You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@shiro.apache.org by alexd92 <di...@gmail.com> on 2016/02/16 22:16:17 UTC
Multifactor authentication
Hello,
I have been searching this subject for a while but I couldn't find something
very useful. The best resource is here [1], but it is not enough. What I
want to achieve is this: a two factor authentication using static password
(from database) and a OTP password that a user can provide (maybe it gets it
through SMS, it doesn't matter).
I am not sure what is the secure way to do this, but I planning something
like this:
- for the sake of example, lets presume I have 3 pages: login1.jsp,
login2.jsp and mainPage.jsp (which I want to protect using the 2 factor
authentication)
- make 2 filters, lets say filter1 and filter2;
- eg. URLS: /login1.jsp = anon; /login2.jsp = filter1; /** = filter2
- phase 1: user enters credentials and I try to login the subject using the
JdbcRealm [problem 1]; in case of success put a flag in session, and
redirect to login2.jsp
- phase 2: filter1 permits access only if the flag is set;
- collect the static password from login2.jsp and issue login with it
- if credentials match redirect to mainPage, filter2 permits access only if
user isAuthenticated
The main problem is how to write the filters. I would do something like
this:
- if user and password are ok, then put a flag in session
- filter1 permits acces only if the flag is set
- do a normal login using otp password and authenticate user, filter2
permits access if user is authenticated (I can user a default shiro filter,
like UserFilter).
What confuses me is this: in phase one, when I check user + static password,
if I use subject.login(token) in case of success I get an authenticated
user, but I just need to put a flag in the session, otherwise filter2 will
allow access (and I don't want this yet, it must provide the otp password).
Should I logout afterwards? (sounds dumb). I could just use the
doGetAuthenticaionInfo from JdbcRealm, and I'm perfectly fine, but I'm not
sure if this is the right way.
Any suggestions would be appreciated!
[1]
http://shiro-user.582556.n2.nabble.com/Multi-stage-or-OTP-sms-factor-td7580272.html
--
View this message in context: http://shiro-user.582556.n2.nabble.com/Multifactor-authentication-tp7580952.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: Multifactor authentication
Posted by Alex Ditu <di...@gmail.com>.
Well I was thinking about not logging in the subject and use a custom
subject factory, but I need the login functionality (in order to use
JdbcRealm to authenticate in the first step). The problem I am facing is
this: using the default behavior I'll get an authenticated user (at least
the isAuthenticated function returns true), so the second filter cannot
allow access only by checking if the user is authenticated. I believe are
there are many ways to solve this problem, and I taught using this one:
- authenticate user as usual in step one
- send the temporary password to user, _save_ it in _session_ (in order to
verify it in step 2) and redirect to second login page
- allow access in second login page if user is authenticated
- user sends the temporary password, and use a custom realm which does the
following:
a. check the user provided temporary password against the password
saved in session
b. if passwords match, assign _two_ principals to user (very important)
- Now the second filter will check if 2 conditions are met: one
isAuthenticated, two if it has the second principal in session.
I am wondering if there are any security problems, but as far as I can tell
everything looks ok.
On Fri, Feb 19, 2016 at 6:37 AM, Kalle Korhonen <ka...@gmail.com>
wrote:
> On Thu, Feb 18, 2016 at 12:17 PM, alexd92 <di...@gmail.com>
> wrote:
>
>> @Kalle: no I don't want the remember me functionality, all I want is a
>> secure way to pass through two filters: one that permits access if user
>> can
>> provide a static pair of username and password, and a second one which
>> allows access if step one succeeds _and_ user provides a second, one time,
>> password.
>>
>
> Yes, that's exactly what I mean. If you don't need the rememberMe
> functionality for the designed purpose, then you can use it for this
> purpose. So, in step one, you create a subject but leave the authenticated
> as false. Then, in the step two, you only allow access to non-guest users
> and call login to create subject that's authenticated. Disable rememberMe
> cookies and probably easiest to simply create a custom SubjectFactory for
> step one instead of invoking login.
