다중 요소 인증(MFA)

Secure Your App with MFA

Firebase MFA Overview

Prerequisites for MFA

Adding a Phone Factor

Start Phone Enrollment

import com.google.firebase.auth.*;
import com.google.firebase.FirebaseApp;
import java.util.concurrent.TimeUnit;

public class Main {
  public static void main(String[] args) {
    // Assume FirebaseApp is initialized and a user is signed in.
    // FirebaseAuth auth = FirebaseAuth.getInstance();
    // FirebaseUser user = auth.getCurrentUser(); // Must be non-null

    System.out.println("Simulating MFA phone enrollment initiation:");

    // Example PhoneAuthOptions (actual implementation requires Activity context)
    PhoneAuthOptions options = PhoneAuthOptions.newBuilder(FirebaseAuth.getInstance())
        .setPhoneNumber("+16505551234") // User's phone number
        .setTimeout(60L, TimeUnit.SECONDS)
        .setActivity(null) // Use 'this' for Activity context on Android
        .setCallbacks(new PhoneAuthProvider.OnVerificationStateChangedCallbacks() {
            @Override public void onVerificationCompleted(PhoneAuthCredential credential) { /* auto-verified */ }
            @Override public void onVerificationFailed(FirebaseException e) { System.err.println("Failed: " + e.getMessage()); }
            @Override public void onCodeSent(String verificationId, PhoneAuthProvider.ForceResendingToken token) {
                System.out.println("Code sent. Store verificationId: " + verificationId);
                // Prompt user for SMS code here.
            }
        }).build();

    // In a real app: PhoneAuthProvider.verifyPhoneNumber(options);
    System.out.println("SMS verification initiated (simulated).");
  }
}

Verify & Finalize Enrollment

import com.google.firebase.auth.*;

public class Main {
  public static void main(String[] args) {
    // Assume FirebaseApp is initialized and a user is signed in.
    // FirebaseAuth auth = FirebaseAuth.getInstance();
    // FirebaseUser user = auth.getCurrentUser(); // Must be non-null

    String verificationId = "YOUR_VERIFICATION_ID"; // From onCodeSent callback
    String smsCode = "123456"; // User's input

    PhoneAuthCredential credential = PhoneAuthProvider.getCredential(verificationId, smsCode);

    // Enroll the credential as an MFA factor
    // user.multiFactor.enroll(credential)
    //     .addOnCompleteListener(task -> {
    //         if (task.isSuccessful()) {
    //             System.out.println("MFA factor enrolled successfully!");
    //         } else {
    //             System.err.println("MFA factor enrollment failed: " + task.getException().getMessage());
    //         }
    //     });
    System.out.println("MFA enrollment code demonstrated. Actual enrollment is async.");
  }
}

Authenticating with MFA

Respond to MFA Challenge

import com.google.firebase.auth.*;
import java.util.List;

public class Main {
  public static void main(String[] args) {
    // Assume FirebaseApp is initialized.
    // FirebaseAuth auth = FirebaseAuth.getInstance();

    // --- Scenario: After an initial sign-in attempt (e.g., email/password)
    // --- that requires MFA, you would receive a MultiFactorResolver.
    // --- This is a simplified demo.

    System.out.println("Simulating MFA sign-in challenge response:");

    // MultiFactorResolver resolver = ... (obtained from initial sign-in result)
    // For demonstration, let's mock a resolver context.
    // In a real app, you'd get this from a FirebaseAuthException.

    // Example of how you'd get enrolled factors from a resolver
    // List<MultiFactorInfo> factors = resolver.getFactors();
    // if (!factors.isEmpty()) {
    //     MultiFactorInfo selectedFactor = factors.get(0); // Choose one, e.g., phone
    //     if (selectedFactor.getFactorId().equals(PhoneMultiFactorGenerator.FACTOR_ID)) {
    //         // Initiate SMS verification for this factor
    //         // Then, get the SMS code from the user
    //         // String smsCode = "123456";
    //         // PhoneAuthCredential credential = PhoneAuthProvider.getCredential(verificationId, smsCode);
    //         // MultiFactorAssertion assertion = PhoneMultiFactorGenerator.getAssertion(credential);
    //
    //         // auth.signInWithMultiFactorCredential(resolver.resolveSignIn(assertion))
    //         //     .addOnCompleteListener(task -> {
    //         //         if (task.isSuccessful()) {
    //         //             System.out.println("Signed in successfully with MFA!");
    //         //         } else {
    //         //             System.err.println("MFA sign-in failed: " + task.getException().getMessage());
    //         //         }
    //         //     });
    //     }
    // }
    System.out.println("MFA sign-in challenge response simulated. See comments.");
  }
}

View & Unenroll Factors

import com.google.firebase.auth.*;
import java.util.List;

public class Main {
  public static void main(String[] args) {
    // Assume FirebaseApp is initialized and a user is signed in.
    // FirebaseAuth auth = FirebaseAuth.getInstance();
    // FirebaseUser user = auth.getCurrentUser(); // Must be non-null

    if (user != null) {
      System.out.println("Managing MFA factors for user: " + user.getUid());

      // Get enrolled factors
      List<MultiFactorInfo> enrolledFactors = user.getMultiFactor().getEnrolledFactors();
      System.out.println("\nEnrolled factors:");
      if (enrolledFactors.isEmpty()) {
        System.out.println("  No MFA factors enrolled.");
      } else {
        for (MultiFactorInfo factor : enrolledFactors) {
          System.out.println("  - Factor ID: " + factor.getFactorId() + ", Display Name: " + factor.getDisplayName());
          // Example: unenroll the first factor
          // user.getMultiFactor().unenroll(factor)
          //     .addOnCompleteListener(task -> {
          //         if (task.isSuccessful()) {
          //             System.out.println("Factor unenrolled successfully: " + factor.getFactorId());
          //         } else {
          //             System.err.println("Failed to unenroll: " + task.getException().getMessage());
          //         }
          //     });
        }
      }
    } else {
      System.out.println("No user signed in to manage MFA factors.");
    }
  }
}

MFA Quick Check

MFA: Stronger Security