wso2-extensions / identity-outbound-auth-push

Aims at implementing biometric authentication for WSO2 IS.

identity-outbound-auth-push

---

Introduction

Push-Based Authentication lets a user authorize an authentication request using a dedicated mobile application. The technology used for sending the authentication request to the mobile phone is push notifications. By using this technology, it is possible to complete a secure and convenient multi-factor authentication flow.

Documentation

For installing the push-based authentication extension

• Installation Guide

For enabling push-based authentication and using it as a multi-factor authentication factor

• Identity Developer Setup Guide

For understanding the architecture and components of the push-based authenticator

• Architecture Documentation

For developing mobile apps to use push-based authentication

• React Native SDK Documentation

Contribute

Please read Contributing to the Code Base for details on our code of conduct, and the process for submitting pull requests to us.

Reporting Issues

We encourage you to report issues, improvements, and feature requests creating Github Issues.

Important: And please be advised that security issues must be reported to [email protected], not as GitHub issues, in order to reach the proper audience. We strongly advise following the WSO2 Security Vulnerability Reporting Guidelines when reporting the security issues.

License

This project is licensed under the Apache License 2.0. See the LICENSE file for details.

identity-outbound-auth-push's Issues

Check on how consent approval can be done through the mobile app

Description:
Check on how consent approval can be done through the mobile app

Add capability for an Identity Developer to define authentication methods to be used

Description:
Add capability for the Identity Developer to define the exact method to be used for authentication (As adaptive authentication)
Ex: Fingerprint only

Related Issues:
#20

Improve authentication flow for instance of selecting one out of multiple registered devices

Description:

Currently, the flow consists of

1. Check if 1 or more devices is registered
2. If more than 1 then redirect to the device selection page
3. When a device is selected it calls the sendRequest method through the servlet

It should be changed such that

1. Check if 1 or more devices is registered
2. Authentication instance is marked as incomplete and re-directed to device selection page
3. Send the selection back to the authenticator from commonauth API
4. Re-initialize auth at canHandle and call sendRequest from there

Update the authentication request payload to support SDK requirements

Description:
The current data payload structure doesn't support the required information that needs to be displayed for an authentication request. Update the data sent from the server-side to support the below requirement

• Connection code
• Username
• Email
• Organization
• Service Provide / Application
• SP URL
• Device accessing the SP
• Web browser used
• IP Address
• Location (approximate/optional)

Use a unique value for getting the list of devices in the device handler

Description:

The current implementation gets the list of devices using the username of the user which is used to get the User ID. While this implementation will work for the super tenant, conflicts may occur when more than 1 tenant is available as the same username may appear in multiple places.

The following changes will have to be made to fix the issue

• User ID passed as the argument from push authenticator class
• User ID passed as the argument from API

Merge PR for biometric authentication in identity-apps

Description:
Merge the PR which adds the functionality for biometric authentication in the identity server found in the identity-apps repo.

Related Pull Request
wso2/identity-apps#973

Note
The version of the node modules for babel should be updated to v7.9.0 in the package.json file

Handle scenario of attempting to register an already registered device

Description:
Attempting to register an already registered device throws a SQL exception on the server side and returns an error 500 to the mobile app. The device can be registered with only 1 user that is in the same database.

The issue is caused by the PushID being considered as a unique value.

The response should be handled on the mobile app SDK and the QR code that should be scanned in order to register should be replaced with a message acknowledging the request was received and that it was for an already registered device.

Change signing algorithm for mobile authentication

Description:
The current implementation uses DSA as the signing algorithm. The libraries for React Native have a minimal support for DSA. The process can be aligned with TOTP standards by changing the signing algorithm to ECDSA or RSA.

Change endpoint for remove device API for mobile app use

Description:

The current implementation handles requests to remove the device that is called from the mobile app using the servlet. Instead use an endpoint from the Me API to handle the scenario as it should align with the functionalities of the Me API.

