[Pass The SALT 2018] Second factor authentication in LemonLDAP::NG
0 likes120 views
This document summarizes multi-factor authentication (MFA) and its implementation in LemonLDAP::NG. MFA requires two or more factors of authentication, such as something you know (password), have (token), or are (biometrics). LemonLDAP::NG allows adding a second authentication step via one-time passwords (TOTP), Universal 2nd Factor (U2F) security keys, or external programs. Users can self-register and manage their MFA settings, and administrators can view current MFA sessions.
![[Pass The SALT 2018] Second factor authentication in LemonLDAP::NG](https://image.slidesharecdn.com/prepassthesalt20182fallng-181220085841/85/Pass-The-SALT-2018-Second-factor-authentication-in-LemonLDAP-NG-10-320.jpg)
![[Pass The SALT 2018] Second factor authentication in LemonLDAP::NG](https://image.slidesharecdn.com/prepassthesalt20182fallng-181220085841/85/Pass-The-SALT-2018-Second-factor-authentication-in-LemonLDAP-NG-11-320.jpg)
![[Pass The SALT 2018] Second factor authentication in LemonLDAP::NG](https://image.slidesharecdn.com/prepassthesalt20182fallng-181220085841/85/Pass-The-SALT-2018-Second-factor-authentication-in-LemonLDAP-NG-19-320.jpg)
[Pass The SALT 2018] Second factor authentication in LemonLDAP::NG
- 1. Second factor authentication in LemonLDAP::NG Pass the SALT 2018 Xavier GUIMARD Clément OUDOT
- 2. MFA / 2FA / OTP / U2F ?
- 3. Multi Factor Authentication Multi-factor authentication (MFA) is a method of confrming a user's claimed identity in which a user is granted access only after successfully presenting 2 or more pieces of evidence (or factors) to an authentication mechanism: ● knowledge (something they and only they know) ● possession (something they and only they have) ● inherence (something they and only they are) Definition from Wikipedia
- 4. Why you need it ● Passwords are still the main security token used to authenticate ● With GPU and rainbow tables it is more and more easy to crack a password ● A password base can be stolen ● Second factor authentication is hype (see Twitter, Github, LinkedIn...)
- 5. One-Time Password ● One-Time Password (OTP) is a password that is valid for only one login session or transaction ● Two standards: – HOTP (RFC 4226): HMAC-Based One-Time Password – TOTP (RFC 6238): Time-Based One-Time Password ● Rely on a secret shared between user and server
- 6. TOTP ● Shared secret key K ● T0: start time ● TI: time interval ● Time Counter TC = foor((unixtime(now) − unixtime(T0)) / TI) ● TOTP = Truncate( SHA1(K 0x5c5c… SHA1(K⊕ ∥ 0x3636… TC)) ) & 0x7FFFFFFF⊕ ∥ ● TOTP Value = TOTP mod 10d, where d is the desired number of digits of the one-time password
- 7. Using a TOTP ● Registration on client: shared key can be registered manually or using a QR code ● Server associates shared secret to user ● At next authentication, TOTP value is computed by client and server
- 8. Universal Second Factor ● Universal 2nd Factor (U2F) is an open authentication standard that strengthens and simplifes two-factor authentication using specialized USB or NFC devices. ● Managed by FIDO Alliance https://fdoalliance.org/ ● Support in modern browsers: – Chrome/Chromium ≥ 38 – Firefox: ● 38 to 56 with U2F Support Add-on ● 57 to 59, with “security.webauth.u2f” set to “true” in “about:confg” ● probably enabled by default for versions ≥ 60 – Opera ≥ 40
- 9. Using U2F ● Registration: Token generates private/public keys and a handle and send public key and handle to server ● The server associates the public key and the handle to user ● At next authentication, server sends the handle and a crypto challenge and the U2F token signs the challenge and sends it back
- 13. LemonLDAP::NG ● WebSSO, Access Control and Identity Provider ● Apache, Nginx, Node.js, Plack support ● Default protection by Handler, identity forwarded trough HTTP headers ● Standard protocols: CAS, SAML and OpenID Connect ● Self services (password change, password lost, account registration) ● GPL License ● https://lemonldap-ng.org
- 14. 2FA implementation ● New feature for 2.0 major version ● Possibility to add a second authentication step to any current authentication method ● A lot of possibilities to ask a second factor: – U2F tokens – TOTP (to use with FreeOTP, Google-Authenticator,…) – U2F-or-TOTP (enable both U2F and TOTP) – Yubikey tokens provide by Yubico – REST (Remote REST app) – External 2F (to call an external command)
- 15. Ask for second factor