatePolicyAtChange.xhtml Data Auxiliary data
  Accessible without login Plain text file _canChangePassword.xhtml Data Auxiliary data
  Accessible without login Plain text file _getBaseEntropy.xhtml Data Auxiliary data
  Accessible without login Plain text file _getBaseEntropyOverride.xhtml Data Auxiliary data
  Accessible without login Plain text file _getBasePasswordPolicy.xhtml Data Auxiliary data
  Accessible without login Plain text file _getPasswordCharac...atDescription.xhtml Data Auxiliary data
  Accessible without login Plain text file _getPasswordEntropyDescription.xhtml Data Auxiliary data
  Accessible without login Plain text file _getPasswordLengthDescription.xhtml Data Auxiliary data
  Accessible without login Plain text file _getPasswordPolicyDescription.xhtml Data Auxiliary data
  Accessible without login Plain text file _getUdfEntropy.xhtml Data Auxiliary data
  Accessible without login Plain text file _getUdfPasswordPolicy.xhtml Data Auxiliary data
  Accessible without login Plain text file _initialize.xhtml Data Auxiliary data
  Accessible without login Plain text file _initializeBaseEntropy.xhtml Data Auxiliary data
  Accessible without login Plain text file _initializeBasePasswordPolicy.xhtml Data Auxiliary data
  Accessible without login Plain text file _initializeProfile.xhtml Data Auxiliary data
  Accessible without login Plain text file _regexBuildPattern.xhtml Data Auxiliary data
  Accessible without login Plain text file _setBaseEntropyOverride.xhtml Data Auxiliary data
  Accessible without login Plain text file _setUdfEntropy.xhtml Data Auxiliary data
  Accessible without login Plain text file _setUdfPasswordPolicy.xhtml Data Auxiliary data
  Accessible without login Plain text file _validateConsecuti...aracterRepeat.xhtml Data Auxiliary data
  Accessible without login Plain text file _validateEntropy.xhtml Data Auxiliary data
  Accessible without login Plain text file _validateLength.xhtml Data Auxiliary data
  Accessible without login Plain text file _validatePolicy.xhtml Data Auxiliary data
  Accessible without login Plain text file _validatePolicyAtChange.xhtml Data Auxiliary data
  Accessible without login Plain text file __construct.xhtml Data Auxiliary data

  Files folder image Files  /  docs  /  html  /  classes  /  cymapgt_core_application_authentication_UserCredential_services_UserCredentialPasswordLoginService  
File Role Description
  Accessible without login Plain text file authenticate.xhtml Data Auxiliary data
  Accessible without login Plain text file getCurrentPassword.xhtml Data Auxiliary data
  Accessible without login Plain text file getCurrentUsername.xhtml Data Auxiliary data
  Accessible without login Plain text file getMultiFactorHandler.xhtml Data Auxiliary data
  Accessible without login Plain text file getMultiFactorStages.xhtml Data Auxiliary data
  Accessible without login Plain text file getPassword.xhtml Data Auxiliary data
  Accessible without login Plain text file getUsePassword.xhtml Data Auxiliary data
  Accessible without login Plain text file initialize.xhtml Data Auxiliary data
  Accessible without login Plain text file setCurrentPassword.xhtml Data Auxiliary data
  Accessible without login Plain text file setCurrentUsername.xhtml Data Auxiliary data
  Accessible without login Plain text file setMultiFactor.xhtml Data Auxiliary data
  Accessible without login Plain text file setMultiFactorHandler.xhtml Data Auxiliary data
  Accessible without login Plain text file setMultiFactorStages.xhtml Data Auxiliary data
  Accessible without login Plain text file setPassword.xhtml Data Auxiliary data
  Accessible without login Plain text file setUsePassword.xhtml Data Auxiliary data
  Accessible without login Plain text file __construct.xhtml Data Auxiliary data

