Page Comparison

...

I would like to give as much flexibility as possible to the users and system administrator to allow for a flawless authentication without much hassle - we would allow the system administrator to select the delivery method of the one time passwords. Currently it is planned to support delivery via SMS / Email but the system should be made so it could be easily extended to support time-based one-time passwords(RFC 6238). 

Project details

Two-factor authentication workflow

1. User authenticates via basic auth / Oauth2

2. If successful, field(“isTwoFactorAuthenticationRequired”) indicates whether 2FA is enabled

3. If 2FA is enabled, the client sends a request to get a list of available delivery methods to authenticated user(see Getting a list of delivery methods)

4. The client sends a request to to generate & send OTP via their selected method(see Requesting OTP)

1. OTP token is generated and saved in-memory

2. Token is sent via SMS/Email bridge

3. Information returned: OTP delivery method, delivery destination(email / phone number), OTP validity period

4. User has at most one active OTP request. If another OTP is requested, all previous OTP requests are invalidated

5. User receives token and the client sends it to an endpoint to validate it (see Validating OTP)

1. If token is valid and hasn’t expired

2. Information returned: access token, access token expiry time

6. User sends the access token as a header(Fineract-Platform-TFA-Token) on every request

7. User is allowed to have multiple two-factor access tokens:

   1. Can support multiple devices

8. Client invalidates access token on logout / session end.(see Invalidating Access Token)

Fineract Implementation Details

...

Message parameters support template data. List of supported template parameters:

• username, email, mobileno(if user has mobileno)
• firstname, lastname
• token, tokenlivetime
• requestdate, requesttime
• expiredate, expiretime

API Endpoints

There are 3 endpoints that serve two-factor authentication requests:

...

{
    "token": "cb0bb6e33fc540709d50a16eb2e555f9",
    "validFrom": 1501530702801,
    "validTo": 1501617102801
}

Invalidating Access Token

Anchor
api_invalidate api_invalidate

Invalidates an active access token.

Requires fully authenticated user.

{
    "token": "fa368f984b0d4e96a73ea57dca4e110d"
}

{
    "resourceIdentifier": "fa368f984b0d4e96a73ea57dca4e110d"
}

...