| |
| <!DOCTYPE HTML> |
| <html lang="" > |
| <head> |
| <meta charset="UTF-8"> |
| <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> |
| <title>Multi Factor Authentication · Eclipse Kapua™ User Guide</title> |
| <meta http-equiv="X-UA-Compatible" content="IE=edge" /> |
| <meta name="description" content=""> |
| <meta name="generator" content="GitBook 3.2.2"> |
| |
| |
| |
| |
| <link rel="stylesheet" href="gitbook/style.css"> |
| |
| |
| |
| |
| <link rel="stylesheet" href="gitbook/gitbook-plugin-highlight/website.css"> |
| |
| |
| |
| <link rel="stylesheet" href="gitbook/gitbook-plugin-search/search.css"> |
| |
| |
| |
| <link rel="stylesheet" href="gitbook/gitbook-plugin-fontsettings/website.css"> |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| <meta name="HandheldFriendly" content="true"/> |
| <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no"> |
| <meta name="apple-mobile-web-app-capable" content="yes"> |
| <meta name="apple-mobile-web-app-status-bar-style" content="black"> |
| <link rel="apple-touch-icon-precomposed" sizes="152x152" href="gitbook/images/apple-touch-icon-precomposed-152.png"> |
| <link rel="shortcut icon" href="gitbook/images/favicon.ico" type="image/x-icon"> |
| |
| |
| <link rel="next" href="credentials.html" /> |
| |
| |
| <link rel="prev" href="Permissions.html" /> |
| |
| |
| </head> |
| <body> |
| |
| <div class="book"> |
| <div class="book-summary"> |
| |
| |
| <div id="book-search-input" role="search"> |
| <input type="text" placeholder="Type to search" /> |
| </div> |
| |
| |
| <nav role="navigation"> |
| |
| |
| |
| <ul class="summary"> |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| <li class="chapter " data-level="1.1" data-path="./"> |
| |
| <a href="./"> |
| |
| |
| Introduction |
| |
| </a> |
| |
| |
| |
| </li> |
| |
| <li class="chapter " data-level="1.2" data-path="rest.html"> |
| |
| <a href="rest.html"> |
| |
| |
| REST API |
| |
| </a> |
| |
| |
| |
| </li> |
| |
| <li class="chapter " data-level="1.3" data-path="community.html"> |
| |
| <a href="community.html"> |
| |
| |
| Community |
| |
| </a> |
| |
| |
| |
| </li> |
| |
| <li class="chapter " data-level="1.4" data-path="simulator.html"> |
| |
| <a href="simulator.html"> |
| |
| |
| Simulator |
| |
| </a> |
| |
| |
| |
| </li> |
| |
| <li class="chapter " data-level="1.5" data-path="jwt_security.html"> |
| |
| <a href="jwt_security.html"> |
| |
| |
| Setup JWT security |
| |
| </a> |
| |
| |
| |
| </li> |
| |
| <li class="chapter " data-level="1.6" data-path="Permissions.html"> |
| |
| <a href="Permissions.html"> |
| |
| |
| Kapua Permissions |
| |
| </a> |
| |
| |
| |
| </li> |
| |
| <li class="chapter active" data-level="1.7" data-path="mfa.html"> |
| |
| <a href="mfa.html"> |
| |
| |
| Multi Factor Authentication |
| |
| </a> |
| |
| |
| |
| </li> |
| |
| <li class="chapter " data-level="1.8" data-path="credentials.html"> |
| |
| <a href="credentials.html"> |
| |
| |
| Credentials |
| |
| </a> |
| |
| |
| |
| </li> |
| |
| |
| |
| |
| <li class="divider"></li> |
| |
| <li> |
| <a href="https://www.gitbook.com" target="blank" class="gitbook-link"> |
| Published with GitBook |
| </a> |
| </li> |
| </ul> |
| |
| |
| </nav> |
| |
| |
| </div> |
| |
| <div class="book-body"> |
| |
| <div class="body-inner"> |
| |
| |
| |
| <div class="book-header" role="navigation"> |
| |
| |
| <!-- Title --> |
| <h1> |
| <i class="fa fa-circle-o-notch fa-spin"></i> |
| <a href="." >Multi Factor Authentication</a> |
| </h1> |
| </div> |
| |
| |
| |
| |
| <div class="page-wrapper" tabindex="-1" role="main"> |