Provide the capability to optionally end the authentication flow at the authentication device end

Currently when the authentication device sends the authentication service to the IS there is a jsp page polling for the result and completed the flow at the consumption device end.
Optionally give the capability to end the authentication flow at the authentication device end while handling consent as well at the authentication device end.

related to: #31

Create Firebase test account

Description:
Create a Firebase account that can be used to have the test project for managing the push notifications sent to WSO2 Verify.

Add capability to use any push notification service for sending authentication request from IS

Description:
The current implementation of the push-based authenticator uses Firebase Cloud messaging to send the authentication data from IS to the mobile app. Add the capability for any other push notification service to be configured from the IS to be used for this purpose.

Change API to support the authentication method

Description:
Currently only the 3-factor authentication (basic login + accept on app + biometric) is supported. Change the API to support 2-factor authentication (basic login + accept on app) as well.

Related Issues:
#20

Handle login attempt when a device isn't registered on IS for push-auth

Description:

If the user hasn't registered a device with the IS for push-based authentication, the devices page is displayed with no other links to either register a device or a message asking to register a device through my account.

Either

1. Add an option to register a device during the authentication
2. Display a message stating that a device should be registered in order to authenticate and give a hyperlink to my account

Merge opened PRs

Description:
Merge the opened pull requests related to biometric authentication

PRs to be merged

identity-outbound-auth-biometric

• #5 "WSO2 Verify" Mobile Application

• #12 Update pom files of the component

• #9 Model classes of the bio-metric device handler component

• #6 Biometric Device Handler Cache

• #8 Device handler exceptions

• #11 Device handler bundle activator and util classes

• #7 Device handler dao

• #10 Device handler core classes

• #13 "WSO2 Verify" Android mobile application

• #14 Modify Authentication flow to support device handler functions

• #15 Extend the Android Mobile app to support device registration and Improve the Authentication Flow

identity-apps

• wso2/identity-apps#973 Implement New Module to support the Biometric Authenticator Device Management Functionalities

Note
The version of the node modules for babel should be updated to v7.9.0 in the package.json file

identity-api-user

• wso2/identity-api-user#91 Rest APIs for Biometric Device Registration

• wso2/identity-api-user#94 Parent pom and pom files of the device handler component

• wso2/identity-api-user#92 Utility classes for Biometric Device Handler Rest APIs

• wso2/identity-api-user#93 Autogenerated classes of the Biometric device handler Rest API component

• wso2/identity-api-user#97 Service class for biometric device handler Rest APIs

• wso2/identity-api-user#98 Implementation of biometric device handler Rest APIs

• wso2/identity-api-user#99 Resource files of the Biometric device handler Rest API component

identity-rest-dispatcher

• wso2/identity-rest-dispatcher#206 Add the Biometric Authenticator Rest Api Component

Improve the bio metric authenticator to support CIBA flow

Description:
Currently, the biometric authenticator is not supporting the CIBA flow, we need to improve it to handle it

Rename the repository

Description:
Rename the repository to give a more meaningful name when the QR code authentication feature is added

Improve caching upon authentication confirmation from device

Description:
Currently the a GET request is used to poll the server for the authentication request. As an issue can arise when the get request is sent over and over again this function should be change to use a POST request instead.

Check if push notifaction token changes in iOS

Description:
Check if the push notification token generated by Firebase registered on an iOS device changes over a period of time as the app is used.

Change the key length of the keypair generated for signing challenge text

Description:
The current implementation supports a key length of 2048 bits which reduces the performance of the React Native mobile app. Change the length of the keypair to 1024 bits in both the SDK and the server-side.

Create Rest API as a separate component

Description:
Creating the Rest API for the QR code authentication as a separate component.

Make push notification provider configurable

Description:
Currently, the authenticator is written to be used with the firebase push notification service. We need to make the push notification provider configurable.