  Files folder image Files  /  docs  /  html  /  classes  /  cymapgt_core_application_authentication_UserCredential_UserCredentialManager  
File Role Description
  Accessible without login Plain text file canChangePassword.xhtml Data Auxiliary data
  Accessible without login Plain text file getBaseEntropy.xhtml Data Auxiliary data
  Accessible without login Plain text file getBaseEntropyOverride.xhtml Data Auxiliary data
  Accessible without login Plain text file getBasePasswordPolicy.xhtml Data Auxiliary data
  Accessible without login Plain text file getPasswordEntropyDescription.xhtml Data Auxiliary data
  Accessible without login Plain text file getPasswordLengthDescription.xhtml Data Auxiliary data
  Accessible without login Plain text file getPasswordPolicyDescription.xhtml Data Auxiliary data
  Accessible without login Plain text file getUdfEntropy.xhtml Data Auxiliary data
  Accessible without login Plain text file getUdfPasswordPolicy.xhtml Data Auxiliary data
  Accessible without login Plain text file setBaseEntropyOverride.xhtml Data Auxiliary data
  Accessible without login Plain text file setUdfEntropy.xhtml Data Auxiliary data
  Accessible without login Plain text file setUdfPasswordPolicy.xhtml Data Auxiliary data
  Accessible without login Plain text file validateConsecutiveCharacterRepeat.xhtml Data Auxiliary data
  Accessible without login Plain text file validateEntropy.xhtml Data Auxiliary data
  Accessible without login Plain text file validateLength.xhtml Data Auxiliary data
  Accessible without login Plain text file validatePolicy.xhtml Data Auxiliary data
  Accessible without login Plain text file validatePolicyAtChange.xhtml Data Auxiliary data
  Accessible without login Plain text file __construct.xhtml Data Auxiliary data

  Files folder image Files  /  docs  /  html  /  classes  /  Exception  
File Role Description
  Accessible without login Plain text file getCode.xhtml Data Auxiliary data
  Accessible without login Plain text file getFile.xhtml Data Auxiliary data
  Accessible without login Plain text file getLine.xhtml Data Auxiliary data
  Accessible without login Plain text file getMessage.xhtml Data Auxiliary data
  Accessible without login Plain text file getPrevious.xhtml Data Auxiliary data
  Accessible without login Plain text file getTrace.xhtml Data Auxiliary data
  Accessible without login Plain text file getTraceAsString.xhtml Data Auxiliary data
  Accessible without login Plain text file __clone.xhtml Data Auxiliary data
  Accessible without login Plain text file __construct.xhtml Data Auxiliary data
  Accessible without login Plain text file __toString.xhtml Data Auxiliary data

  Files folder image Files  /  docs  /  html  /  css  
File Role Description
  Accessible without login Plain text file source.css Data Auxiliary data
  Accessible without login Plain text file style.css Data Auxiliary data

  Files folder image Files  /  docs  /  html  /  interfaces  /  cymapgt_core_application_authentication_UserCredential_abstractclass_UserCredentialAuthenticationInterface  
File Role Description
  Accessible without login Plain text file authenticate.xhtml Data Auxiliary data
  Accessible without login Plain text file getCurrentPassword.xhtml Data Auxiliary data
  Accessible without login Plain text file getCurrentUsername.xhtml Data Auxiliary data
  Accessible without login Plain text file getMultiFactorHandler.xhtml Data Auxiliary data
  Accessible without login Plain text file getMultiFactorStages.xhtml Data Auxiliary data
  Accessible without login Plain text file getPassword.xhtml Data Auxiliary data
  Accessible without login Plain text file getUsePassword.xhtml Data Auxiliary data
  Accessible without login Plain text file initialize.xhtml Data Auxiliary data
  Accessible without login Plain text file setCurrentPassword.xhtml Data Auxiliary data
  Accessible without login Plain text file setCurrentUsername.xhtml Data Auxiliary data
  Accessible without login Plain text file setMultiFactor.xhtml Data Auxiliary data
  Accessible without login Plain text file setMultiFactorHandler.xhtml Data Auxiliary data
  Accessible without login Plain text file setMultiFactorStages.xhtml Data Auxiliary data
  Accessible without login Plain text file setPassword.xhtml Data Auxiliary data
  Accessible without login Plain text file setUsePassword.xhtml Data Auxiliary data

