![]() Note these seeds cannot be encrypted at this stage. The attribute itself must supply one or more string values containing the Base32-encoded token seed(s) to try and validate the supplied code against. Since the attribute name really shouldn't matter much, leaving it defaulted is usually the best choice but if you want to set the property you can put it in any of the existing property files, advisedly the conf/authn/authn.properties file added in V4.1. ![]() The default behavior of the flow is to perform a special attribute resolution step to resolve an attribute named by the property, defaulting to "tokenSeeds". There are two implementations provided, as described below. This plugin supports a public interface to obtain the token seeds for a specific user at runtime. ![]() Because of this, the flow is installed by default as supporting non-browser use, though if the header is missing there is no user interface to ask for one. So you would need to add that to your own conf/messages.properties file or just inline the label.įinally, for non-browser use, it's also possible to supply the code in a request header, "X-Shibboleth-TOTP" by default, also controllable with a property. One note about this: because of the way Spring messages work, unfortunately putting the input field on the Password collection view will not allow use of any Spring message identifiers that are pre-installed with this module, namely "" for the field label. With this approach, the same underlying configuration is used but the flow will try and locate the form field before displaying the second view, and if for some reason the code fails, it will simply fall back to the second view to reprompt for the code. The name of the input field is "tokencode" by default but is controllable with the property. This would perhaps be appropriate in cases when you impose TOTP as a second factor to all requests. This is designed to work out of the box with a simple "Password flow, then TOTP flow" MFA configuration, much as the Duo flow works.Īs an alternative, you may choose to "collapse" the collection process so that the Password login form includes the input field to collect the token code. User InterfaceĪfter installation, a view (with some error handling examples) is provided to support a "two-stage" user interface where the token code is collected after an initial factor is completed that will supply the username to this flow. This is assumed to be the Attribute Resolver in most "real" cases, but it's also possible to define some static tokens for testing in a Spring configuration file (e.g., conf/global.xml). Other than the user interface, which is fairly self-explanatory, the only configuration required is to define how to resolve token seeds to use while validating a particular subject's token codes. Shell script for testing token code validationīatch script for testing token code validation View template for reporting errors with code validation View template for dedicated prompt for token code Taken together, this plugin is probably best viewed as either a feature for local extension or as a tool for some limited kinds of deployments where tokens can be managed by hand in some way much as SSH keys often are by small teams. An extension point does exist for providing alternative token sources, but this interface is not at this time a public API so should be viewed as unstable. The default implementation provides a couple of options for looking up token seeds for subjects, a static/dummy option for testing and making use of the IdP's Attribute Resolver service to look up (and optionally decrypt) token information at runtime. There is no support for enrollment of users and tokens or for managing those enrollments. There are some limitations to understand about this add-on: In either case, the identity of the subject used to resolve token seeds is generally based on an earlier authentication step. ![]() It can be used to piggyback on the existing Password flow's login form view, with an additional field to collect the token code, or it can be run separately with a dedicated view, usually via the IdP's Multi-Factor Authentication feature. Any software or hardware token supporting the TOTP algorithm should work. The TOTP plugin provides a login flow that implements a bare-bones form of support for TOTP OATH tokens. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |