Using your authenticator app, please enter the one-time code that you see for APTrust.
+ + {{ if .errorMessage }} +{{ .errorMessage }}
+ {{ end }} + + +How would you like to complete your login?
+
+
+
+
+
Multi-Factor Authentication Required
let csrfToken = "{{ .csrf_token }}" form["two_factor_method"].value = twoFactorMethod - if (twoFactorMethod == "backup") { + if (twoFactorMethod == "totp") { + // form = document.forms["validateTOTP"] + // addCsrf(form, csrfToken) + } else if (twoFactorMethod == "backup") { form["csrf_token"] = null form.method = "get" form.action = "/users/2fa_backup/" @@ -71,7 +90,9 @@Multi-Factor Authentication Required
form.action = "/users/2fa_sms/" } showTwoFactorMessage(twoFactorMethod) - form.submit() + if (twoFactorMethod != "totp") { + form.submit() + } } function addCsrf(form, token) { if (form["csrf_token"] == null) { diff --git a/views/users/setup_authenticator_app.html b/views/users/setup_authenticator_app.html new file mode 100644 index 00000000..a1eb02b8 --- /dev/null +++ b/views/users/setup_authenticator_app.html @@ -0,0 +1,52 @@ +{{ define "users/setup_authenticator_app.html" }} + + +{{ if not .showAsModal }} + {{ template "shared/_header.html" .}} +{{ end }} + +
+
+
+
+
+{{ if not .showAsModal }}
+ {{ template "shared/_footer.html" .}}
+{{ end }}
+
+
+{{ end }}
diff --git a/views/users/validate_totp.html b/views/users/validate_totp.html
new file mode 100644
index 00000000..4cd9780f
--- /dev/null
+++ b/views/users/validate_totp.html
@@ -0,0 +1,46 @@
+{{ define "users/validate_totp.html" }}
+
+
+{{ if not .showAsModal }}
+ {{ template "shared/_header.html" .}}
+{{ end }}
+
+
+
+
+ Set Up Authenticator App
+
+ 
+
+ +
+Using your authenticator app, please scan the QR code displayed below. Then, follow the instructions in your authenticator app. When you're done setting up your authenticator app, click Continue.
+If you cannot or do not wish to continue with the setup, click on the Cancel Setup button.
+ +
+ If you would rather enter a setup key into your app instead of scanning the QR code, please click the Show Setup Key button below.
+ +
+
+ Enter this Setup Key into your authenticator app.
+ Note: Please enter the exact Setup Key with care. Your authenticator app may not show any message or error if the Setup Key is entered incorrectly.
+ In the next step, you will have the opportunity to validate that the authenticator app is set up correctly. If you are having trouble validating in the next step, you will be able to cancel setup and try again.
+ Please do not share the Setup Key with anyone.
+
+ {{ .secVal }}
+
+ +
+
+
+
+
+{{ if not .showAsModal }}
+ {{ template "shared/_footer.html" .}}
+{{ end }}
+
+
+{{ end }}
diff --git a/web/webui/two_factor_controller.go b/web/webui/two_factor_controller.go
index a20e112c..d40f93dc 100644
--- a/web/webui/two_factor_controller.go
+++ b/web/webui/two_factor_controller.go
@@ -1,6 +1,7 @@
package webui
import (
+ "encoding/base64"
"fmt"
"net/http"
"time"
@@ -10,6 +11,8 @@ import (
"github.com/APTrust/registry/forms"
"github.com/APTrust/registry/helpers"
"github.com/gin-gonic/gin"
+ "github.com/pquerna/otp/totp"
+ "github.com/skip2/go-qrcode"
"github.com/stretchr/stew/slice"
)
@@ -99,7 +102,11 @@ func UserTwoFactorVerify(c *gin.Context) {
user := req.CurrentUser
- if method == constants.TwoFactorSMS {
+ if method == constants.TwoFactorTOTP {
+ if OTPTokenIsExpired(user.EncryptedOTPSentAt) {
+ c.Redirect(http.StatusFound, "/users/validate_totp")
+ }
+ } else if method == constants.TwoFactorSMS {
if OTPTokenIsExpired(user.EncryptedOTPSentAt) {
helpers.SetFlashCookie(c, "Your one-time password expired. Please sign in again.")
c.Redirect(http.StatusFound, "/users/sign_out")
@@ -117,7 +124,9 @@ func UserTwoFactorVerify(c *gin.Context) {
// User model needs FailedLogins and LockoutUntil.
