Multi Factor Auth

Multi Factor Auth

Current state (without MFA)

• user get two tokens after login:
  • shortTerm token (for auth)
  • longTerm refresh-token (for get new shortTerm token)
• they have the same content: id (+ extraData from hooks)

Concept

The shortTerm token contains which providers used for authenticating (eg.: LDAP, Facebook, email), so the client application can handle this information.

Each provider can have an optionally expiration condition:

• expiration after X time after login (eg: 30 day: when login at may 1 then expiring on jun 1)
• expiration after X time inactivity (eg: 2 day: if the user use every day then will not expire)

The longTerm token contains which providers used + the providers login time and the longTerm token creation time.

When client call refresh-token api, we check each provider and remove that if it expired.

Conditions

• expiration after X time after login: 'current time' - token.providers.'provider'.loginAt < 'X from config'
• expiration after X time inactivity: 'current time' - token.createdAt < 'X from config'

Example - Logins

1. Login with Facebook at 2019-10-16T20:04:06Z

shortTerm token:

{ "id": "user-id-1", "providers": ["facebook"] }

longTerm token:

{
  "id": "user-id-1",
  "createdAt": 1571256246000
  "providers": [
    { "name": "facebook", "loginAt": 1571256246000 }
  ]
}

2. Call refresh-token api at 2019-10-16T20:06:57Z

shortTerm token (not changed):

{ "id": "user-id-1", "providers": ["facebook"] }

longTerm token (createdAt changed):

{
  "id": "user-id-1",
  "createdAt": 1571256417000
  "providers": [
    { "name": "facebook", "loginAt": 1571256246000 }
  ]
}

3. Login with LDAP at 2019-10-16T20:09:21Z

shortTerm token (ldap added to providers):

{ "id": "user-id-1", "providers": ["facebook", "ldap"] }

longTerm token (createdAt changed, and ldap added to providers):

{
  "id": "user-id-1",
  "createdAt": 1571256561000
  "providers": [
    { "name": "facebook", "loginAt": 1571256246000 },
    { "name": "ldap", "loginAt": 1571256561000 }
  ]
}

Example - expiration after X time after login

Config:

• ldap expiration after 1 hour after login
• google expiration after 2 hour after login

1. Login with LDAP at 2019-10-16T20:04:06Z and Login with Google at 2019-10-16T20:09:21Z

shortTerm token:

{ "id": "user-id-1", "providers": ["ldap", "google"] }

longTerm token:

{
  "id": "user-id-1",
  "createdAt": 1571256561000
  "providers": [
    { "name": "ldap", "loginAt": 1571256246000 },
    { "name": "google", "loginAt": 1571256561000 }
  ]
}

2. Call refresh-token api at 2019-10-16T21:04:06Z (ldap login + 1 hour)

shortTerm token (ldap removed from providers):

{ "id": "user-id-1", "providers": ["google"] }

longTerm token (createdAt changed, ldap removed from providers):

{
  "id": "user-id-1",
  "createdAt": 1571259846000
  "providers": [
    { "name": "google", "loginAt": 1571256561000 }
  ]
}

3. Call refresh-token api at 2019-10-16T22:09:21Z (google login + 2 hour)

ERROR 401 because zero provider left

Steps:

• add createdAt to longTerm token
• add providers to shortTerm and longTerm token
• auth service login improve with optionally existing token (login with second/third/etc provider)
• improve providers api to login with existing token
• auth service register improve with optionally existing token (login with second/third/etc provider)
• improve providers api to register with existing token
• add expiration logic to refresh-token api
• core api optionally requires multi auth (from config. eg: ldap,totp only access when have ldap and totp)