  Files folder image Files  /  docs  /  html  /  source  
File Role Description
Files folder imageabstractclass (3 files)
Files folder imageconfig (2 files)
Files folder imageException (2 files)
Files folder imageservices (2 files)
  Accessible without login Plain text file index.xhtml Data Auxiliary data
  Accessible without login Plain text file UserCredentialManager.php.xhtml Data Auxiliary data

  Files folder image Files  /  docs  /  html  /  source  /  abstractclass  
File Role Description
  Accessible without login Plain text file index.xhtml Data Auxiliary data
  Accessible without login Plain text file UserCredentialAbstract.php.xhtml Data Auxiliary data
  Accessible without login Plain text file UserCredentialAuth...Interface.php.xhtml Data Auxiliary data

  Files folder image Files  /  docs  /  html  /  source  /  config  
File Role Description
  Accessible without login Plain text file index.xhtml Data Auxiliary data
  Accessible without login Plain text file NamedConstant.php.xhtml Data Auxiliary data

  Files folder image Files  /  docs  /  html  /  source  /  Exception  
File Role Description
  Accessible without login Plain text file index.xhtml Data Auxiliary data
  Accessible without login Plain text file UserCredentialException.php.xhtml Data Auxiliary data

  Files folder image Files  /  docs  /  html  /  source  /  services  
File Role Description
  Accessible without login Plain text file index.xhtml Data Auxiliary data
  Accessible without login Plain text file UserCredentialPass...inService.php.xhtml Data Auxiliary data

  Files folder image Files  /  images  
File Role Description
  Accessible without login Image file bg_hr.png Icon Icon image
  Accessible without login Image file blacktocat.png Icon Icon image
  Accessible without login Image file icon_download.png Icon Icon image
  Accessible without login Image file sprite_download.png Icon Icon image

  Files folder image Files  /  javascripts  
File Role Description
  Accessible without login Plain text file main.js Data Auxiliary data

  Files folder image Files  /  lib  
File Role Description
Files folder imageMultiotp (23 files, 9 directories)

  Files folder image Files  /  lib  /  Multiotp  
File Role Description
Files folder imageconfig (1 file)
Files folder imagecontrib (37 files)
Files folder imagelauncher (4 files)
Files folder imagelog (1 file)
Files folder imageoath (10 files)
Files folder imageqrcode (3 files, 2 directories)
Files folder imagetemplates (4 files)
Files folder imagetokens (25 files)
Files folder imageusers (3 files)
  Accessible without login Plain text file 4.3.2.6 Data Auxiliary data
  Accessible without login Plain text file check.multiotp.class.php Example Example script
  Plain text file checkmultiotp.cmd Class Class source
  Accessible without login Plain text file CODE_OF_CONDUCT.md Data Auxiliary data
  Accessible without login Plain text file COPYING Data Auxiliary data
  Accessible without login Plain text file COPYING.LESSER Data Auxiliary data
  Accessible without login Plain text file md5.js Data Auxiliary data
  Plain text file multiotp.class.php Class Class source
  Accessible without login Plain text file multiotp.cli.header.php Example Example script
  Accessible without login Plain text file multiotp.cli.proxy.php Aux. Auxiliary script
  Plain text file multiotp.php Class Class source
  Accessible without login Plain text file multiotp.server.php Example Example script
  Accessible without login Plain text file multiotp.wsdl Data Auxiliary data
  Accessible without login Plain text file radius_debug.cmd Data Auxiliary data
  Accessible without login Plain text file radius_install.cmd Data Auxiliary data
  Accessible without login Plain text file radius_uninstall.cmd Data Auxiliary data
  Accessible without login Plain text file README.md Doc. Documentation
  Accessible without login Plain text file readme_4.3.2.6.txt Doc. Documentation
  Accessible without login Plain text file readme_5.1.1.2.txt Doc. Documentation
  Accessible without login Plain text file test-tokens.csv Data Auxiliary data
  Accessible without login Plain text file webservice_install.cmd Data Auxiliary data
  Accessible without login Plain text file webservice_uninstall.cmd Data Auxiliary data
  Accessible without login Plain text file _config.yml Data Auxiliary data

