All geek questions in one place

Recommended Design for OTP / 2FA Support in OAuth2

I am trying to add OTP / 2FA support to OAuth2, but after reading RFC6749 it is still not clear how to carefully add OTP / 2FA without violating the specifications.

Although an OTP / 2FA record can be added to the conversation stream authorize, there are no conditions for adding it to token. For example, publicclient applications with privileges on Resource owner password-basedmay not want to provide a token directly when they request a new one access_token, rather than embed an HTML dialog box.

Therefore my questions are these;

  • grant_typeIs RFC Custom grant_type? Should this be used to provide 2FA / OTP functionality?

  • grant_typeDoes RFC have additional attributes for an existing one grant_type? For example, grant_type=token&otp_code=1234(the RFC does not make it clear whether additional attributes are allowed grant_typein the specification)

  • Should OTP functions be placed in headers? This is the approach that Github has used , but it seems really ugly / hacky.

  • Are there any other approaches that I have missed?

thank you in advance

+6
source share
4 answers

The RFC permits the provision of an additional (custom) grant, see https://tools.ietf.org/html/rfc6749#section-8.3 . This grant may define additional attributes.

OAuth 2.0 , , . .

+1

- . , , , 2fa/mfa/otp ( ) / .

, mfa totp ( , ). , (, ).

MFA/2FA/OTP .

OAuth2, , Authenticator:

OAuth, .

+1

Hanz Z: OTP. OTP ( , ).

, (X-OAuth2-OTP= 01234567). , OTP, .

0

Based on the specified SCOPE (for example, OTP), you can mark the carrier channel (access_token) as "" Verified_otp = false "" on the backend, and then, after the authorization server has received a valid otp for this session, mark your carrier channel ( access_token) as "" Verified_otk = true "." ". For your resource server, check the Verified_otk field before authorizing calls that depend on this check.

0
source

Source: https://habr.com/ru/post/1609400/

More articles:


All Articles