Develop WSO2 Verify mobile app using React Native

Description:
WSO2 Verify is currently developed only for Android mobile devices. Develop the app for production using React Native to support both Android and iOS. As a first phase, have only the capability of authenticating users through push.

• Implement the ability to integrate app side capability as a library

Test Biometric Authenticator integrated in the Identity Server

Description:
Setup biometric authentication in the Identity Server and test its functionality using the mobile application by adding biometric as the outbound authentication method for an app using the identity server.

Suggested Labels:
Task, Milestone

No persistent layer available for device authentication

Description:
The device authentication status is currently stored in a variable on which the current polling mechanism relies on. It should be handled properly.

Possible solution:
Using a session datastore

Implement validations for remove device request from mobile app

Description:

The remove device requests from the mobile app are completed from the server-side without any validations. Do the necessary validations prior to executing the remove device task.

Implement the ability to integrate app side capability as a library

Description:
Ability to integrate app side capability as a library , so that any custom app can have push notification capability with WSO2 IS.

Change SQL queries to refer to push authenticator table

Description:

The current implementation works with the table for Biometric authentication in the database. Change the table name and the required queries as Push authentication as the authenticator name has been changed.

Large number of requests sent to IS for push-based auth to verify authorization status from mobile app

Description:
The waiting page for authorization (until the login request is accepted in the mobile app) sends a large number of requests per second to the server which may affect the performance. Make changes to resolve this issue.

In the above screenshot 1992 requests have been sent to the IS within a span of 50s to check if the login has been authorized.

Implement a function to resend the QR Code in case FCM fails

Description:
Currently the users do not have a secondary way of getting the details required for authentication through the mobile application in a scenario FCM fails. In order to avoid the issue a secondary method, preferably displaying a QR code containing the same data sent through firebase. The method used in the registration flow in order to scan the QR code can be modified and used for this function as well.

Merge PRs for biomentric authentication in identity-api-user

Description:
Merge the pull requests that are related to biometric authentication found in the identity-api-user repo

Pull Requests to be Merged
wso2/identity-api-user#91
wso2/identity-api-user#92
wso2/identity-api-user#93
wso2/identity-api-user#94
wso2/identity-api-user#97
wso2/identity-api-user#98
wso2/identity-api-user#99

Optimise registration flow by changing attributes in QR code and server response

Description:

Currently, the QR code for registration contains multiple attributes that are not needed for the registration process but only required for storing the account information.

Have only the attributes required for the registration in the QR code and send all the account information back as the response to the registration request from the server when the request is completed.

Parameters duplicated in request to FCM to initiate authentication push message causing a false OK response

Description:
Some of the fields in the request sent to Firebase cloud messaging to send the authentication push notification to the mobile device have been duplicated causing the push notification to not arrive, but the server to get a response code 200.

How to fix:
Adjust the request to take the following format

{
    "notification": {
        "body": "admin is trying to log into pickup-dispatch at localhost",
    },
    "content_available": true,
    "data": {
        "sessionDataKey": "f089dfe7-d789-491b-9296-bb34ad8d5dde",
        "challenge": "2da478cd-ca29-4696-8b26-0451746d0612",
        "body": "admin is trying to log into pickup-dispatch at localhost",
        "click_action": "AuthenticateActivity",
        "deviceId": "ac17f16f-c12c-4138-95ef-0af6e2c5824d"
    },
    "to": "fQrUKjM_TyWc2w4QrK8vyB:APA91bFsNHubZZJJnhrxD_VG....",
    "priority": "high"
}

Changes should be made in identity-outbound-auth-biometric/components/org.wso2.carbon.identity.application.authenticator.biometric/src/main/java/org/wso2/carbon/identity/application/authenticator/biometric/notification/handler/impl/FirebasePushNotificationSenderImpl.java

Add capability to send the selected login method data to the device and to make the device honor the selection

Description:
Add the capability for the device to give only the authentication methods defined by the user or the developer for the particular login.
Ex: Fingerprint to be the only biometric authentication method offered to verify the user

Should check if the required biometrics are recorded in the device to complete this task.

