phax/phoss-smp phoss-smp-parent-pom-8.4.3

v8.4.3

on GitHub

• Added support for two-factor authentication (TOTP, RFC 6238) of the management GUI, based on the new library ph-totp 2.1.0.
  Based on #547 - thx @vrbyjimmy.
  See #295.
  The feature is opt-in and disabled by default - it must be enabled with the new configuration property smp.totp.enabled, and changing that property requires a restart.
  While it is disabled, the pages Administration / Two-factor authentication and Administration / Two-factor authentication of all users are not created at all, and existing enrollments are not enforced on login - they are retained though and become effective again as soon as the property is enabled.
  Each user enrolls individually via a QR code respectively the shared secret as text, and the enrollment only becomes active after it was confirmed with a code from the authenticator app.
  On confirmation 10 single-use recovery codes are shown once - only their SHA-512 hashes are stored - and a recovery code can be used instead of an authenticator code.
  Members of the Administrators user group can reset the second factor of a single user, for the case that both the authenticator device and the recovery codes were lost.
  A one-time password can only be used once, because the time slot it was generated for is remembered per user and is checked and stored atomically, and failed attempts are slowed down with an exponential backoff.
  The enrollments are stored in the configured backend - the new table smp_sectotp for SQL (migration V37), the collection smp-user-totp for MongoDB and the file smp-user-totp.xml for the XML backend.
  See the [[Security]] page for the details.
• Added the new configuration property smp.totp.enabled to enable the two-factor authentication of the management GUI.
  It defaults to false.
• The [[Status API]] contains the new item smp.totp.enabled, reflecting whether the two-factor authentication of the management GUI is enabled.
• Failed validations of the second authentication factor are now throttled per user, via the LoginThrottlePerIP of ph-oton, instead of per session.
  Previously the counter of the exponential backoff was kept in the session only, so that discarding the session cookie reset the delay and left the second factor effectively unthrottled.
  A dedicated throttle key is used - the user ID with the suffix -totp - so that it can neither be reset by rotating the source IP address, nor by the successful login that clears the throttle key of the first factor.
  Throttling per user is safe for the second factor, because it is only reached after the password was accepted.
• Added the new configuration property smp.totp.issuer to define the issuer shown in the authenticator app of a user.
  It identifies this SMP instance, so that several SMPs can be told apart in the same authenticator app.
  If it is not set, the application title is used, which is the previous behaviour.

What's Changed

• Added support for enabling two-factor authentication using totp. by @vrbyjimmy in #547

Full Changelog: phoss-smp-parent-pom-8.4.2...phoss-smp-parent-pom-8.4.3