  Files folder image Files  /  lib  /  Multiotp  /  config  
File Role Description
  Accessible without login Plain text file multiotp.ini Data Auxiliary data

  Files folder image Files  /  lib  /  Multiotp  /  contrib  
File Role Description
  Plain text file AES.php Class Class source
  Plain text file ASN1.php Class Class source
  Plain text file Base.php Class Class source
  Plain text file BigInteger.php Class Class source
  Plain text file Blowfish.php Class Class source
  Plain text file DES.php Class Class source
  Plain text file FUNC4.php Class Class source
  Plain text file FUNC5.php Class Class source
  Plain text file Hash.php Class Class source
  Plain text file MAIL4.php Class Class source
  Plain text file MAIL5.php Class Class source
  Plain text file MIME4.php Class Class source
  Plain text file MIME5.php Class Class source
  Plain text file MultiotpAdLdap.php Class Class source
  Plain text file MultiotpAspSms.php Class Class source
  Plain text file MultiotpClickatell.php Class Class source
  Plain text file MultiotpIntelliSms.php Class Class source
  Accessible without login Plain text file MultiotpQrcode.php Aux. Auxiliary script
  Accessible without login Plain text file MultiotpShowStatus.php Aux. Auxiliary script
  Plain text file MultiotpSyslog.php Class Class source
  Plain text file MultiotpTools.php Class Class source
  Plain text file MultiotpXmlParser.php Class Class source
  Plain text file MultiotpYubikey.php Class Class source
  Plain text file nusoap.php Class Class source
  Accessible without login Plain text file Random.php Example Example script
  Plain text file RC2.php Class Class source
  Plain text file RC4.php Class Class source
  Plain text file Rijndael.php Class Class source
  Plain text file RSA.php Class Class source
  Plain text file SFTP.php Class Class source
  Plain text file SMTP4.php Class Class source
  Plain text file SMTP5.php Class Class source
  Plain text file SSH2.php Class Class source
  Plain text file Stream.php Class Class source
  Plain text file TripleDES.php Class Class source
  Plain text file Twofish.php Class Class source
  Plain text file X509.php Class Class source

  Files folder image Files  /  lib  /  Multiotp  /  launcher  
File Role Description
  Accessible without login Plain text file launcher.cpp Data Auxiliary data
  Accessible without login Plain text file ReadMe.txt Doc. Documentation
  Accessible without login Plain text file stdafx.cpp Data Auxiliary data
  Accessible without login Plain text file stdafx.h Data Auxiliary data

  Files folder image Files  /  lib  /  Multiotp  /  log  
File Role Description
  Accessible without login Plain text file multiotp.log Data Auxiliary data

  Files folder image Files  /  lib  /  Multiotp  /  oath  
File Role Description
  Accessible without login Plain text file pskc-hotp-aes.txt Doc. Documentation
  Accessible without login Plain text file pskc-hotp-pbe.txt Doc. Documentation
  Accessible without login Plain text file pskc-totp-aes.txt Doc. Documentation
  Accessible without login Plain text file pskc-totp-pbe.txt Doc. Documentation
  Accessible without login Plain text file tokens_hotp_aes.pskc Data Auxiliary data
  Accessible without login Plain text file tokens_hotp_pbe.pskc Data Auxiliary data
  Accessible without login Plain text file tokens_ocra_aes.pskc Data Auxiliary data
  Accessible without login Plain text file tokens_ocra_pbe.pskc Data Auxiliary data
  Accessible without login Plain text file tokens_totp_aes.pskc Data Auxiliary data
  Accessible without login Plain text file tokens_totp_pbe.pskc Data Auxiliary data