Related Issues:
#20

Discuss how "WSO2 Verify" is going to be implemented for iOS

Description:

• Discuss if the mobile application development is going to be continued on native platforms when implementing for iOS as well or whether the development is going to be restarted using a cross platform framework.

Use a standardized icon pack for the icons in the app

Description:
The icons used in the app are from different packs and are saved as images. Import the icons in a suitable way and consistently use the icons from the same pack throughout the app.

Handle exception for get device API when a device is not found

Description:

The server throws an exception when polled to check if the device to be registered has got added to the database causing the exception to be thrown multiple times in the server with the full stack trace. The API returns 500 Internal server error

Handle the exception from the API component and return a 404 HTTP status code for the API call to indicate that the device is not found.

Add functionality to select authentication mechanism ex: biometric or push notification only

Description:
Ability to select either biometric authentication or push notification only when prompting to authenticate

• #33 - Change API to support the authentication method
• #34 - Add capability to the device to send at registration the authentication method it supports
• #35 - Add capability for an Identity Developer to define authentication methods to be used
• #36 - Add capability to login portal UI for a user to select the authentication method at login time
• #37 - Add capability to send the selected login method data to the device and to make the device honor the selection

Update variable names in push-auth device management module in my account according to API changes

Description:

Some of the functionalities in the UI component for push-auth device management have broken as a result of changes made to the APIs (eg: get a device by its device id).

Implement the changes as required for the components to work as before

Add capability to login portal UI for a user to select the authentication method at login time

Description:
Add the capability for the user to select the preferred authentication methods to log into a given app from the user portal

Related Issues:
#20

Add capability to the device to send at registration the authentication method it supports

Description:
Add the capability for the app to send a list of available authentication methods in the device as part of the registration.
Eg: Fingerprint, Face ID, Iris, Pin, Pattern, etc

Related Issues:
#20

Design UI/UX for the mobile app

Description:
Design the UI/UX that will be used when developing the push-based authentication mobile app

Send a key in push notification by which the auth request message can be processed at device end

Description:

The push notification message for an auth request is processed by the authenticator and sends the full text which gets processed there.
Modify it to send a key by which the developer can process the message on the app end to display when an auth request is received.

Providing the capability to terminate sessions from the mobile application

Description:
This will be a feature addition to the mobile application where we can use the session termination REST API to give the capability to terminate user sessions through the mobile application.

Sign the challenge sent from Identity Server to the Device

Description:
Sign the challenge sent from Identity Server to the Device. This will be used by the device to verify that the push notification came from the Identity Server. Since we will be using a 3rd party service to send push notification this will be useful.

Implement UI as a component

Description:
Create the UI elements required for the QR code authenticator as a component of the biometric authenticator.

Function to Send notifications to the device when changes are been made from the user portal

Description:
Currently the feature does not consists of a function to send the mobile device a notification when device details have been altered or removed from the user portal. While the device should simply get notification when the device name is changed the notification sent when a device is removed should also remove the data from the device upon clicking the notification.

Refactor Discovery Data method name to be more meaningful

Description:

Discovery data can appear in many authenticator components leading to confusion as to its purpose. Refactor to a more meaningful name for this instance such as getRegistrationDiscoveryData()

Changes should be made in the components below

• Device handler component
• API component where the method gets called

Merge PR for Biometric Authentication in identity-rest-dispatcher

Description:
Merge the pull request for adding the Biometric Authenticator rest api component to the identity-rest-dispatcher repo

Pull Request to merge
wso2/identity-rest-dispatcher#206

Auth request gets allowed for any response keyword

Description:

When the authorization request is sent the keyword "SUCCESSFUL" or "DENIED" should be given as auth_status. While the request gets denied only when the proper keyword is added, the request gets authorized with any keyword placed instead of "SUCCESSFUL"

Do proper validation on the server-side