>
> Kalle
>
>
>> On Thursday, February 18, 2016, kaosko [via Shiro User] <
>> ml-node+s582556n7580955h12@n2.nabble.com> wrote:
>>
>> > Do you need the rememberMe functionality in addition to the two-factor
>> > authentication? If not, the first filter could easily make the user
>> > remembered and the second one authenticated. Or you could use a generic
>> > role to mark that the user needs or have completed the second phase
>> > authentication.
>> >
>> > Kalle
>> >
>> > On Thu, Feb 18, 2016 at 8:50 AM, Brian Demers <[hidden email]
>> > <http:///user/SendEmail.jtp?type=node&node=7580955&i=0>> wrote:
>> >
>> >> Thinking out loud here, so others feel free to chime in.
>> >>
>> >> As far as OTP goes, some systems use pin + token as a single line.
>> With
>> >> this case, you _could_ use a UserPasswordToken and have your
>> >> realm/authenticator check to see if the user has a OTP attribute set
>> or not.
>> >>
>> >> But for the multi form (similar to what google or gihub approach) your
>> >> idea with the auth filters might be a good approach. You could check
>> for
>> >> an existing of a role/permission "OTP" (or subject attribute) from a
>> >> filter, and then redirect to your other login page. Needing to force
>> the
>> >> subject logout is an interesting issue, I cannot think of an easy way
>> >> around this without overriding a few methods form the SecurityManager.
>> >>
>> >> Other thoughts on this?
>> >>
>> >>
>> >> On Thu, Feb 18, 2016 at 2:42 AM, alexd92 <[hidden email]
>> >> <http:///user/SendEmail.jtp?type=node&node=7580955&i=1>> wrote:
>> >>
>> >>> For the moment I'm thinking at the following solution:-use two
>> filters,
>> >>> f1
>> >>> and f2 and 2 realms (r1 and r2)-protect the urls: /login1 = anon,
>> >>> /login2 =
>> >>> f1, /** = f2-f1 = org.apache.shiro.web.filter.authc.UserFilter-f2 = {
>> >>> custom
>> >>> filter which permits access if user has 2 principals in session }-r1 =
>> >>> could
>> >>> be JdbcRealm-r2 = custom realm which adds two principals in session
>> >>> Short:- first login is annoymous, anyone could enter credentials- in
>> >>> case of
>> >>> succes it is redirected to second login page, where it has access only
>> >>> if it
>> >>> is authenticated (using r1)- if login2 succeeds it is redirected to
>> main
>> >>> page, and has access only if it passes the second filter, f2 (which it
>> >>> will,
>> >>> if the login2 succeeded).
>> >>>
>> >>>
>> >>>
>> >>> --
>> >>> View this message in context:
>> >>>
>> http://shiro-user.582556.n2.nabble.com/Multifactor-authentication-tp7580952p7580953.html
>> >>> Sent from the Shiro User mailing list archive at Nabble.com.
>> >>>
>> >>
>> >>
>> >
>> >
>> > ------------------------------
>> > If you reply to this email, your message will be added to the discussion
>> > below:
>> >
>> >
>> http://shiro-user.582556.n2.nabble.com/Multifactor-authentication-tp7580952p7580955.html
>> > To unsubscribe from Multifactor authentication, click here
>> > <
>> http://shiro-user.582556.n2.nabble.com/template/NamlServlet.jtp?macro=unsubscribe_by_code&node=7580952&code=ZGl0dS5hbGV4YW5kcnVAZ21haWwuY29tfDc1ODA5NTJ8LTE2MTg5OTk0MDE=
>> >
>> > .
>> > NAML
>> > <
>> http://shiro-user.582556.n2.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml
>> >
>> >
>>
>>
>>
>>
>> --
>> View this message in context:
>> http://shiro-user.582556.n2.nabble.com/Multifactor-authentication-tp7580952p7580956.html
>> Sent from the Shiro User mailing list archive at Nabble.com.
>>
>
>
Re: Multifactor authentication
Posted by Kalle Korhonen <ka...@gmail.com>.
On Thu, Feb 18, 2016 at 12:17 PM, alexd92 <di...@gmail.com> wrote:
> @Kalle: no I don't want the remember me functionality, all I want is a
> secure way to pass through two filters: one that permits access if user can
> provide a static pair of username and password, and a second one which
> allows access if step one succeeds _and_ user provides a second, one time,
> password.
