Skip to content

Feature/iframify #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dshafer wants to merge 14 commits into
base: develop
Choose a base branch
from
Open

Feature/iframify #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
b4d53d6
Kill the dinosaurs
Feb 23, 2015
45584c2
Consume toopher-java as a jar instead of source
Feb 24, 2015
cee9f74
remove unnecessary files
Feb 24, 2015
dc2ca59
Remove some more unnecessary junk
Feb 24, 2015
b78e9ef
Simplify XML callbacks file
Feb 24, 2015
adb80b4
Remove junk Login.jsp file
Feb 24, 2015
5e918e4
simplified ToopherSecondFactor.java
Feb 24, 2015
bbd1510
Rewrite toopher-openam.js for iframe
Feb 26, 2015
1b65e71
Rewrite ToopherSecondFactor.java to use iframe
Feb 26, 2015
561d332
js semicolons
Feb 26, 2015
5e18bd2
README updates
Feb 26, 2015
cf5bcac
Remove references to opt-out
Feb 26, 2015
4c4149d
PR feedback
Feb 27, 2015
fba0e67
These have officially consumed more calories than they are worth to me.
Feb 27, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
349 changes: 0 additions & 349 deletions Login.jsp
View file
Open in desktop

This file was deleted.

32 changes: 15 additions & 17 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,18 +37,29 @@ All executable and configuration files must be copied to the proper spot in the

sudo cp -r openam/* ${CATALINA_HOME}/webapps/openam/

Edit Login.jsp to include the Toopher javascript file at the end of the page (just above the closing `</body>` tag):
Edit Login.jsp to include and initialize the Toopher javascript file at the end of the page (just above the closing `</body>` tag):

</div>
</div>
<!--Beginning of required change-->
<script language="JavaScript" src="<%= ServiceURI%>/js/toopher-openam.js" type="text/javascript"></script>
<script language="JavaScript" type="text/javascript">
toopherOpenAM.init('${toopherIframeSrcUrl}');
</script>
<!--End of required change-->
</body>
</jato:useViewBean>
</html>

Make sure tomcat can access all of the new files:
By default, the Toopher-OpenAM Javascript will insert a Toopher Iframe into the login page
immediately before the OpenAM form, and hide the form. If you would like to override this
behavior, you may add an `<iframe id='toopher-iframe'></iframe>` anywhere in the page, and
the Toopher-OpenAM Javascript will use your iframe element instead of creating one
of its own. Your iframe should be 300px in height. Minimum width is 400px, optimum width
is 720px. The iframe should be hidden by default in your CSS - the Toopher-OpenAM Javascript
will make it visible when it is needed.

Finally, make sure tomcat can access all of the new files:

sudo chown -R tomcat:tomcat ${CATALINA_HOME}/webapps/openam

Expand Down Expand Up @@ -80,7 +91,6 @@ If you have not done so already, provision a new Toopher Consumer Key/Secret pai

Click the `ToopherSecondFactor` entry in the `Module Instances` list to go to the module options page. Fill in appropriate values for all fields:

* **Allow Users to Opt-Out of Toopher Authentication** : If enabled, individual users will be able to disable Toopher Authentication when they log in. This has the effect that the `ToopherSecondFactor` module instance will immedately grant access to the user
* **User email attribute** : Name of the User Principal attribute that holds a valid email address for the user. The Toopher Two-Factor ID authentication module uses this address to send self-service Pairing Reset emails to the user *(not yet implemented)*
* **Authentication Level** : Authentication Level to be reported to OpenAM
* **Toopher API URL** : URL of the Toopher Web API. This should be `https://api.toopher.com/v1/` for most users.
Expand All @@ -100,31 +110,22 @@ Congratulations - You're done!
## Administering a Toopher-Enabled Userbase
### The Toopher Two-Factor Login Flow

