4.0 KiB
#Registration: 2FA
Sprint: 2
Outcome:
2 factor authentication is a feature that helps users to secure their activities. For critical activities the app needs a code to be completed. At first vault creates a code (that showed with QR) to sync with google authenticator. After adding code in the user's google authenticator, every time a user needs OTP(one-time-password) can read it in his app.
Implementation description:
Endpoints:
GET {$domain}/api/v2/barong/resource/otp/generate_qrcode
POST {$domain}/api/v2/barong/resource/otp/enable
POST {$domain}/api/v2/barong/resource/otp/enable_2fa
POST {$domain}/api/v2/barong/resource/otp/disable
POST {$domain}/api/v2/barong/resource/otp/disable_email
File destination:
{$Dalan_Path}/app/api/v2/resource/otp.rb
Commits:
bd7f980596 dc95b308a6 b3b5a08d60 3c170120c1 a79e06a71b 8c821f1ba4 e04a58b012 99c2552404 63f69ed0d6 7010449976 4d55a48572 2da71b1097
What did we implement:
We add an authorization step to enable/disable 2FA. After entering the google authenticator code, an authorization email is sent to the user containing an OTP . Users only can enable or disable 2FA after entering the correct OTP from the email.
New flow:
System generates the code → User scan it with mobile → enters the google code → Receives the email →The user enters the code → 2FA enable/disable
sequenceDiagram
title: 2fa activation
User->>Ranj: generate Qr Code
Ranj-->>Dalan: get /generate_qrcode
Dalan->>Ranj: 400, message: '2FA has been enabled for this account'
Dalan->>Ranj: 401, message: 'Invalid bearer token'
Dalan->>Ranj: 400, message: '2FA has been already sent email for this account(enabling process started)'
Dalan->>Ranj: 200, QR params
Ranj->>User: QR
User->>Ranj: User scan and enter code
Ranj-->>Dalan: post /enable params:{code:string}
Dalan->>Ranj: 400, message: '2FA has been enabled for this account or code is missing'
Dalan->>Ranj: 401, message: 'Invalid bearer token'
Dalan->>Ranj: 422, message: 'Validation errors'
Dalan->>Ranj: 422, message: 'OTP code is invalid'
Dalan->>Ranj: 422, message: '2FA has been already sent email for this account(enabling process started)'
Ranj->>User: show result
Dalan->>User: send email in case of success
User->>Ranj: enter authorization code
Ranj-->>Dalan: post '/enable_2fa' params:{code:string}
Dalan->>Ranj: 400, message: '2FA has been enabled for this account or code is missing
Dalan->>Ranj: 401, message: 'Invalid bearer token'
Dalan->>Ranj: 422, message: 'Validation errors'
Dalan->>Ranj: 400. message: '2FA has been already enabled for this account'
Dalan->>Ranj: 400, message: '2FA hasnt been enable'(didnt start enabling process)
Dalan->>Ranj: 422, message: 'OTP code is invalid'
Dalan->>Ranj: 200
Ranj->>User: success
sequenceDiagram
title: 2fa deactivation
User->>Ranj: enter google authentication code
Ranj-->>Dalan: post /disable params:{code:string}
Dalan->>Ranj: 400, message: '2FA has not been enabled for this account or code is missing'
Dalan->>Ranj: 401, message: 'Invalid bearer token'
Dalan->>Ranj: 422, message: 'Validation errors'
Dalan->>Ranj: 422, message: 'OTP code is invalid'
Dalan->>Ranj: 422, message: '2FA has been already sent email for this account(disabling process started)'
Ranj->>User: show result
Dalan->>User: send email in case of success
User->>Ranj: enter authorization code
Ranj-->>Dalan: post '/disable_email' params:{code:string}
Dalan->>Ranj: 400, message: '2FA has not been enabled for this account or code is missing
Dalan->>Ranj: 401, message: 'Invalid bearer token'
Dalan->>Ranj: 422, message: 'Validation errors'
Dalan->>Ranj: 400. message: '2FA has been already disabled for this account'
Dalan->>Ranj: 400, message: '2FA has been already sent email for this account'(didnt start enabling process)
Dalan->>Ranj: 422, message: 'OTP code is invalid'
Dalan->>Ranj: 200
Ranj->>User: success