>
Yes, that's exactly what I mean. If you don't need the rememberMe
functionality for the designed purpose, then you can use it for this
purpose. So, in step one, you create a subject but leave the authenticated
as false. Then, in the step two, you only allow access to non-guest users
and call login to create subject that's authenticated. Disable rememberMe
cookies and probably easiest to simply create a custom SubjectFactory for
step one instead of invoking login.
Kalle
> On Thursday, February 18, 2016, kaosko [via Shiro User] <
> ml-node+s582556n7580955h12@n2.nabble.com> wrote:
>
> > Do you need the rememberMe functionality in addition to the two-factor
> > authentication? If not, the first filter could easily make the user
> > remembered and the second one authenticated. Or you could use a generic
> > role to mark that the user needs or have completed the second phase
> > authentication.
> >
> > Kalle
> >
> > On Thu, Feb 18, 2016 at 8:50 AM, Brian Demers <[hidden email]
> > <http:///user/SendEmail.jtp?type=node&node=7580955&i=0>> wrote:
> >
> >> Thinking out loud here, so others feel free to chime in.
> >>
> >> As far as OTP goes, some systems use pin + token as a single line. With
> >> this case, you _could_ use a UserPasswordToken and have your
> >> realm/authenticator check to see if the user has a OTP attribute set or
> not.
> >>
> >> But for the multi form (similar to what google or gihub approach) your
> >> idea with the auth filters might be a good approach. You could check
> for
> >> an existing of a role/permission "OTP" (or subject attribute) from a
> >> filter, and then redirect to your other login page. Needing to force
> the
> >> subject logout is an interesting issue, I cannot think of an easy way
> >> around this without overriding a few methods form the SecurityManager.
> >>
> >> Other thoughts on this?
> >>
> >>
> >> On Thu, Feb 18, 2016 at 2:42 AM, alexd92 <[hidden email]
> >> <http:///user/SendEmail.jtp?type=node&node=7580955&i=1>> wrote:
> >>
> >>> For the moment I'm thinking at the following solution:-use two filters,
> >>> f1
> >>> and f2 and 2 realms (r1 and r2)-protect the urls: /login1 = anon,
> >>> /login2 =
> >>> f1, /** = f2-f1 = org.apache.shiro.web.filter.authc.UserFilter-f2 = {
> >>> custom
> >>> filter which permits access if user has 2 principals in session }-r1 =
> >>> could
> >>> be JdbcRealm-r2 = custom realm which adds two principals in session
> >>> Short:- first login is annoymous, anyone could enter credentials- in
> >>> case of
> >>> succes it is redirected to second login page, where it has access only
> >>> if it
> >>> is authenticated (using r1)- if login2 succeeds it is redirected to
> main
> >>> page, and has access only if it passes the second filter, f2 (which it
> >>> will,
> >>> if the login2 succeeded).
> >>>
> >>>
> >>>
> >>> --
> >>> View this message in context:
> >>>
> http://shiro-user.582556.n2.nabble.com/Multifactor-authentication-tp7580952p7580953.html
> >>> Sent from the Shiro User mailing list archive at Nabble.com.
> >>>
> >>
> >>
> >
> >
> > ------------------------------
> > If you reply to this email, your message will be added to the discussion
> > below:
> >
> >
> http://shiro-user.582556.n2.nabble.com/Multifactor-authentication-tp7580952p7580955.html
> > To unsubscribe from Multifactor authentication, click here
> > <
> http://shiro-user.582556.n2.nabble.com/template/NamlServlet.jtp?macro=unsubscribe_by_code&node=7580952&code=ZGl0dS5hbGV4YW5kcnVAZ21haWwuY29tfDc1ODA5NTJ8LTE2MTg5OTk0MDE=
> >
> > .
> > NAML
> > <
> http://shiro-user.582556.n2.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml
> >
> >
>
>
>
>
> --
> View this message in context:
> http://shiro-user.582556.n2.nabble.com/Multifactor-authentication-tp7580952p7580956.html
> Sent from the Shiro User mailing list archive at Nabble.com.
>
Re: Multifactor authentication
Posted by alexd92 <di...@gmail.com>.
@Brian: I don't see the problem with logging out, what do you mean?