1. The first time OpenAM users authenticate through the Toopher service, they will be given the chance to opt-out of Toopher Authentication if the **Allow Users to Opt-Out of Toopher** setting is enabled.
1. If the user has opted-out of Toopher Authentication, they will be immediately authenticated successfully by the Toopher Authentication Service
1. If the user has not paired a mobile device with their OpenAM profile, they will be prompted to enter a "pairing phrase" generated by the Toopher Mobile App (Available for Android and iOS through the respective app store)
1. If the user has never logged in from the current terminal, they will be prompted to assign a "Friendly Name" to the terminal. Terminals are identified by setting a secure cookie in the browser.
1. The user is prompted via push message on their mobile device to authenticate the login. If sufficient location information is available, the user is given the option to automatically allow future logins from that specific terminal when the mobile device is in that location

## Future Enhancements
This pilot demonstrates the core functionality of a Toopher-enhanced OpenAM authentication flow. Several further improvements are in active development and will be available soon:

* Self-service Toopher pairing management (e.g., account recovery for when a user loses access to their second factor, etc.)
* User-accessible configuration options
* Admin pairing management (e.g., allow admins to deactivate pairing, etc.)
* More dynamic Toopher authentication waiting room (currently the webpage periodically refreshes while Toopher authentication is performed)

### FAQ
#### How can users un-pair their mobile device from Toopher?
Users can delete the pairing from their mobile device by tapping on the pairing in the Toopher mobile app, then selecting "Remove Pairing". The next time they authenticate through OpenAM, the user will be prompted to re-pair their account with a mobile device. If the **Allow Users to Opt-Out of Toopher** option is `enabled`, the user will first be given the opportunity to disable Toopher authentication on their account.
Users can delete the pairing from their mobile device by tapping on the pairing in the Toopher mobile app, then selecting "Remove Pairing". The next time they authenticate through OpenAM, the user will be prompted to re-pair their account with a mobile device.

#### Can users authenticate if their mobile device is not connected to the network?
Yes, users can still authenticate with a One-Time Password by clicking on the "Authenticate with
One-Time Password" button when logging in. The Toopher mobile app can generate valid One-Time
Passwords regardless of network connectivity.

#### What happens if users lose their mobile device, or delete the Toopher app?
Currently, this situation requires an administrator to manually reset the user's Toopher Pairing
This situation requires an administrator to manually reset the user's Toopher Pairing
status by running `reset_user.py` script, available in the `tools` directory of the installation archive.
`reset_user.py` requires access to the same Toopher Consumer Key and Secret used to configure the Toopher
OpenAM module. There are two ways to supply these credentials to the script:
Expand All @@ -141,6 +142,3 @@ command-line argument: the UID for the OpenAM user needing to be reset.

python tools/reset_user.py johndoe

We are currently developing a self-service Pairing
Recovery capability in Toopher for OpenAM which will reduce the administrative burden of this task,
expected to be available in late 2013.
60 changes: 3 additions & 57 deletions ToopherSecondFactor/ToopherSecondFactor.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,66 +4,12 @@
<Callbacks length="0" order="1" timeout="600" header="Toopher">
<!-- dummy callback so code can figure out what to do next -->
</Callbacks>
<Callbacks length="1" order="2" timeout="600" header="Pair with Toopher">
<Callbacks length="1" order="2" timeout="600" header="Authenticate with Toopher">
<NameCallback isRequired="true">
<Prompt>Please enter a Pairing Phrase generated from the Toopher Mobile app</Prompt>
<Prompt>#TOOPHER_HIDE#</Prompt>
Copy link
Member

@smholloway smholloway Feb 27, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's this?

Copy link
Member Author

@dshafer dshafer Feb 27, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Javascript uses that prompt string to locate the <input> element in the form that needs to receive the final Toopher signature once authentication is finished. It then finds the parent <form>, hides it, and replaces it with our iframe.

