129 lines
5.8 KiB
HTML
129 lines
5.8 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en" dir="ltr">
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<title>documentation:2.0:external2f</title>
|
|
<meta name="generator" content="DokuWiki"/>
|
|
<meta name="robots" content="noindex,nofollow"/>
|
|
<meta name="keywords" content="documentation,2.0,external2f"/>
|
|
<link rel="search" type="application/opensearchdescription+xml" href="lib/exe/opensearch.html" title="LemonLDAP::NG"/>
|
|
<link rel="start" href="external2f.html"/>
|
|
<link rel="contents" href="external2f.html" title="Sitemap"/>
|
|
<link rel="stylesheet" type="text/css" href="lib/exe/css.php.t.bootstrap3.css"/>
|
|
<!-- //if:usedebianlibs
|
|
<link rel="stylesheet" type="text/css" href="/javascript/bootstrap/css/bootstrap.min.css" />
|
|
//elsif:useexternallibs
|
|
<link rel="stylesheet" type="text/css" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css"></script>
|
|
//elsif:cssminified
|
|
<link rel="stylesheet" type="text/css" href="/static/bwr/bootstrap/dist/css/bootstrap.min.css" />
|
|
//else -->
|
|
<link rel="stylesheet" type="text/css" href="/static/bwr/bootstrap/dist/css/bootstrap.css" />
|
|
<!-- //endif -->
|
|
<script type="text/javascript">/*<![CDATA[*/var NS='documentation:2.0';var JSINFO = {"id":"documentation:2.0:external2f","namespace":"documentation:2.0"};
|
|
/*!]]>*/</script>
|
|
<script type="text/javascript" charset="utf-8" src="lib/exe/js.php.t.bootstrap3.js"></script>
|
|
<!-- //if:usedebianlibs
|
|
<script type="text/javascript" src="/javascript/jquery/jquery.min.js"></script>
|
|
//elsif:useexternallibs
|
|
<script type="text/javascript" src="http://code.jquery.com/jquery-2.2.0.min.js"></script>
|
|
//elsif:jsminified
|
|
<script type="text/javascript" src="/static/bwr/jquery/dist/jquery.min.js"></script>
|
|
//else -->
|
|
<script type="text/javascript" src="/static/bwr/jquery/dist/jquery.js"></script>
|
|
<!-- //endif -->
|
|
<!-- //if:usedebianlibs
|
|
<script type="text/javascript" src="/javascript/jquery-ui/jquery-ui.min.js"></script>
|
|
//elsif:useexternallibs
|
|
<script type="text/javascript" src="http://code.jquery.com/ui/1.10.4/jquery-ui.min.js"></script>
|
|
//elsif:jsminified
|
|
<script type="text/javascript" src="/static/bwr/jquery-ui/jquery-ui.min.js"></script>
|
|
//else -->
|
|
<script type="text/javascript" src="/static/bwr/jquery-ui/jquery-ui.js"></script>
|
|
<!-- //endif -->
|
|
</head>
|
|
<body>
|
|
<div class="dokuwiki export container">
|
|
<!-- TOC START -->
|
|
<div id="dw__toc">
|
|
<h3 class="toggle">Table of Contents</h3>
|
|
<div>
|
|
|
|
<ul class="toc">
|
|
<li class="level1"><div class="li"><a href="#commands">Commands</a></div>
|
|
<ul class="toc">
|
|
<li class="level2"><div class="li"><a href="#configuration">Configuration</a></div>
|
|
<ul class="toc">
|
|
<li class="level3"><div class="li"><a href="#selinux_note">SELinux note</a></div></li>
|
|
</ul></li>
|
|
</ul></li>
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<!-- TOC END -->
|
|
|
|
<h1 class="sectionedit1" id="external_second_factor">External Second Factor</h1>
|
|
<div class="level1">
|
|
|
|
<p>
|
|
This basic plugin can be used to add a second factor authentication device (SMS, OTP,...). It uses external commands to send or validate a second factor. Any language is allowed to call your 2nd factor system.
|
|
</p>
|
|
|
|
</div>
|
|
<!-- EDIT1 SECTION "External Second Factor" [1-249] -->
|
|
<h2 class="sectionedit2" id="commands">Commands</h2>
|
|
<div class="level2">
|
|
|
|
<p>
|
|
Commands receive arguments on command line and must return a 0 code if succeed, another else. <strong>Nothing must be written to STDOUT</strong>, STDERR is reported in logs <em>(but may be lost with FastCGI server)</em>.
|
|
</p>
|
|
|
|
</div>
|
|
<!-- EDIT2 SECTION "Commands" [250-476] -->
|
|
<h3 class="sectionedit3" id="configuration">Configuration</h3>
|
|
<div class="level3">
|
|
|
|
<p>
|
|
All parameters are configured in “General Parameters » Portal Parameters » Extensions » External 2nd Factor”.
|
|
</p>
|
|
<ul>
|
|
<li class="level1"><div class="li"> <strong>Activation</strong></div>
|
|
</li>
|
|
<li class="level1"><div class="li"> <strong>Code RegEx</strong>: regular expression to create an OTP code. Let this option blank to delegate code Generation / Verification to an external provider</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> <strong>Send command</strong>: define your command using <em>$attribute</em> like in rules. Example: <code>/usr/local/bin/sendOtp --uid $uid</code> or <code>/usr/local/bin/sendCode --uid $uid --code $code</code> if code is generated by the Portal</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> <strong>Validation command</strong>: Required ONLY if you delegate code Generation / Verification to an external provider. You must also use <em>$code</em> which is the value entered by user; Example: <code>/usr/local/bin/verify --uid $uid --code $code</code></div>
|
|
</li>
|
|
<li class="level1"><div class="li"> <strong>Authentication Level</strong>: if you want to overwrite the value sent by your authentication module, you can define here the new authentication level. Example: 5</div>
|
|
</li>
|
|
<li class="level1"><div class="li"> <strong>Logo</strong> (Optional): logo file <em>(in static/<skin> directory)</em></div>
|
|
</li>
|
|
</ul>
|
|
<div class="noteimportant">The command line is split in an array and launched with exec(). So you don't need to enclose arguments in “” and this feature protects your system against shell injection. However, you can not use any space except to separate arguments.
|
|
</div>
|
|
</div>
|
|
|
|
<h4 id="selinux_note">SELinux note</h4>
|
|
<div class="level4">
|
|
|
|
<p>
|
|
If your server is enforcing SELinux policies, make sure your external script has a label that is allowed to be executed by <code>httpd</code>.
|
|
</p>
|
|
|
|
<p>
|
|
For example, storing your script in <code>/usr/local/bin/</code> will give it a <code>bin_t</code> label that will work correctly.
|
|
</p>
|
|
|
|
<p>
|
|
If your script has a <code>httpd_sys_script_exec_t</code> type, it will only be able to do external network requests if the SELinux boolean <code>httpd_can_network_connect</code> is enabled.
|
|
</p>
|
|
|
|
<p>
|
|
If your script has any other label, it will probably not work at all.
|
|
</p>
|
|
|
|
</div>
|
|
<!-- EDIT3 SECTION "Configuration" [477-] --></div>
|
|
</body>
|
|
</html>
|