auth0/auth0-authy-sample-app

Name: auth0-authy-sample-app

Owner: Auth0

Description: This is the sample app for setting up Authy TOTP 2FA with Auth0

Created: 2016-05-31 15:57:16.0

Updated: 2016-08-26 18:24:48.0

Pushed: 2016-08-26 18:22:22.0

Homepage: null

Size: 22

Language: JavaScript

GitHub Committers

User	Most Recent Commit	# Commits

Other Committers

User	Email	Most Recent Commit	# Commits

README

auth0-authy-sample-app

This is the sample app for setting up Authy TOTP 2FA with Auth0

Installation

1. Install Dependencies

   install
   

2. Gather Credentials

3. Your Auth0 domain, client ID, and client secret, obtainable from the Auth0 dashboard

4. Your Auth0 Management API Token

5. A webtask.io account, and your webtask.io profile name: the value of the -p parameter shown at the end of the code in Step 2 of the Account Settings > Webtasks page.

6. Create .env file with:

   0_DOMAIN="[Your Auth0 Domain]"
   0_CLIENT_ID="[Your Auth0 Client ID]"
   0_CLIENT_SECRET="[Your Auth0 Client Secret]"
   0_CALLBACK="http://localhost:3000/callback"
   Y_API_KEY="[Your Authy API Key]"
   0_MANAGEMENT_TOKEN="[Your Auth0 Management API Token]"
   

7. Modify wt-run script

   bin/bash
   
   reate --name authy-mfa --secret authy_api_key=[Your Authy API Key] --secret auth0_secret=[Your Auth0 Client Secret] --secret auth0_clientID=[Your Auth0 Client ID] --secret returnUrl=https://[Your Auth0 domain]/continue --output json --profile [Your Webtask.io Profile Name] authy-mfa-wt.js
   

8. Make wt-run executable

   mod +x wt-run
   

9. install the webtask cli if you haven't already

10. Deploy your webtask:

    wt-run
    

11. modify rule.js

    configuration = {
    IENT_ID: '[Your Auth0 Client ID]',
    IENT_SECRET: '[Your Auth0 Client Secret]',
    SUER: '[Your Auth0 Domain]'
    
    

12. open the rules tab in the dashboard, create a new rule, and paste the modified contents of rule.js into the editor window, and click 'Save'.

13. Run the server

     bin/www
    

14. navigate to http://localhost:3000 in your browser.

Caveat

There is a caveat with this project. If you're going to log into a social provider and use 2FA, you'll need to use your own dev keys with the social connection, or the rule will fail. Using email/password combination works just fine no matter the situation.