// Then we need logic to enforce the lockout.
msg := "Backup code is incorrect. Try again."
- if method == constants.TwoFactorSMS {
+ if method == constants.TwoFactorTOTP {
+ msg = "One-time code is incorrect. Try again."
+ } else if method == constants.TwoFactorSMS {
msg = "One-time password is incorrect. Try again."
}
req.TemplateData["flash"] = msg
@@ -197,6 +206,23 @@ func UserComplete2FASetup(c *gin.Context) {
return
}
+ if prefs.UseAuthenticatorApp() {
+ userCompleteAuthenticatorAppSetup(c, req, prefs)
+ return
+ /* if AbortIfError(c, err) {
+ return
+ }
+ if ok {
+ helpers.SetFlashCookie(c, "Your two-factor setup is complete. Next time you log in, you will need to use your authenticator app and provide a six-digit one-time code to complete the sign-in process.")
+ c.Redirect(http.StatusFound, "/users/my_account")
+ return
+ } else {
+ // User did not approve
+ c.Redirect(http.StatusFound, "/users/sign_out")
+ return
+ } */
+ }
+
if prefs.UseAuthy() {
ok, err := userCompleteAuthySetup(req, prefs)
if AbortIfError(c, err) {
@@ -226,6 +252,7 @@ func UserComplete2FASetup(c *gin.Context) {
helpers.SetFlashCookie(c, "Your phone number has been updated.")
}
}
+
c.Redirect(http.StatusFound, "/users/my_account")
}
@@ -375,6 +402,17 @@ func userCompleteAuthySetup(req *Request, prefs *TwoFactorPreferences) (ok bool,
return ok, err
}
+func userCompleteAuthenticatorAppSetup(c *gin.Context, req *Request, prefs *TwoFactorPreferences) {
+ if prefs.NeedsAuthenticatorAppRegistration() {
+ c.Redirect(http.StatusFound, "/users/generate_totp")
+ return
+ } else if prefs.NeedsAuthenticatorAppConfirmation() {
+ c.Redirect(http.StatusFound, "/users/validate_totp")
+ return
+ }
+ c.Redirect(http.StatusFound, "/users/my_account")
+}
+
func UserCompleteSMSSetup(req *Request) error {
// Send SMS code and redirect to UserConfirmPhone
user := req.CurrentUser
@@ -397,3 +435,93 @@ func OTPTokenIsExpired(tokenSentAt time.Time) bool {
expiration := tokenSentAt.Add(common.Context().Config.TwoFactor.OTPExpiration)
return time.Now().After(expiration)
}
+
+// Generates a QR code that a user can use to set up MFA with any Authenticator App
+// on their device.
+//
+// GET /users/generate_totp
+func UserGenerateTOTP(c *gin.Context) {
+ req := NewRequest(c)
+ user := req.CurrentUser
+ if user.EncryptedAuthAppSecret == "" {
+ // if 1 == 1 {
+ secret, err := totp.Generate(totp.GenerateOpts{
+ Issuer: constants.TOTPSecretIssuer,
+ AccountName: user.Email,
+ })
+ if err != nil {
+ if AbortIfError(c, err) {
+ return
+ }
+ }
+ user.EncryptedAuthAppSecret = secret.Secret()
+ err = user.Save()
+ if AbortIfError(c, err) {
+ return
+ }
+ // req.TemplateData["sec"] = secret // temp - remove
+ }
+ otpURL := fmt.Sprintf("otpauth://totp/%s:%s?secret=%s&issuer=%s", constants.TOTPSecretIssuer, user.Email, user.EncryptedAuthAppSecret, constants.TOTPSecretIssuer)
+ //otpURL := fmt.Sprintf("otpauth://totp/%s:%s?secret=%s&issuer=%s", constants.TOTPSecretIssuer, user.Email, "nonesuch", constants.TOTPSecretIssuer)
+ png, err := qrcode.Encode(otpURL, qrcode.Medium, 256)
+ if err != nil {
+ if AbortIfError(c, err) {
+ return
+ }
+ }
+ otpQRImage := base64.StdEncoding.EncodeToString(png)
+ req.TemplateData["otpQRImage"] = otpQRImage
+ req.TemplateData["secVal"] = user.EncryptedAuthAppSecret
+ // req.TemplateData["secVal"] = "nonesuch"
+ c.HTML(http.StatusOK, "users/setup_authenticator_app.html", req.TemplateData)
+}
+
+// Displays page for user to validate their TOTP using an authenticator app.
