Security Library

[Chris Spencer]

I added 2FA to my webapp with the autenticator library and all works well.

I am looking at the later Security Library and it doesnt seem clear how you can apply a known individual secret to the create the QRCode so as it can be reproduced to verify against.
the following code in



Procedure InitializeNewOtpSpec
Handle hoOtp
String sBase32Secret sAccountName
String sOtpSpec


// create new OTP (with new secret)
Get psLoginName of ghoWebSessionManager to sAccountName
Move (sAccountName + "(SecurityDemo)") to sAccountName

Get NewOtp of oMyOtp C_SEC_OTPTYPE_TIME sAccountName to hoOtp
Get SecretAsBase32 of hoOtp to sBase32Secret //<----------------------------------------------------------- This code create the secret with no way to pass and generates a random string in the demo There is no clear way I see to pass aknown string tied to each user
WebSet psCaption of oNewSecretText to (SFormat("This is your new OTP secret: %1"+Character(13)+"Scan this QR code with your OTP app:", sBase32Secret))


// save
Get PackForStorage of hoOtp to sOtpSpec
WebSet psOtpSpec to sOtpSpec
WebSet psValue of oNewSecretQrCode to sOtpSpec


// clean up
Send Destroy of hoOtp
End_Procedure




Am I missing something here.
Tthe Authenticator does what I need but was investigating whether to move to Security Lib

[Chris Spencer]

No one using 2FA with security library?
As stated was a breeze using the original Authenticator libray

[Samuel Pizarro]

I’m not Chris. Sorry!

[wila]

Chris,

It's been a long long time since I've done this, but the following should work.



Object o2FAWebGroup is a c2FAWebGroup
Set pbVisible to False
// make sure you include the required javascript files in your index.html:
//
// <script src="Custom/u2f-api.js"></script>
// <script src="Custom/2FAWebGroup.js"></script>

//***** Set up one-time password (e.g. oATH HOTP or TOTP)
// If OTP support is not needed this entire section can be removed.

Object oMyOtp is a cSecureTimeBasedOneTimePassword_Impl //cSecureTimeBasedOneTimePassword
Set piHashImplementation to C_SEC_HASH_CNG_HMAC_SHA1 //C_SEC_HASH_LIBSODIUM_HMAC_SHA256

Function GenerateOTPCode Returns String
String sOtp
Integer iTime iStep iCounter
UChar[] ucaSecret

Get pucaSecret to ucaSecret
Move (CurrentUnixTime()) to iTime
Get piStep to iStep
// try current code first
Move (iTime / iStep) to iCounter
Get OneTimePassword iCounter to sOtp
Function_Return sOtp
End_Function
End_Object
Set phoSecureOneTimePassword to oMyOtp

// **WvA: Not used in the current implementation
// Return registered OTP secrets for the user. Make sure you verify password first!
// For security reasons, each user should have only one OTP key.
Function RegisteredOtpSecrets Returns UChar[][]
UChar[][] ucaSecrets

// override this method.

Function_Return ucaSecrets
End_Function

// Return the specification of the registered OTP for the _authenticated_ user.
// There MUST be zero or one.
Function RegisteredOtp Returns String
String sSecret
Get psUserSecret of ghoWebSessionManager To sSecret
If (sSecret="") Begin
Error DfErr_Program ("The OTP secret is not set, please report to support")
End
Function_Return sSecret
End_Function

Procedure OnOTPAuthenticationFailure
// implement this event.
End_Procedure

Procedure OnOTPAuthenticationSuccess
// implement this event.
End_Procedure

End_Object


--
Wil