IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Selective login with TOTP token

    Posted 06/11/20 02:32 AM
    Hi,

    I have this question from a client:
    "After an initial login to WebSeal with username/password, we want to register the user for TOTP.
    After a successful registration, the TOTP token should be used 'as the password', i.e. login done with username/token"

    Is this a known scenario and/or is it desribed in a 'howto'?

    Many thanks in advance

    ------------------------------
    Anders Domeij
    CGI Sweden AB
    ------------------------------


  • 2.  RE: Selective login with TOTP token

    Posted 06/11/20 07:03 AM
    Hi Anders,

    This scenario is possible with Access Manager (with customization) although I would advise caution before implementing it because it creates a system where access is based only on "something you have" - unless the TOTP token generator can only be used with a PIN or Biometric.

    As you may have discovered, the TOTP authentication mechanism in AAC requires a username as an input parameter.  By default this comes from the logged in user (in which case the TOTP only works as a 2nd factor) but you can create a custom authentication policy which requests only a UserID from the user in a first (custom) step and then feeds this into the TOTP mechanism as a 2nd step.

    Here is a REALLY basic sample for that custom mechanism:

    Template File (/authsvc/authenticator/infomap/testLogin.html):

    <html>
  @MESSAGE@
  <form method="POST" action="@ACTION@">
    Username: <input name="uid"/>
    <input type="hidden" name="operation" value="verify"/>
    <input type="submit"/>
  </form>
</html>

    Infomap JavaScript:
    success.setValue(false);
page.setValue("/authsvc/authenticator/infomap/testLogin.html");
macros.put("@MESSAGE@","Please Login.");
var user = context.get(Scope.REQUEST,"urn:ibm:security:asf:request:parameter","uid");

if (user != null && user != "") {
    success.setValue(true);
    context.set(Scope.SESSION,
                "urn:ibm:security:asf:response:token:attributes","username",user);
}
​

    I hope this helps,

    Jon.

    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------



  • 3.  RE: Selective login with TOTP token

    Posted 06/12/20 07:08 AM
    Thanks Jon,

    I'll try it out :-)

    I totally agree with your security issue -- this in not any more secure than UserId/password.
    I believe, putting words in the client's mouth (which I shouldn't do), they are just fed up with people forgetting their passwords.

    Rgds
    Anders

    ------------------------------
    Anders Domeij
    CGI Sweden AB
    ------------------------------

    Original Message


Related Content