+func UserValidateTOTPView(c *gin.Context) {
+ req := NewRequest(c)
+ _, firstConfirm := c.GetQueryMap("firstConfirm")
+ if firstConfirm {
+ req.TemplateData["firstConfirm"] = firstConfirm
+ }
+ c.HTML(http.StatusOK, "users/validate_totp.html", req.TemplateData)
+}
+
+// Validates a TOTP provided by the user from their authenticator app.
+func UserValidateTOTP(c *gin.Context) {
+ req := NewRequest(c)
+ user := req.CurrentUser
+ totpCode := c.PostForm("totpCode")
+ confirming := c.PostForm("firstConfirm")
+ isValid := totp.Validate(totpCode, user.EncryptedAuthAppSecret)
+ // isValid := totp.Validate(totpCode, "nonesuch")
+ if !isValid {
+ req.TemplateData["errorMessage"] = "Oops! That wasn't the right code. Please try again."
+ c.HTML(http.StatusOK, "users/validate_totp.html", req.TemplateData)
+ return
+ } else {
+ // If we've reached here, you've provided a valid code
+ if confirming == "" {
+ // req.CurrentUser.AwaitingSecondFactor = false
+
+ err := req.CurrentUser.Save()
+ if err != nil {
+ if AbortIfError(c, err) {
+ return
+ }
+ }
+ }
+ user.AwaitingSecondFactor = false
+ user.EnabledTwoFactor = true
+ user.ConfirmedTwoFactor = true
+ user.Save()
+ if confirming != "" {
+ helpers.SetFlashCookie(c, "Your two-factor setup is complete. Next time you log in, you'll need to use your authenticator app to enter a one-time password.")
+ c.Redirect(http.StatusFound, "/users/my_account")
+ return
+ } else {
+ helpers.SetFlashCookie(c, "Logged in successfully!")
+ c.Redirect(http.StatusFound, "/dashboard")
+ return
+ }
+ }
+}
diff --git a/web/webui/two_factor_preferences.go b/web/webui/two_factor_preferences.go
index 961975fb..6c59fa07 100644
--- a/web/webui/two_factor_preferences.go
+++ b/web/webui/two_factor_preferences.go
@@ -6,16 +6,19 @@ import (
)
type TwoFactorPreferences struct {
- OldPhone string
- NewPhone string
- OldMethod string
- NewMethod string
- User *pgmodels.User
+ OldPhone string
+ NewPhone string
+ OldMethod string
+ NewMethod string
+ OldAuthAppMethod string
+ NewAuthAppMethod string
+ User *pgmodels.User
}
func NewTwoFactorPreferences(req *Request) (*TwoFactorPreferences, error) {
oldPhone := req.CurrentUser.PhoneNumber
oldMethod := req.CurrentUser.AuthyStatus
+ oldAuthAppMethod := constants.TwoFactorNone // req.CurrentUser.UseAuthenticatorApp
// Get phone and authy data submitted in the form.
user := &pgmodels.User{}
@@ -29,11 +32,13 @@ func NewTwoFactorPreferences(req *Request) (*TwoFactorPreferences, error) {
user.ReformatPhone()
prefs := &TwoFactorPreferences{
- OldPhone: oldPhone,
- NewPhone: user.PhoneNumber,
- OldMethod: oldMethod,
- NewMethod: user.AuthyStatus,
- User: user,
+ OldPhone: oldPhone,
+ NewPhone: user.PhoneNumber,
+ OldMethod: oldMethod,
+ NewMethod: user.AuthyStatus,
+ User: user,
+ OldAuthAppMethod: oldAuthAppMethod,
+ NewAuthAppMethod: constants.TwoFactorNone,
}
return prefs, nil
@@ -47,18 +52,26 @@ func (p *TwoFactorPreferences) MethodChanged() bool {
return p.OldMethod != p.NewMethod
}
+func (p *TwoFactorPreferences) AuthAppMethodChanged() bool {
+ return p.OldAuthAppMethod != p.NewAuthAppMethod
+}
+
func (p *TwoFactorPreferences) NeedsConfirmation() bool {
- return p.PhoneChanged() || p.MethodChanged()
+ return p.PhoneChanged() || p.MethodChanged() || p.AuthAppMethodChanged()
}
func (p *TwoFactorPreferences) NothingChanged() bool {
- return !p.PhoneChanged() && !p.MethodChanged()
