Package: django-simplemfa
django-simplemfaAn implementation of basic Multi-Factor Authentication (MFA) functionality for Django applications (phone call, text message, and email).Now available on PyPI(pip install django-simplemfa)OverviewThe intent of this project is to:Provide essential MFA functionality for new and existing Django applications.Limit external (outside Django) dependencies wherever feasible.Simplify the setup and integration of MFA functionality in Django applications.At this time only email, phone call, and text message MFA options are supported. Future integrations (such as MS/Google Authenticator apps, OTP keys, WebAuthn, etc.) are possible.Why It ExistsUpon evaluating various other Django MFA applications, most appeared to be one or more of the following:Their codebases were deprecated or unsupported.They often required a substantial amount of very specific dependencies in order to achieve even basic functionality.They often required substantial changes to existing applications to function and integrate properly.Basic RequirementsDjango >= version 3.0Django-Twilio (if using phone and/or text message MFA)Twilio is the current integration for phone and text message MFA, but more are planned.
Email MFA leverages the built-in Django email utilities.Setup and UseDownload or clone thesimplemfapackage here or install from PyPi withpip install django-simplemfa.In yourtemplatesdirectory:Create a new directory called 'simplemfa' and in it place or create the following templates:simplemfa/mfa_email.html(the MFA email message template)simplemfa/mfa_text.html(the MFA text message template)simplemfa/mfa_voice.html(plain text file with the message you want to send via phone call)simplemfa/auth.html(the MFA login screen template)Examples are provided in the package'stemplatesdirectory (simplemfa/templates).In yoururls.py:Addpath('mfa/', include('simplemfa.urls', namespace="simplemfa"))to your routes, making sure to include the namespace as shown.In yoursettings.py:Required Settings:Required:REQUIRE_MFA = True(global setting which activates MFA for all users)Required: Ensure the Djangoemail system is configured properlyRequired:INSTALLED_APPS = [ ... 'simplemfa' ]Required:MIDDLEWARE = [ ... 'simplemfa.middleware.ValidateMFAMiddleware' ]If using Twilio (text and voice):Required: Install and set updjang-twilioRequired:MFA_USER_PHONE_ATTRIBUTE(the attribute ofrequest.userthat has the phone number for the user in the format+12345678900, e.g.profile.phoneresolves torequest.user.profile.phone)Required:MFA_USER_MODE_ATTRIBUTE(the attribute ofrequest.userthat has the user's default way of receiving the MFA code, e.g.profile.mfa_moderesolves torequest.user.profile.mfa_modewhich must be one of the choices fromsimplemfa.models.AUTH_CODE_DELIVERY_CHOICES- currently "EMAIL", "TEXT", and "PHONE")Optional Settings:Optional:APP_NAME = "My App Name"(application name which is provided in the messages to the user)Optional:MFA_CODE_LENGTH(default is 6)Optional:MFA_CODE_EXPIRATION(default is 900 seconds (15 minutes))Optional:MFA_CODE_DELIVERY_DEFAULT(default is "EMAIL")Once those items are complete, runmakemigrationsthenmigratefor your project.Run your project. That's it!It should allow you to access all public (login exempt) pages. After you log in, however, it will automatically redirect you to the MFA verification page where you will request and then enter an MFA code. If the code passes, you will be allowed to proceed as any normal authenticated user would in your application.NotesA project example is coming shortly.As of right now, MFA is applied globablly in thesettings.pyfile. We are working on changing that to track in a User's settings as part of anMFAProfilemodel attached to the User object.MFA codes sent to users are stored as one-way hashed objects using Django's built-in hashers. It is treated as a password field in the application. The hashes are created and verified using Django's ownmake_password()andcheck_password()functions, respectively. The ONLY time a plain-text MFA code is created in the application is during the sending of the user message to the Twilio API or via email. At no other time are MFA codes rendered or stored as plain text. All MFA codes are destroyed immediately after use or upon expiration (MFA_CODE_EXPIRATION).