Setting Up Two-Factor Authentication (2FA) in 1C-Bitrix
Even a strong password doesn't guarantee security: phishing, keyloggers, and database leaks are real threats. Two-factor authentication (2FA) in 1C-Bitrix blocks these scenarios: even knowing the password, without a one-time code, entry is impossible. We configure 2FA tailored to your setup: from enabling built-in OTP to custom SMS integration. We guarantee that after implementation, no account takeover will succeed. With over a decade of experience, we have delivered more than 50 2FA projects, including large e-commerce sites and corporate portals. For protection of your projects, contact us for a consultation.
Why One Password Is Not Enough
Even complex passwords can be intercepted via phishing, keyloggers, or database breaches. Microsoft research shows that 99.9% of compromised accounts lacked 2FA. Two-factor authentication adds a second factor—something only the user possesses: a TOTP code from an app or SMS. The TOTP standard is described in RFC 6238—an open standard supported by all modern authenticators.
How Built-in OTP Authentication Works
The 2FA module is part of the main module. Enable it in Settings → Main Module → Two-factor Authentication. Parameters:
- Force use—for selected user groups. Must be enabled for the 'Administrators' group
- Code validity period—standard TOTP: 30 seconds. Do not change without necessity
- Code length—6 or 8 digits
After enabling, the user gets a QR code on next authorization to configure an authenticator app. The secret is stored encrypted in b_user.OTP_SECRET. All popular authenticators are supported: Google Authenticator, Authy, Microsoft Authenticator.
Available 2FA Methods in Bitrix
Bitrix offers two main methods: built-in TOTP and SMS via custom development. Here's a comparison:
| Method | Implementation Complexity | Security | User Convenience |
|---|---|---|---|
| OTP (TOTP) | Low (built-in) | High | High (auto-fill) |
| SMS | Medium (gateway) | Medium (SIM interception) | Medium (manual entry) |
| Backup codes | Requires custom development | High | High (paper codes) |
TOTP codes are 100 times more secure than SMS codes because they are tied to the device, not the SIM card. Attacks on SMS interception (SS7) hardly affect TOTP.
Typical Setup Mistakes
| Mistake | Consequences | Solution |
|---|---|---|
| No reset procedure | Employee loses access to account | Develop an admin-based reset script |
| Enforcing 2FA only for some admins | Others remain vulnerable | Force-enable for all groups with privileges |
| Using weak password hashes | MD5 without salt—easy to crack | Update hashes to bcrypt via main::OnUserLogin |
Detailed authenticator configuration example
After enabling the module, the user sees a QR code. Important: the secret is encrypted using the main module key. If the key is not generated (file /bitrix/secret_key), create it before enabling.Case from Practice
An e-commerce site with $5M/month revenue. An admin account was compromised via password guessing—a weak combination not caught by length restrictions in the old policy. The attacker altered payment details. Loss: $300k in 4 hours. After the incident: enforced 2FA for 'Administrators' and 'Managers' groups, audit of all existing passwords via b_user.PASSWORD for weak hashes (MD5 without salt—old accounts). Additionally, we configured lockout after 5 failed login attempts. Since then, no similar incidents have occurred.
How to Implement 2FA for External Users
If you need to apply 2FA only to a subset of users (e.g., employees but not customers):
- Settings → User Groups → [target group] → Two-factor authentication: Required
- Or programmatically via the
OnAfterUserAuthorizeevent—check the group and redirect to the OTP setup page
The OnOTPCheck event allows extending logic: for example, not requiring a code when accessing from the office IP.
SMS Authentication
Bitrix does not have a built-in SMS gateway for 2FA, but this can be solved via the OnOTPCheck event handler—you can connect any SMS provider (e.g., SMS.ru, SMSC.ru). Implementation: on first login, a code is generated, sent via SMS, and entered by the user. An alternative is modules from the Marketplace for SMS 2FA, if you prefer not to write your own handler. We recommend using TOTP as the primary method and SMS as a backup.
What's Included in the Work
- Audit of current password policy and user groups
- Enabling and configuring built-in OTP authentication
- Custom SMS integration (if required)
- Creating a 2FA reset procedure and backup codes
- Documentation and staff training
- Post-launch support guarantee (2 weeks)
Process
- Analysis—study your configuration, user groups, and requirements
- Design—choose method (OTP, SMS, combined)
- Implementation—configure native tools or develop handlers
- Testing—verify on test accounts, simulate access loss scenarios
- Deployment and documentation
Timeline
Enabling and configuring built-in OTP for all groups—from 2 to 3 hours. With custom SMS integration—from 1 working day. The cost is calculated individually based on complexity and number of groups.
Contact us for a detailed consultation—we will implement 2FA tailored to your business specifics. We have been developing on Bitrix for over a decade and have completed more than 50 2FA projects. We provide a warranty on all work.