+ return !p.PhoneChanged() && !p.MethodChanged() && !p.AuthAppMethodChanged()
}
func (p *TwoFactorPreferences) DoNotUseTwoFactor() bool {
return p.NewMethod == constants.TwoFactorNone
}
+func (p *TwoFactorPreferences) UseAuthenticatorApp() bool {
+ return p.NewMethod == constants.TwoFactorTOTP
+}
+
func (p *TwoFactorPreferences) UseAuthy() bool {
return p.NewMethod == constants.TwoFactorAuthy
}
@@ -75,6 +88,15 @@ func (p *TwoFactorPreferences) NeedsAuthyConfirmation() bool {
return p.NeedsConfirmation() && p.NewMethod == constants.TwoFactorAuthy
}
+func (p *TwoFactorPreferences) NeedsAuthenticatorAppRegistration() bool {
+ return true
+ // return p.NewAuthAppMethod == constants.TwoFactorTOTP && p.User.TOTPSecret == ""
+}
+
+func (p *TwoFactorPreferences) NeedsAuthenticatorAppConfirmation() bool {
+ return p.NeedsConfirmation() && p.NewMethod == constants.TwoFactorTOTP
+}
+
func (p *TwoFactorPreferences) NeedsSMSConfirmation() bool {
return p.NeedsConfirmation() && p.NewMethod == constants.TwoFactorSMS
}
diff --git a/web/webui/two_factor_preferences_test.go b/web/webui/two_factor_preferences_test.go
index 25f932ca..9529c4a9 100644
--- a/web/webui/two_factor_preferences_test.go
+++ b/web/webui/two_factor_preferences_test.go
@@ -30,16 +30,25 @@ func TestTwoFactorPreferences(t *testing.T) {
assert.True(t, prefs.DoNotUseTwoFactor())
assert.False(t, prefs.UseAuthy())
assert.False(t, prefs.UseSMS())
+ assert.False(t, prefs.UseAuthenticatorApp())
prefs.NewMethod = constants.TwoFactorSMS
assert.False(t, prefs.DoNotUseTwoFactor())
assert.False(t, prefs.UseAuthy())
assert.True(t, prefs.UseSMS())
+ assert.False(t, prefs.UseAuthenticatorApp())
prefs.NewMethod = constants.TwoFactorAuthy
assert.False(t, prefs.DoNotUseTwoFactor())
assert.True(t, prefs.UseAuthy())
assert.False(t, prefs.UseSMS())
+ assert.False(t, prefs.UseAuthenticatorApp())
+
+ prefs.NewMethod = constants.TwoFactorTOTP
+ assert.False(t, prefs.DoNotUseTwoFactor())
+ assert.False(t, prefs.UseAuthy())
+ assert.False(t, prefs.UseSMS())
+ assert.True(t, prefs.UseAuthenticatorApp())
prefs.NewMethod = constants.TwoFactorAuthy
prefs.User.AuthyID = ""
@@ -49,6 +58,14 @@ func TestTwoFactorPreferences(t *testing.T) {
prefs.User.AuthyID = ""
assert.False(t, prefs.NeedsAuthyRegistration())
+ prefs.NewMethod = constants.TwoFactorAuthy
+ prefs.User.AuthyID = ""
+ assert.True(t, prefs.NeedsAuthyRegistration())
+
+ prefs.NewMethod = constants.TwoFactorTOTP
+ prefs.User.AuthyID = ""
+ assert.False(t, prefs.NeedsAuthyRegistration())
+
prefs.NewMethod = constants.TwoFactorAuthy
prefs.User.AuthyID = "12345"
assert.False(t, prefs.NeedsAuthyRegistration())
diff --git a/web/webui/users_controller.go b/web/webui/users_controller.go
index cb022bbd..f0323fa1 100644
--- a/web/webui/users_controller.go
+++ b/web/webui/users_controller.go
@@ -524,7 +524,9 @@ func SignInUser(c *gin.Context) (int, string, error) {
c.Set("CurrentUser", user)
redirectTo = "/dashboard"
- if user.IsTwoFactorUser() {
+ if user.IsTwoFactorUser() && user.IsAuthenticatorAppUser() {
+ redirectTo = "/users/validate_totp"
+ } else if user.IsTwoFactorUser() {
redirectTo = "/users/2fa_choose"
}
return http.StatusFound, redirectTo, nil
+
+
+ Enter One-Time Code From Your Authenticator App
+
+
+
+Using your authenticator app, please enter the one-time code that you see for APTrust.
+ + {{ if .errorMessage }} +{{ .errorMessage }}
+ {{ end }} + + ++