README

This plugin adds a "G" button to the Craft Admin login. This simplifies logging in to any CMS set up by Glue-Agency. Works for Local and Remote environments using the Glue Google OAuth proxy (oauth.glue.be).

Requirements

This plugin requires Craft CMS 5.0.0 or later, and PHP 8.2 or later.

Installation

With Composer

Open your terminal and run the following commands

# Require the plugin through composer
composer require glue-agency/craft-glue-auth

# Install the plugin
php craft plugin/install glue-auth

Register the site with the proxy

The proxy only sends a login back to a callback it knows. Add https://<host>/glue-auth/auth/callback to the site's install at https://oauth.glue.be/admin/installs for every host the control panel is reached on: production, staging, each multisite host and every local URL. Matching is exact.

No secret or env var is needed. Sites upgrading from before 5.1.0 can drop GLUE_AUTH_ENCRYPTION_TOKEN and the encryptionToken config.

Configuration

Every setting has a default, so a config file is optional. To override one, create config/glue-auth.php:

<?php

return [
    'createUsers' => false,
];

enabled (default true): show the "G" button, and disable regular login for Glue admin users. false turns both off.
createUsers (default true): allow the plugin to create a new user, as an admin, when a Glue account without a user signs in. Set it to false to refuse an account the site has no user for. A user made by hand still signs in: it is matched on its email the first time, and bound to that Google account from then on.
hostedDomain (default 'glue.be'): the Google Workspace domain an account must belong to. It also decides who counts as a Glue user.
proxyUrl (default 'https://oauth.glue.be'): the OAuth proxy the login goes through.
googleClientId (default: Glue's client id): the Google OAuth client the proxy signs in with.
requireTwoStep (default false): an extra, per-site check that refuses a Google sign-in that did not use 2-Step Verification; the proxy normally enforces it for every site. See below.

Requiring 2-Step Verification

2-Step Verification is enforced at the proxy: with GOOGLE_REQUIRE_TWO_STEP=true on oauth.glue.be, it refuses a sign-in without it on every site at once, whatever version of this plugin (or of the Laravel and Magento packages) it runs, and switching it off again is one .env change there. The proxy's request log names the refused account. From 5.3.1 the plugin recognises that refusal: the login form shows the 2-Step Verification message below instead of "Could not sign in with Google.", and the glue-auth log says the proxy refused it. The plugin never learns the account, so the login history does not list it.

requireTwoStep is an extra check for a site that wants it whatever the proxy does. Google reports how the user last signed in to their Google account in the id_token's amr claim. With requireTwoStep on, a sign-in counts when it lists mfa (a second factor), hwk (a security key) or swk (a passkey), in any order; a password alone, or no amr at all, is refused. Every sign-in's amr and auth_time are written to the glue-auth log, and so is each refusal.

Either way, the user is told: "This site requires 2-Step Verification, and your last Google sign-in did not use it. Sign out of Google, then sign in again with your second step or a passkey."

Both checks only work once all of these are in place, which is why requireTwoStep is off by default:

The proxy asks Google for the claim: GOOGLE_SECURITY_CLAIMS=true on oauth.glue.be (implied by GOOGLE_REQUIRE_TWO_STEP=true).
The Google OAuth client has Authentication strength claims and Session age claims ticked, under Google Auth Platform → Settings → Advanced settings.
The glue.be Workspace enforces 2-Step Verification (Admin console → Security → Authentication → 2-step verification). Otherwise an account without it is refused on every site that requires it.
Allow user to trust the device is off there, or a sign-in on a trusted device may skip the second step and be refused, however often the user signs in again. (Not tested yet.)

amr describes the user's last sign-in to Google in that browser, not this one, and Google cannot be asked to make them sign in again. A Google session that started before 2-Step Verification was turned on keeps reporting a password only: that user is refused until they sign out of Google and back in. A passkey-only sign-in is expected to report swk, but has not been tested yet.

Usage

The CP login page and the session-expired modal get a "G" button that signs in with a Glue Google account.
Regular (password) login is disabled for Glue admin users; they sign in with the "G" button.
Utilities → Glue Auth lists the login history: every Google sign-in, refused ones included with why, whether Google reports 2-Step Verification and by which methods, when the user last signed in to Google, and the IP address. A sign-in that fails before Google vouches for the account is only in the glue-auth log.
Errors are written to their own glue-auth log in storage/logs/.

glue-agency / craft-glue-auth

Package info

Security

Statistics