  Files folder image Files  /  lib  /  Multiotp  /  qrcode  
File Role Description
Files folder imagedata (40 files)
Files folder imageimage (42 files)
  Accessible without login Plain text file .htaccess Data Auxiliary data
  Accessible without login Image file qrHOTP.png Icon Icon image
  Accessible without login Image file qrTOTP.png Icon Icon image

  Files folder image Files  /  lib  /  Multiotp  /  qrcode  /  data  
File Role Description
  Accessible without login Plain text file qrvfr1.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr10.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr11.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr12.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr13.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr14.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr15.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr16.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr17.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr18.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr19.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr2.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr20.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr21.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr22.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr23.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr24.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr25.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr26.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr27.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr28.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr29.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr3.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr30.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr31.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr32.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr33.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr34.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr35.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr36.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr37.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr38.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr39.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr4.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr40.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr5.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr6.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr7.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr8.dat Data Auxiliary data
  Accessible without login Plain text file qrvfr9.dat Data Auxiliary data

  Files folder image Files  /  lib  /  Multiotp  /  qrcode  /  image  
File Role Description
  Accessible without login Image file b.png Icon Icon image
  Accessible without login Image file d.png Icon Icon image
  Accessible without login Image file qrv1.png Icon Icon image
  Accessible without login Image file qrv10.png Icon Icon image
  Accessible without login Image file qrv11.png Icon Icon image
  Accessible without login Image file qrv12.png Icon Icon image
  Accessible without login Image file qrv13.png Icon Icon image
  Accessible without login Image file qrv14.png Icon Icon image
  Accessible without login Image file qrv15.png Icon Icon image
  Accessible without login Image file qrv16.png Icon Icon image
  Accessible without login Image file qrv17.png Icon Icon image
  Accessible without login Image file qrv18.png Icon Icon image
  Accessible without login Image file qrv19.png Icon Icon image
  Accessible without login Image file qrv2.png Icon Icon image
  Accessible without login Image file qrv20.png Icon Icon image
  Accessible without login Image file qrv21.png Icon Icon image
  Accessible without login Image file qrv22.png Icon Icon image
  Accessible without login Image file qrv23.png Icon Icon image
  Accessible without login Image file qrv24.png Icon Icon image
  Accessible without login Image file qrv25.png Icon Icon image
  Accessible without login Image file qrv26.png Icon Icon image
  Accessible without login Image file qrv27.png Icon Icon image
  Accessible without login Image file qrv28.png Icon Icon image
  Accessible without login Image file qrv29.png Icon Icon image
  Accessible without login Image file qrv3.png Icon Icon image
  Accessible without login Image file qrv30.png Icon Icon image
  Accessible without login Image file qrv31.png Icon Icon image
  Accessible without login Image file qrv32.png Icon Icon image
  Accessible without login Image file qrv33.png Icon Icon image
  Accessible without login Image file qrv34.png Icon Icon image
  Accessible without login Image file qrv35.png Icon Icon image
  Accessible without login Image file qrv36.png Icon Icon image
  Accessible without login Image file qrv37.png Icon Icon image
  Accessible without login Image file qrv38.png Icon Icon image
  Accessible without login Image file qrv39.png Icon Icon image
  Accessible without login Image file qrv4.png Icon Icon image
  Accessible without login Image file qrv40.png Icon Icon image
  Accessible without login Image file qrv5.png Icon Icon image
  Accessible without login Image file qrv6.png Icon Icon image
  Accessible without login Image file qrv7.png Icon Icon image
  Accessible without login Image file qrv8.png Icon Icon image
  Accessible without login Image file qrv9.png Icon Icon image

  Files folder image Files  /  lib  /  Multiotp  /  templates  
File Role Description
  Accessible without login HTML file scratchtemplate.html Doc. Documentation
  Accessible without login HTML file scratchtemplate_fr.html Doc. Documentation
  Accessible without login HTML file template.html Doc. Documentation
  Accessible without login HTML file template_fr.html Doc. Documentation