| <div class="page-inner"> |
| |
| <div id="book-search-results"> |
| <div class="search-noresults"> |
| |
| <section class="normal markdown-section"> |
| |
| <h1 id="multi-factor-authentication">Multi Factor Authentication</h1> |
| <p>Kapua provides a Multi Factor Authentication feature (a.k.a. MFA), which allows a user to authenticate to a system only when he presents the |
| password and another valid factor. A user can enable the MFA through the User menu in the Console.</p> |
| <p><img src="images/mfa_user_view.png" alt="MFA User View"></p> |
| <p>The user can also access the MFA configuration dialog through the upper right menu. Note that only the user itself can enable the MFA.</p> |
| <p><img src="images/mfa_enable.png" alt="MFA Enable"></p> |
| <p>MFA uses a secret to produce a one-time code to authenticate. The secret will be displayed in the form of a QR code during the MFA activation. |
| This QR code can only be viewed once during MFA activation, and only by the user itself. To collect the QR code, use an authenticator app |
| (e.g. the Google Authenticator App) installed on a smartphone. This app will be used to produce one-time authentication code.</p> |
| <p>Scratch codes are also produced, in order to pass the multi factor authentication in case the authenticator app is temporarily unavailable. |
| Similarly to the QR code, also scratch codes can only be viewed once during MFA activation, and they can be viewed only by the user itself. |
| Users have a limited number of scratch codes (the maximum number of scratch codes can be set through a dedicated environment variable, see the Web |
| Console container properties section for more information). Furthermore, each scratch code is invalidated after being used once.</p> |
| <p><img src="images/mfa_qr_code.png" alt="MFA QR Code"></p> |
| <p>The admin is able to see if the user have the MFA enabled or not. Moreover, even if only the user is allowed to enable MFA, the admin is allowed to disable |
| it for each one of the users in the account.</p> |
| <p>When the MFA is enabled for a given user, such user has to type the one-time authentication code provided by the authenticator app as part of the login |
| process to the Web Console.</p> |
| <p><img src="images/mfa_login.png" alt="MFA Login"></p> |
| <p>The user with enabled MFA can also trust the access to the console from one or more devices. In this way, the MFA procedure is enforced only on un-trusted |
| devices. Note that the trust on the device expires after 30 days, and the admin is able to revoke the trusted device.</p> |
| <h2 id="multi-factor-authentication-configuration">Multi Factor Authentication Configuration</h2> |
| <p>The following variables control the Multi Factor Authentication feature of the Web Console.</p> |
| <table> |
| <thead> |
| <tr> |
| <th>Environment Variable</th> |
| <th>Default Value</th> |
| <th>Description</th> |
| </tr> |
| </thead> |
| <tbody> |
| <tr> |
| <td>CIPHER_KEY</td> |
| <td><em>to be changed</em></td> |
| <td>Secret containing the key to use for the AES cipher (used by the MFA authentication).</td> |
| </tr> |
| <tr> |
| <td>MFA_TIME_STEP_SIZE</td> |
| <td>30</td> |
| <td>MFA time step size (in seconds, min > 0).</td> |
| </tr> |
| <tr> |
| <td>MFA_WINDOW_SIZE</td> |
| <td>3</td> |
| <td>Number of windows of size timeStepSizeInMillis checked during the MFA validation (min > 0).</td> |
| </tr> |
| <tr> |
| <td>MFA_SCRATCH_CODES_NUMBER</td> |
| <td>5</td> |
| <td>Number of MFA scratch codes (min is 0 max is 1000).</td> |
| </tr> |
