Overview

When it comes to multi-factor authentication (MFA), users have different preferences and needs. Some rely on email OTPs, others prefer using authenticator apps, and some may find push notifications more convenient. The client wanted to secure user logins while giving each user the freedom to choose how they authenticate, every time they log in.

Prerequisites

This use case has been seamlessly implemented using the plugins listed below. To achieve this, you will need to install these plugins on your Joomla instance.

miniOrange MFA Extension for Joomla

Validate your users with our powerful Joomla MFA/Two-Factor Authentication (TFA) extension.

Download Extension

Challenge

The client needed strong MFA protection but didn’t want to restrict users to just one method. Instead, they wanted a system where users could set up multiple MFA options and select their preferred one at the time of login, based on what’s most convenient at that moment.

Solution

We helped implement a flexible MFA system using the miniOrange Multi-Factor Authentication (MFA) extension for Joomla. This setup allows each user to:

• Configure multiple MFA methods in their account
• Choose any of those methods during the login process

For example, a user might use push notifications while at their desk and switch to email OTP when traveling.

Implementation

With multi-method MFA Support, users can configure multiple verification methods for their accounts. Each user can set up more than one of the following options:

• Authenticator App (TOTP)
• OTP via Email
• OTP via SMS
• Push Notification
• Backup Codes

During the login process, after entering their username and password, users are presented with a screen displaying all their configured MFA methods. They can then select their preferred method. For example, a user might choose to push notifications while at the office and an email OTP while traveling.

Administrators can still enforce minimum MFA requirements, such as ensuring that every user has at least two methods set up. However, the choice of which method to use during login is entirely up to the user.

Benefits

• User Flexibility: Users aren’t locked into one method—they choose what works best at the time of login.
• Fewer Login Failures: If one method isn’t available (e.g., dead phone battery or no mobile network), users can still log in using another.
• Stronger Security: Users are still protected by MFA, regardless of the method they choose.
• Lower Support Burden: Fewer users get locked out or raise support tickets for authentication issues.

Result

This solution provided both security and user flexibility. Users no longer had to depend on a single method of multi-factor authentication (MFA). Even if their phone was out of battery or they were in an area with poor network coverage, they could still log in using an alternative method. This approach reduced login failures, minimized support requests, and gave users a smoother, more personalized experience.

Additional Resources

1. Multi-Factor Authentication for Joomla
2. OTP Verification for Joomla