2FA in a webapp using PASOE and HybridRealm

Posted by MTBOO on 21-Dec-2016 04:54

Hi,

We are developing a web app to run on PASOE with OERealm SPA security model. Front end uses JSDO and Kendo UI with backend business entities exposed via REST service.

We have written a custom HybridRealm class to validate the user and password against our own user table in our database to authenticate the user, create a spring security token and login to the app which sets roles when the user is authenticated.

We want to add another layer of security by implementing a second factor for authentication so after the user enters username and password, they are sent via SMS a code.

The way I can see this working is as follows:

1) User authenticates with username and pwd to create a session id but if the back-end decides 2FA is required, sends an SMS to the user and sets a specific role on login

2) URL intercept patterns only allow access to the resources to validate 2FA code when this specific role is set

3) 2FA page asks for code which uses invoke method on back-end to validate the code for current session

4) If code is valid, role is changed so access is allowed to core app resources

The issue I have here is determing how to change the role as I can see it, this can only be done once on initial login and cant be changed/set again until the user logs out.

Any pointers/ideas would be great. Not sure what the PRE_AUTH_FILTER mechanism does, but perhaps this might help? Similar mechanism would be required for a force password change type feature.

Thanks

Mobile - Forum
Posted by Michael Jacobs on 22-Dec-2016 05:58


What you are doing with the 2 factor security is going in the right direction.  I *think* it can be done, and it would be an interesting advanced Spring Security configuration that would probably start with the oeablSecurity-form-oerealm.xml configuration template.  As I started writing it, I realized that the details would be large and maybe not appropriate for a forum, plus some of the real low level details you would have to supply based on your application.   If you are interested, we can connect offline, talk, and see if a means could be found to achieve your goals?

Just a couple of technical points that were asked :

.  The OERealm functionality implements the Spring Security AuthenticationProvider interface, which acts a raw source of user account data to Spring Security's client-authentication process call-out.  The OERealm server class (ie. what is derived from HybridRealm) can only fail the client authentication or return raw account data.  Your OERealm class will not know 100% if Spring Security fails the client authentication or not - therefore not knowing whether to push the SMS message or not.

.  The PRE_AUTH_FILTER is a dependency-injection point in the Spring Security process where you can inject a customized [Java] Spring bean.  Spring Security provides this injection point for handling SSO security token validation for token that were created by some external security service

Let me know if you want to dive into the details.

Mike J.

All Replies

Posted by Michael Jacobs on 22-Dec-2016 05:58


What you are doing with the 2 factor security is going in the right direction.  I *think* it can be done, and it would be an interesting advanced Spring Security configuration that would probably start with the oeablSecurity-form-oerealm.xml configuration template.  As I started writing it, I realized that the details would be large and maybe not appropriate for a forum, plus some of the real low level details you would have to supply based on your application.   If you are interested, we can connect offline, talk, and see if a means could be found to achieve your goals?

Just a couple of technical points that were asked :

.  The OERealm functionality implements the Spring Security AuthenticationProvider interface, which acts a raw source of user account data to Spring Security's client-authentication process call-out.  The OERealm server class (ie. what is derived from HybridRealm) can only fail the client authentication or return raw account data.  Your OERealm class will not know 100% if Spring Security fails the client authentication or not - therefore not knowing whether to push the SMS message or not.

.  The PRE_AUTH_FILTER is a dependency-injection point in the Spring Security process where you can inject a customized [Java] Spring bean.  Spring Security provides this injection point for handling SSO security token validation for token that were created by some external security service

Let me know if you want to dive into the details.

Mike J.

This thread is closed