@Kalle: no I don't want the remember me functionality, all I want is a
secure way to pass through two filters: one that permits access if user can
provide a static pair of username and password, and a second one which
allows access if step one succeeds _and_ user provides a second, one time,
password.
On Thursday, February 18, 2016, kaosko [via Shiro User] <
ml-node+s582556n7580955h12@n2.nabble.com> wrote:
> Do you need the rememberMe functionality in addition to the two-factor
> authentication? If not, the first filter could easily make the user
> remembered and the second one authenticated. Or you could use a generic
> role to mark that the user needs or have completed the second phase
> authentication.
>
> Kalle
>
> On Thu, Feb 18, 2016 at 8:50 AM, Brian Demers <[hidden email]
> <http:///user/SendEmail.jtp?type=node&node=7580955&i=0>> wrote:
>
>> Thinking out loud here, so others feel free to chime in.
>>
>> As far as OTP goes, some systems use pin + token as a single line. With
>> this case, you _could_ use a UserPasswordToken and have your
>> realm/authenticator check to see if the user has a OTP attribute set or not.
>>
>> But for the multi form (similar to what google or gihub approach) your
>> idea with the auth filters might be a good approach. You could check for
>> an existing of a role/permission "OTP" (or subject attribute) from a
>> filter, and then redirect to your other login page. Needing to force the
>> subject logout is an interesting issue, I cannot think of an easy way
>> around this without overriding a few methods form the SecurityManager.
>>
>> Other thoughts on this?
>>
>>
>> On Thu, Feb 18, 2016 at 2:42 AM, alexd92 <[hidden email]
>> <http:///user/SendEmail.jtp?type=node&node=7580955&i=1>> wrote:
>>
>>> For the moment I'm thinking at the following solution:-use two filters,
>>> f1
>>> and f2 and 2 realms (r1 and r2)-protect the urls: /login1 = anon,
>>> /login2 =
>>> f1, /** = f2-f1 = org.apache.shiro.web.filter.authc.UserFilter-f2 = {
>>> custom
>>> filter which permits access if user has 2 principals in session }-r1 =
>>> could
>>> be JdbcRealm-r2 = custom realm which adds two principals in session
>>> Short:- first login is annoymous, anyone could enter credentials- in
>>> case of
>>> succes it is redirected to second login page, where it has access only
>>> if it
>>> is authenticated (using r1)- if login2 succeeds it is redirected to main
>>> page, and has access only if it passes the second filter, f2 (which it
>>> will,
>>> if the login2 succeeded).
>>>
>>>
>>>
>>> --
>>> View this message in context:
>>> http://shiro-user.582556.n2.nabble.com/Multifactor-authentication-tp7580952p7580953.html
>>> Sent from the Shiro User mailing list archive at Nabble.com.
>>>
>>
>>
>
>
> ------------------------------
> If you reply to this email, your message will be added to the discussion
> below:
>
> http://shiro-user.582556.n2.nabble.com/Multifactor-authentication-tp7580952p7580955.html
> To unsubscribe from Multifactor authentication, click here
> <http://shiro-user.582556.n2.nabble.com/template/NamlServlet.jtp?macro=unsubscribe_by_code&node=7580952&code=ZGl0dS5hbGV4YW5kcnVAZ21haWwuY29tfDc1ODA5NTJ8LTE2MTg5OTk0MDE=>
> .
> NAML
> <http://shiro-user.582556.n2.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml>
>
--
View this message in context: http://shiro-user.582556.n2.nabble.com/Multifactor-authentication-tp7580952p7580956.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: Multifactor authentication
Posted by Kalle Korhonen <ka...@gmail.com>.
Do you need the rememberMe functionality in addition to the two-factor
authentication? If not, the first filter could easily make the user
remembered and the second one authenticated. Or you could use a generic
role to mark that the user needs or have completed the second phase
authentication.
Kalle
On Thu, Feb 18, 2016 at 8:50 AM, Brian Demers <br...@gmail.com>
wrote:
> Thinking out loud here, so others feel free to chime in.
>
> As far as OTP goes, some systems use pin + token as a single line. With
> this case, you _could_ use a UserPasswordToken and have your
> realm/authenticator check to see if the user has a OTP attribute set or not.