</NameCallback>
</Callbacks>
<Callbacks length="1" order="3" timeout="600" header="Waiting for Pairing Completion">
</Callbacks>
<Callbacks length="1" order="4" timeout="600" header="Name Terminal">
<NameCallback isRequired="true">
<Prompt>Terminal Name</Prompt>
</NameCallback>
</Callbacks>
<Callbacks length="1" order="5" timeout="600" header="Authenticating with Toopher">
<ConfirmationCallback>
<OptionValues>
<OptionValue>
<Value>Authenticate with One-Time Password</Value>
</OptionValue>
</OptionValues>
</ConfirmationCallback>
</Callbacks>
<Callbacks length="1" order="6" timeout="600" header="Enter One-Time Password">
<NameCallback isRequired="true">
<Prompt>Enter current OTP generated by the Toopher Mobile App</Prompt>
</NameCallback>
</Callbacks>
<Callbacks length="1" order="7" timeout="600" header="This Pairing has been Deactivated on the Mobile Device">
<ConfirmationCallback>
<OptionValues>
<OptionValue>
<Value>Re-Pair Account with Toopher</Value>
</OptionValue>
</OptionValues>
</ConfirmationCallback>
</Callbacks>
<Callbacks length="2" order="8" timeout="600" header="This Pairing has been Deactivated on the Mobile Device">
<ConfirmationCallback>
<OptionValues>
<OptionValue>
<Value>Re-Pair Account with Toopher</Value>
</OptionValue>
<OptionValue>
<Value>Disable Toopher Authentication</Value>
</OptionValue>
</OptionValues>
</ConfirmationCallback>
</Callbacks>
<Callbacks length="2" order="9" timeout="600" header="Enable Toopher Two-Factor Authentication?">
<ConfirmationCallback>
<OptionValues>
<OptionValue>
<Value>Yes, use Toopher</Value>
</OptionValue>
<OptionValue>
<Value>No thanks</Value>
</OptionValue>
</OptionValues>
</ConfirmationCallback>
</Callbacks>
<Callbacks length="1" order="10" timeout="600" header="Toopher" error="true">
<Callbacks length="1" order="3" timeout="600" header="Toopher" error="true">
<NameCallback>
<Prompt>#THE DUMMY WILL NEVER BE SHOWN#</Prompt>
</NameCallback>
Expand Down
107 changes: 0 additions & 107 deletions ToopherSecondFactor/amAuthToopherLocalStorageSecondFactor.xml
View file
Open in desktop

This file was deleted.

1 change: 0 additions & 1 deletion ToopherSecondFactor/amAuthToopherSecondFactor.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@ backend=Backend
toopher-api-url=Toopher API URL
toopher-consumer-key=Toopher Consumer Key
toopher-consumer-secret=Toopher Consumer Secret
allow-opt-out=Allow Users to Opt-Out of Toopher Authentication
backend-server-urls=Backend Server URLs
num-backend-connections=Num Backend Connections
ldap-bind-user-dn=Bind User DN
Expand Down
18 changes: 0 additions & 18 deletions ToopherSecondFactor/amAuthToopherSecondFactor.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,15 +29,6 @@
<Value>mail</Value>
</DefaultValues>
</AttributeSchema>
<AttributeSchema name="iplanet-am-auth-ToopherSecondFactor-allowOptOut" type="single" syntax="boolean" i18nKey="allow-opt-out">
<BooleanValues>
<BooleanTrueValue i18nKey="i18nTrue">true</BooleanTrueValue>
<BooleanFalseValue i18nKey="i18nFalse">false</BooleanFalseValue>
</BooleanValues>
<DefaultValues>
<Value>false</Value>
</DefaultValues>
</AttributeSchema>
<SubSchema name="serverconfig" inheritance="multiple">
<AttributeSchema name="iplanet-am-auth-ToopherSecondFactor-auth-level" type="single" syntax="number_range" rangeStart="0" rangeEnd="2147483647" i18nKey="auth-level">
<DefaultValues>
Expand All @@ -64,15 +55,6 @@
<Value>mail</Value>
</DefaultValues>
</AttributeSchema>
<AttributeSchema name="iplanet-am-auth-ToopherSecondFactor-allowOptOut" type="single" syntax="boolean" i18nKey="allow-opt-out">
<BooleanValues>
<BooleanTrueValue i18nKey="i18nTrue">true</BooleanTrueValue>
<BooleanFalseValue i18nKey="i18nFalse">false</BooleanFalseValue>
</BooleanValues>
<DefaultValues>
<Value>false</Value>
</DefaultValues>
</AttributeSchema>
</SubSchema>
</Organization>
</Schema>
Expand Down
Loading