| <tr> |
| <td>MFA_CODE_DIGITS_NUMBER</td> |
| <td>6</td> |
| <td>Number of digits in the generated MFA code (min is 6 max is 8).</td> |
| </tr> |
| </tbody> |
| </table> |
| |
| |
| </section> |
| |
| </div> |
| <div class="search-results"> |
| <div class="has-results"> |
| |
| <h1 class="search-results-title"><span class='search-results-count'></span> results matching "<span class='search-query'></span>"</h1> |
| <ul class="search-results-list"></ul> |
| |
| </div> |
| <div class="no-results"> |
| |
| <h1 class="search-results-title">No results matching "<span class='search-query'></span>"</h1> |
| |
| </div> |
| </div> |
| </div> |
| |
| </div> |
| </div> |
| |
| </div> |
| |
| |
| |
| <a href="Permissions.html" class="navigation navigation-prev " aria-label="Previous page: Kapua Permissions"> |
| <i class="fa fa-angle-left"></i> |
| </a> |
| |
| |
| <a href="credentials.html" class="navigation navigation-next " aria-label="Next page: Credentials"> |
| <i class="fa fa-angle-right"></i> |
| </a> |
| |
| |
| |
| </div> |
| |
| <script> |
| var gitbook = gitbook || []; |
| gitbook.push(function() { |
| gitbook.page.hasChanged({"page":{"title":"Multi Factor Authentication","level":"1.7","depth":1,"next":{"title":"Credentials","level":"1.8","depth":1,"path":"credentials.md","ref":"credentials.md","articles":[]},"previous":{"title":"Kapua Permissions","level":"1.6","depth":1,"path":"Permissions.md","ref":"Permissions.md","articles":[]},"dir":"ltr"},"config":{"plugins":[],"styles":{"website":"styles/website.css","pdf":"styles/pdf.css","epub":"styles/epub.css","mobi":"styles/mobi.css","ebook":"styles/ebook.css","print":"styles/print.css"},"pluginsConfig":{"highlight":{},"search":{},"lunr":{"maxIndexSize":1000000,"ignoreSpecialCharacters":false},"sharing":{"facebook":true,"twitter":true,"google":false,"weibo":false,"instapaper":false,"vk":false,"all":["facebook","google","twitter","weibo","instapaper"]},"fontsettings":{"theme":"white","family":"sans","size":2},"theme-default":{"styles":{"website":"styles/website.css","pdf":"styles/pdf.css","epub":"styles/epub.css","mobi":"styles/mobi.css","ebook":"styles/ebook.css","print":"styles/print.css"},"showLevel":false}},"github":"eclipse/kapua","theme":"default","githubHost":"https://github.com/","pdf":{"pageNumbers":true,"fontSize":12,"fontFamily":"Arial","paperSize":"a4","chapterMark":"pagebreak","pageBreaksBefore":"/","margin":{"right":62,"left":62,"top":56,"bottom":56}},"structure":{"langs":"LANGS.md","readme":"README.md","glossary":"GLOSSARY.md","summary":"SUMMARY.md"},"variables":{},"title":"Eclipse Kapua™ User Guide","links":{"home":"http://eclipse.org/kapua"},"gitbook":"3.x.x","description":"Eclipse Kapua™ User Guide"},"file":{"path":"mfa.md","mtime":"2020-11-26T08:22:34.032Z","type":"markdown"},"gitbook":{"version":"3.2.2","time":"2020-11-26T08:23:37.956Z"},"basePath":".","book":{"language":""}}); |
| }); |
| </script> |
| </div> |
| |
| |
| <script src="gitbook/gitbook.js"></script> |
| <script src="gitbook/theme.js"></script> |
| |
| |
| <script src="gitbook/gitbook-plugin-search/search-engine.js"></script> |
| |
| |
| |
| <script src="gitbook/gitbook-plugin-search/search.js"></script> |
| |
| |
| |
| <script src="gitbook/gitbook-plugin-lunr/lunr.min.js"></script> |
| |
| |
| |
| <script src="gitbook/gitbook-plugin-lunr/search-lunr.js"></script> |
| |
| |
| |
| <script src="gitbook/gitbook-plugin-sharing/buttons.js"></script> |
| |
| |
| |
| <script src="gitbook/gitbook-plugin-fontsettings/fontsettings.js"></script> |
| |
| |
| |
| </body> |
| </html> |
| |
