Simple 2FA & SSO
Secure your Moodle™ site with professional two-factor authentication and Single Sign-On. Enforce TOTP codes via Google Authenticator, Microsoft Authenticator, or Authy — and let staff log in with a single click via their Google or Microsoft account using built-in OAuth2/OIDC SSO.
See archive-bound Requirements | One-time unlock, lifetime updates
⭐ Why this plugin is unlike anything else available
App-based TOTP two-factor authentication
▸ App-based TOTP 2FA using Google Authenticator, Microsoft Authenticator, Authy or any compatible TOTP app; users enrol by scanning a QR code. The QR code can also be entered manually as a secret if scanning isn't available.
▸ Codes are the standard time-based 6-digit TOTP codes generated by the authenticator app on the user's device — no third-party SMS gateway or email delivery required.
▸ Administrators can exempt specific roles or cohorts. Face-to-face supervisors who log in from a known IP can bypass 2FA; remote learners are always challenged.
Simple 2FA is a professional-grade security plugin for Moodle™ that implements Time-based One-Time Password (TOTP) authentication. It ensures that even if a user's password is stolen, their account remains protected by a second layer of security accessible only through their smartphone.
The Security Gap
- Weak passwords easily guessed
- Phishing attacks steal credentials
- Credential stuffing from other breaches
- Single point of failure for site security
The 2FA Solution
- Industry-standard TOTP protocol
- Role-based mandatory enforcement
- Offline recovery codes for lockouts
- Rate-limited brute force protection
Google Authenticator
The most popular choice for simplicity and reliability.
Microsoft Authenticator
Perfect for institutions using Microsoft 365.
Authy / Others
Compatible with any standard TOTP-compliant app.
Role Enforcement
Make 2FA mandatory for Admins and Teachers while keeping it optional for students.
SSO Compatibility
Optionally bypass 2FA for users logging in via OAuth2/OpenID Connect (Microsoft/Google).
- QR Code generation for easy mobile pairing
- Manual secret key entry for older devices
- Force setup on next login for required roles
Help desk calls for lost phones are the biggest cost of 2FA. Simple 2FA reduces this burden with a robust recovery system:
Recovery Codes
Users are prompted to save 10 unique recovery codes during setup. Each code works exactly once to bypass the 2FA requirement.
Admin Resets
Admins can quickly reset 2FA for individual users through the standard Moodle user profile or the 2FA dashboard.
Single Sign-On (SSO)
Let staff log in with one click via Google or Microsoft — no Moodle password required.
The plugin includes a built-in OAuth2 / OpenID Connect client that adds a "Sign in with Google" or "Sign in with Microsoft" button directly to the Moodle login page. When a user clicks it, they are sent to Google/Microsoft to authenticate, then automatically returned and logged into Moodle — no Moodle password ever needs to be typed.
Account matching
Moodle looks up the user by the email returned from Google/Microsoft. If a matching Moodle account exists, the user is logged in. If not, a new account is auto-provisioned using the SSO profile data.
2FA bypass for SSO users
Users who authenticate via SSO are already verified by Google/Microsoft, so the plugin skips the TOTP prompt for them by default. You can restrict which roles are allowed to use SSO via the SSO Role Access settings.
SSO is optional
SSO is entirely opt-in. If you leave the Client ID and Secret blank in settings, the SSO button simply does not appear on the login page. The 2FA feature works independently with or without SSO configured.
You need a Google Cloud project with an OAuth 2.0 Client ID. This takes about 5 minutes and is free.
Open Google Cloud Console
Go to console.cloud.google.com → select or create a project for your RTO.
Enable the Google+ API (or People API)
APIs & Services → Library → search "Google People API" → Enable.
Create OAuth credentials
APIs & Services → Credentials → Create Credentials → OAuth Client ID → Application type: Web application.
Set the Authorised Redirect URI
Add exactly: https://yourmoodle.edu.au/auth/simple2fa/sso/callback.php — replace the domain with your Moodle URL. Do not add a trailing slash.
Copy Client ID and Client Secret
Google shows both after saving. Keep them — you will paste them into the Moodle plugin settings.
Configure OAuth Consent Screen
APIs & Services → OAuth Consent Screen → set App name, support email, and authorised domain (yourmoodle.edu.au). For internal staff only, set User type to Internal. For students/external, set External and publish the app.
Paste into plugin settings
Site admin → Plugins → Authentication → Simple 2FA → SSO / OAuth2 Configuration → paste Client ID and Client Secret → set Provider to Google → Save.
The redirect URI must match exactly — including https:// and no trailing slash. A mismatch causes Google to reject the login with "redirect_uri_mismatch".
Register an app in Azure Active Directory (Entra ID). Suitable for RTOs using Microsoft 365.
Open Azure Portal
Go to portal.azure.com → Azure Active Directory → App registrations → New registration.
Register the application
Name it (e.g. "Moodle SSO"). Supported account types: choose "Accounts in this organizational directory only" for staff-only, or "Any Azure AD directory" for multi-tenant. Redirect URI: Web → https://yourmoodle.edu.au/auth/simple2fa/sso/callback.php
Copy the Application (Client) ID
Shown on the app Overview page. This is your Client ID.
Create a Client Secret
Certificates & secrets → New client secret → set an expiry → copy the Value immediately (it is only shown once).
Grant API permissions
API permissions → Add a permission → Microsoft Graph → Delegated permissions → add openid, email, profile. Then click "Grant admin consent".
Paste into plugin settings
Site admin → Plugins → Authentication → Simple 2FA → SSO / OAuth2 Configuration → paste Client ID and Client Secret → set Provider to Microsoft → Save.
All SSO settings are under Site admin → Plugins → Authentication → Simple 2FA → SSO / OAuth2 Configuration.
Understanding how SSO and 2FA enforcement combine for each role:
| Scenario | 2FA enforced? | SSO allowed? | Result |
|---|---|---|---|
| Admin — standard login | Yes | n/a | Must enter TOTP code after password |
| Admin — SSO login | Yes | Yes (default) | TOTP skipped — SSO is trusted |
| Admin — SSO login, SSO role OFF | Yes | No | SSO login denied; must use password + TOTP |
| Teacher — 2FA enforced, SSO login | Yes | Yes | TOTP skipped — SSO trusted |
| Teacher — 2FA not enforced, any login | No | Yes | Straight to dashboard either way |
| Student — no 2FA, no SSO config | No | n/a | Normal Moodle login, no prompts |
Simple 2FA is built as a native Moodle Admin Tool (tool_simple2fa).