  Files folder image Files  /  lib  /  Multiotp  /  tokens  
File Role Description
  Accessible without login Plain text file abcdef012300.db Data Auxiliary data
  Accessible without login Plain text file abcdef012301.db Data Auxiliary data
  Accessible without login Plain text file abcdef012302.db Data Auxiliary data
  Accessible without login Plain text file mu2f5a34b53360.db Data Auxiliary data
  Accessible without login Plain text file mu2f5a34d8d5da.db Data Auxiliary data
  Accessible without login Plain text file mu2f5a355a8315.db Data Auxiliary data
  Accessible without login Plain text file mu2f5a357996c1.db Data Auxiliary data
  Accessible without login Plain text file mu2f5a35808a27.db Data Auxiliary data
  Accessible without login Plain text file rhossis.db Data Auxiliary data
  Accessible without login Plain text file test_token.db Data Auxiliary data
  Accessible without login Plain text file test_token8.db Data Auxiliary data
  Accessible without login Plain text file yebo.db Data Auxiliary data
  Accessible without login Plain text file yebo32.db Data Auxiliary data
  Accessible without login Plain text file zz0000000002.db Data Auxiliary data
  Accessible without login Plain text file zz1000000000.db Data Auxiliary data
  Accessible without login Plain text file zz1000000001.db Data Auxiliary data
  Accessible without login Plain text file zz1000000002.db Data Auxiliary data
  Accessible without login Plain text file zz1100000000.db Data Auxiliary data
  Accessible without login Plain text file zz1100000001.db Data Auxiliary data
  Accessible without login Plain text file zz7000000000.db Data Auxiliary data
  Accessible without login Plain text file zz7000000001.db Data Auxiliary data
  Accessible without login Plain text file zz7000000002.db Data Auxiliary data
  Accessible without login Plain text file zz8000000000.db Data Auxiliary data
  Accessible without login Plain text file zz8000000001.db Data Auxiliary data
  Accessible without login Plain text file zz8000000002.db Data Auxiliary data

  Files folder image Files  /  lib  /  Multiotp  /  users  
File Role Description
  Accessible without login Plain text file test_user.db Data Auxiliary data
  Accessible without login Plain text file test_user2.db Data Auxiliary data
  Accessible without login Plain text file test_user8.db Data Auxiliary data

  Files folder image Files  /  plugins  
File Role Description
Files folder imageopenbiz-cubi (1 file)

  Files folder image Files  /  plugins  /  openbiz-cubi  
File Role Description
  Plain text file usercredentialService.php Class Package plugin for Openbiz-Cubi PHP framework

  Files folder image Files  /  src  
File Role Description
Files folder imageabstractclass (3 files)
Files folder imageauthentication (1 directory)
Files folder imageconfig (1 file)
Files folder imageConfig (1 file)
Files folder imageException (1 file)
Files folder imageservices (3 files)
Files folder imagetraits (3 files)
  Plain text file UserCredentialManager.php Class Activate Github sync

  Files folder image Files  /  src  /  abstractclass  
File Role Description
  Plain text file MultiotpWrapper.php Class Add MultiOTP wrapper and SMS Token 2 factor authentication service
  Accessible without login Plain text file UserCredentialAbstract.php Example Activate Github sync
  Plain text file UserCredentialAuth...cationInterface.php Class Activate Github sync

  Files folder image Files  /  src  /  authentication  
File Role Description
Files folder imageUserCredential (1 file, 2 directories)

  Files folder image Files  /  src  /  authentication  /  UserCredential  
File Role Description
Files folder imageabstractclass (2 files)
Files folder imageservices (1 file)
  Plain text file UserCredentialManager.php Class Concrete implementation of the UserCredentialManager (The Password Policy Manager)

  Files folder image Files  /  src  /  authentication  /  UserCredential  /  abstractclass  
File Role Description
  Plain text file UserCredentialAbstract.php Class Implements base logic of the class
  Plain text file UserCredentialAuth...cationInterface.php Class Interface for concrete service classes

