LiRuochen_WorkFlow/MaxKey
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TimeBasedOtpAuthn

Browse Source
This commit is contained in:
MaxKey
2021-03-27 09:27:02 +08:00
parent 7d5ad8ba7f
commit e0454deea9
3 changed files with 5 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
maxkey-authentications/maxkey-authentication-core/src/main/java/org/maxkey/authn/AbstractAuthenticationProvider.java
View File

@@ -25,7 +25,6 @@ import org.maxkey.authn.realm.AbstractAuthenticationRealm;
import org.maxkey.authn.support.rememberme.AbstractRemeberMeService; import org.maxkey.authn.support.rememberme.AbstractRemeberMeService;
import org.maxkey.configuration.ApplicationConfig; import org.maxkey.configuration.ApplicationConfig;
import org.maxkey.constants.ConstantsLoginType; import org.maxkey.constants.ConstantsLoginType;
import org.maxkey.crypto.password.PasswordReciprocal;
import org.maxkey.domain.UserInfo; import org.maxkey.domain.UserInfo;
import org.maxkey.password.onetimepwd.AbstractOtpAuthn; import org.maxkey.password.onetimepwd.AbstractOtpAuthn;
import org.maxkey.web.WebConstants; import org.maxkey.web.WebConstants;
@@ -222,9 +221,7 @@ public abstract class AbstractAuthenticationProvider {
if (applicationConfig.getLoginConfig().isMfa() && authType.equalsIgnoreCase("tfa")) { if (applicationConfig.getLoginConfig().isMfa() && authType.equalsIgnoreCase("tfa")) {
UserInfo validUserInfo = new UserInfo(); UserInfo validUserInfo = new UserInfo();
validUserInfo.setUsername(userInfo.getUsername()); validUserInfo.setUsername(userInfo.getUsername());
String sharedSecret = validUserInfo.setSharedSecret(userInfo.getSharedSecret());
PasswordReciprocal.getInstance().decoder(userInfo.getSharedSecret());
validUserInfo.setSharedSecret(sharedSecret);
validUserInfo.setSharedCounter(userInfo.getSharedCounter()); validUserInfo.setSharedCounter(userInfo.getSharedCounter());
validUserInfo.setId(userInfo.getId()); validUserInfo.setId(userInfo.getId());
if (otpCaptcha == null || !tfaOtpAuthn.validate(validUserInfo, otpCaptcha)) { if (otpCaptcha == null || !tfaOtpAuthn.validate(validUserInfo, otpCaptcha)) {

5
maxkey-authentications/maxkey-authentication-otp/src/main/java/org/maxkey/password/onetimepwd/impl/TimeBasedOtpAuthn.java
View File

@@ -23,6 +23,7 @@ import java.util.Date;
import java.util.TimeZone; import java.util.TimeZone;
import org.apache.commons.codec.binary.Hex; import org.apache.commons.codec.binary.Hex;
import org.maxkey.crypto.Base32Utils; import org.maxkey.crypto.Base32Utils;
import org.maxkey.crypto.password.PasswordReciprocal;
import org.maxkey.domain.UserInfo; import org.maxkey.domain.UserInfo;
import org.maxkey.password.onetimepwd.AbstractOtpAuthn; import org.maxkey.password.onetimepwd.AbstractOtpAuthn;
import org.maxkey.password.onetimepwd.algorithm.TimeBasedOTP; import org.maxkey.password.onetimepwd.algorithm.TimeBasedOTP;
@@ -46,7 +47,9 @@ public class TimeBasedOtpAuthn extends AbstractOtpAuthn {
public boolean validate(UserInfo userInfo, String token) { public boolean validate(UserInfo userInfo, String token) {
_logger.debug("utcTime : " + dateFormat.format(new Date())); _logger.debug("utcTime : " + dateFormat.format(new Date()));
long currentTimeSeconds = System.currentTimeMillis() / 1000; long currentTimeSeconds = System.currentTimeMillis() / 1000;
byte[] byteSharedSecret = Base32Utils.decode(userInfo.getSharedSecret()); String sharedSecret =
PasswordReciprocal.getInstance().decoder(userInfo.getSharedSecret());
byte[] byteSharedSecret = Base32Utils.decode(sharedSecret);
String hexSharedSecret = Hex.encodeHexString(byteSharedSecret); String hexSharedSecret = Hex.encodeHexString(byteSharedSecret);
String timeBasedToken = ""; String timeBasedToken = "";
if (crypto.equalsIgnoreCase("HmacSHA1")) { if (crypto.equalsIgnoreCase("HmacSHA1")) {

4
maxkey-web-manage/src/main/java/org/maxkey/web/api/endpoint/RestTimeBasedOtpController.java
View File

@@ -52,10 +52,6 @@ public class RestTimeBasedOtpController {
UserInfo validUserInfo = userInfoService.loadByUsername(username); UserInfo validUserInfo = userInfoService.loadByUsername(username);
if(validUserInfo != null) { if(validUserInfo != null) {
String sharedSecret =
PasswordReciprocal.getInstance().decoder(validUserInfo.getSharedSecret());
validUserInfo.setSharedSecret(sharedSecret);
validUserInfo.setSharedCounter(validUserInfo.getSharedCounter());
if(timeBasedOtpAuthn.validate(validUserInfo, token)) { if(timeBasedOtpAuthn.validate(validUserInfo, token)) {
return true; return true;
} }