>
> But for the multi form (similar to what google or gihub approach) your
> idea with the auth filters might be a good approach. You could check for
> an existing of a role/permission "OTP" (or subject attribute) from a
> filter, and then redirect to your other login page. Needing to force the
> subject logout is an interesting issue, I cannot think of an easy way
> around this without overriding a few methods form the SecurityManager.
>
> Other thoughts on this?
>
>
> On Thu, Feb 18, 2016 at 2:42 AM, alexd92 <di...@gmail.com> wrote:
>
>> For the moment I'm thinking at the following solution:-use two filters, f1
>> and f2 and 2 realms (r1 and r2)-protect the urls: /login1 = anon, /login2
>> =
>> f1, /** = f2-f1 = org.apache.shiro.web.filter.authc.UserFilter-f2 = {
>> custom
>> filter which permits access if user has 2 principals in session }-r1 =
>> could
>> be JdbcRealm-r2 = custom realm which adds two principals in session
>> Short:- first login is annoymous, anyone could enter credentials- in case
>> of
>> succes it is redirected to second login page, where it has access only if
>> it
>> is authenticated (using r1)- if login2 succeeds it is redirected to main
>> page, and has access only if it passes the second filter, f2 (which it
>> will,
>> if the login2 succeeded).
>>
>>
>>
>> --
>> View this message in context:
>> http://shiro-user.582556.n2.nabble.com/Multifactor-authentication-tp7580952p7580953.html
>> Sent from the Shiro User mailing list archive at Nabble.com.
>>
>
>
Re: Multifactor authentication
Posted by Brian Demers <br...@gmail.com>.
Thinking out loud here, so others feel free to chime in.
As far as OTP goes, some systems use pin + token as a single line. With
this case, you _could_ use a UserPasswordToken and have your
realm/authenticator check to see if the user has a OTP attribute set or not.
But for the multi form (similar to what google or gihub approach) your idea
with the auth filters might be a good approach. You could check for an
existing of a role/permission "OTP" (or subject attribute) from a filter,
and then redirect to your other login page. Needing to force the subject
logout is an interesting issue, I cannot think of an easy way around this
without overriding a few methods form the SecurityManager.
Other thoughts on this?
On Thu, Feb 18, 2016 at 2:42 AM, alexd92 <di...@gmail.com> wrote:
> For the moment I'm thinking at the following solution:-use two filters, f1
> and f2 and 2 realms (r1 and r2)-protect the urls: /login1 = anon, /login2 =
> f1, /** = f2-f1 = org.apache.shiro.web.filter.authc.UserFilter-f2 = {
> custom
> filter which permits access if user has 2 principals in session }-r1 =
> could
> be JdbcRealm-r2 = custom realm which adds two principals in session
> Short:- first login is annoymous, anyone could enter credentials- in case
> of
> succes it is redirected to second login page, where it has access only if
> it
> is authenticated (using r1)- if login2 succeeds it is redirected to main
> page, and has access only if it passes the second filter, f2 (which it
> will,
> if the login2 succeeded).
>
>
>
> --
> View this message in context:
> http://shiro-user.582556.n2.nabble.com/Multifactor-authentication-tp7580952p7580953.html
> Sent from the Shiro User mailing list archive at Nabble.com.
>
Re: Multifactor authentication
Posted by alexd92 <di...@gmail.com>.
For the moment I'm thinking at the following solution:-use two filters, f1
and f2 and 2 realms (r1 and r2)-protect the urls: /login1 = anon, /login2 =
f1, /** = f2-f1 = org.apache.shiro.web.filter.authc.UserFilter-f2 = { custom
filter which permits access if user has 2 principals in session }-r1 = could
be JdbcRealm-r2 = custom realm which adds two principals in session
Short:- first login is annoymous, anyone could enter credentials- in case of
succes it is redirected to second login page, where it has access only if it
is authenticated (using r1)- if login2 succeeds it is redirected to main
page, and has access only if it passes the second filter, f2 (which it will,
if the login2 succeeded).
--
View this message in context: http://shiro-user.582556.n2.nabble.com/Multifactor-authentication-tp7580952p7580953.html
Sent from the Shiro User mailing list archive at Nabble.com.