Overview

Passwordless authentication is an improved approach to online security that eliminates the need for traditional passwords. Instead of relying on memorized passwords, passwordless authentication uses a variety of unique authentication methods that are specific to the user. These authentication methods include TOTP, OTP via SMS/email, push notifications, and biometrics. By using these alternative methods, passwordless authentication provides a more secure and convenient way to log in to Joomla.

Prerequisites:

In this section, we’ll discuss everything from requirements and implementation process to results.

• Key Requirements:

miniOrange 2FA plugin

Download Plugin

miniOrange Passwordless add-on

Contact US

Scenario

The client was seeking a way for their users to access their website using Joomla registration with only a username or email, and not requiring a password. The goal was to allow their clients to access their site while simplifying the login process and eliminating the need to remember passwords.

Implementation

The login process will differ from the traditional method. Instead of entering both a username and password, users will only need to provide their username or phone number. Site owners can implement various alternative authentication methods, such as Time-based One-Time Passwords (TOTP), One-Time Passwords (OTP) sent via SMS or email, push notifications, and biometric verification, to confirm and authenticate users.

For registered users, after submitting the username or phone number, the two-factor authentication (2FA) is activated, and a one-time password (OTP) is sent via the configured 2FA method, which can include OTP over SMS, OTP over email, OTP over a phone call, or a combination of SMS and email. Depending on the configuration, 2FA activation can also involve a combination of two methods to enhance security.

For unregistered users, there is a simple inline user registration process. This allows users to set their preferred 2FA method during their first login, eliminating the need for the administrator to configure 2FA for all users. This gives users the freedom to choose their preferred 2FA method.

Benefit

We have simplified the login process for users by implementing a passwordless login system with the miniOrange 2FA plugin and a custom add-on. This has allowed secure and effortless access to our Joomla-based private project. Our approach eliminates the need to remember complex passwords and provides a flexible and secure authentication method through 2FA.