  Files folder image Files  /  src  /  authentication  /  UserCredential  /  services  
File Role Description
  Plain text file UserCredentialPasswordLoginService.php Class Password only implementation of the Login Interface (Others go here e.g. MulitOTP, LDAP)

  Files folder image Files  /  src  /  config  
File Role Description
  Plain text file NamedConstant.php Class Activate Github sync

  Files folder image Files  /  src  /  Config  
File Role Description
  Accessible without login Plain text file NamedConstant.php Aux. Defines named constants

  Files folder image Files  /  src  /  Exception  
File Role Description
  Plain text file UserCredentialException.php Class Exception class for the service

  Files folder image Files  /  src  /  services  
File Role Description
  Plain text file UserCredentialGoogleAuthLoginService.php Class Class source
  Plain text file UserCredentialPasswordLoginService.php Class Activate Github sync
  Plain text file UserCredentialSmsTokenLoginService.php Class Add MultiOTP wrapper and SMS Token 2 factor authentication service

  Files folder image Files  /  src  /  traits  
File Role Description
  Plain text file UserCredentialAuth...cationLdapTrait.php Class Class source
  Plain text file UserCredentialAuth...tionNativeTrait.php Class Class source
  Plain text file UserCredentialAuthenticationTrait.php Class Class source

  Files folder image Files  /  stylesheets  
File Role Description
  Accessible without login Plain text file github-light.css Data Auxiliary data
  Accessible without login Plain text file stylesheet.css Data Auxiliary data

  Files folder image Files  /  tests  
File Role Description
Files folder imageauthentication (1 directory)
Files folder imagefiles (5 files)
Files folder imagesrc (2 directories)
  Plain text file UserCredentialManagerTest.php Class Activate Github sync

  Files folder image Files  /  tests  /  authentication  
File Role Description
Files folder imageUserCredential (1 file, 1 directory)

  Files folder image Files  /  tests  /  authentication  /  UserCredential  
File Role Description
Files folder imageservices (1 file)
  Accessible without login Plain text file UserCredentialManagerTest.php Test Unit test for UserCredentialManager class

  Files folder image Files  /  tests  /  authentication  /  UserCredential  /  services  
File Role Description
  Accessible without login Plain text file UserCredentialPass...oginServiceTest.php Test Unit test for Password only implementation of the service

  Files folder image Files  /  tests  /  files  
File Role Description
  Accessible without login Plain text file bootstrap.php Test Activate Github sync
  Plain text file FreeDsxLdapServer.php Class Class source
  Plain text file Google2FA.php Class Class source
  Plain text file LdapRequestHandler.php Class Class source
  Accessible without login Plain text file phpunit.xml Lic. Activate Github sync

  Files folder image Files  /  tests  /  src  
File Role Description
Files folder imageabstractclass (1 file)
Files folder imageservices (3 files)

  Files folder image Files  /  tests  /  src  /  abstractclass  
File Role Description
  Plain text file UserCredentialAuth...cationTraitTest.php Class Class source

  Files folder image Files  /  tests  /  src  /  services  
File Role Description
  Plain text file UserCredentialGoog...oginServiceTest.php Class Class source
  Accessible without login Plain text file UserCredentialPass...oginServiceTest.php Test Add MultiOTP wrapper and SMS Token 2 factor authentication service
  Accessible without login Plain text file UserCredentialSmsT...oginServiceTest.php Test Add MultiOTP wrapper and SMS Token 2 factor authentication service

 Version Control Unique User Downloads Download Rankings  
 96%
Total:1,317
This week:8
All time:2,881
This week:46Up
 User Ratings  
 
 All time
Utility:100%StarStarStarStarStarStar
Consistency:100%StarStarStarStarStarStar
Documentation:75%StarStarStarStar
Examples:56%StarStarStar
Tests:75%StarStarStarStar
Videos:-
Overall:80%StarStarStarStarStar
Rank:16