Skip to content

Commit

Permalink
docs: fix corrections #2201
Browse files Browse the repository at this point in the history
  • Loading branch information
maduvena committed Aug 23, 2022
1 parent 5357f1c commit 94e79d6
Show file tree
Hide file tree
Showing 3 changed files with 26 additions and 24 deletions.
36 changes: 18 additions & 18 deletions docs/admin/developer/scripts/person-authentication-fido2.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ to implement a two-step, two-factor authentication (2FA) with username / passwor

## Prerequisites
- A Janssen Server ([installation instructions](https://github.com/JanssenProject/jans#installation))
- [FIDO2 interception script](https://github.com/GluuFederation/oxAuth/blob/master/Server/integrations/fido2/Fido2ExternalAuthenticator.py) (included in the default Gluu Server distribution);
- [FIDO2 interception script](https://github.com/JanssenProject/jans/blob/main/docs/script-catalog/person_authentication/fido2-external-authenticator/Fido2ExternalAuthenticator.py) (included in the default Janssen Server distribution);
- At least one FIDO2 device for testing, like one of the devices [listed below](#fido2-devices).

### FIDO2 devices
Expand Down Expand Up @@ -94,36 +94,36 @@ graph TD
A[ou=jans] --> K(ou=people)
K --> K1[inum=....]
K1 --> K11[ou=fido2_register]
K11 --> K111[oxId=....]
K11 --> K112[oxId=....]
K11 --> K112[oxId=....]
K11 --> K111[jansId=....]
K11 --> K112[jansId=....]
K11 --> K112[jansId=....]
K1 --> K12[ou=fido2_auth]
K12 --> K121[oxId=....]
K12 --> K122[oxId=....]
K12 --> K123[oxId=....]
K12 --> K121[jansId=....]
K12 --> K122[jansId=....]
K12 --> K123[jansId=....]
K --> K2[inum=....]
K2 --> K21[ou=fido2_register]
K21 --> K211[oxId=....]
K21 --> K212[oxId=....]
K21 --> K212[oxId=....]
K21 --> K211[jansId=....]
K21 --> K212[jansId=....]
K21 --> K212[jansId=....]
K2 --> K22[ou=fido2_auth]
K22 --> K221[oxId=....]
K22 --> K222[oxId=....]
K22 --> K221[jansId=....]
K22 --> K222[jansId=....]
K22 --> K223[oxId=....]
K --> K3[inum=....]
K3 --> K31[ou=fido2_register]
K31 --> K311[oxId=....]
K31 --> K312[oxId=....]
K31 --> K312[oxId=....]
K31 --> K311[jansId=....]
K31 --> K312[jansId=....]
K31 --> K312[jansId=....]
K3 --> K32[ou=fido2_auth]
K32 --> K321[oxId=....]
K32 --> K322[oxId=....]
K32 --> K323[oxId=....]
K32 --> K321[jansId=....]
K32 --> K322[jansId=....]
K32 --> K323[jansId=....]
```

Expand Down
14 changes: 8 additions & 6 deletions docs/admin/developer/scripts/person-authentication.md
Original file line number Diff line number Diff line change
@@ -1,12 +1,13 @@


# Adaptive Authentication scripts (Person Authentication scripts)
The Jans-Auth Server leverages interception scripts of [PersonAuthenticationType](https://github.com/JanssenProject/jans/blob/main/jans-core/script/src/main/java/io/jans/model/custom/script/type/auth/PersonAuthenticationType.java) which when implemented can facilitate complex multi-step, multi-factor authentication workflows. The authentication flow in the Jans Server is driven by the openID spec. The authorization request to the OP (Jans server) contains an optional query parameter called `acr_values` which is used by the OP to pick an interception script which will be run when `/authorize` endpoint (Authentication flow) is invoked. The name of each script corresponds with its `acr` value in the Jans-Auth Server.

Typically, a `PersonAuthenticationType` script can be used to:
* introduce a new 2FA authentication mechanism
* customise multistep authentication
* offer Social logins
* proactively perform fraud detection and block the user.
Typically, a `PersonAuthenticationType` script can be used to:
1. introduce a new 2FA authentication mechanism
2. customise multistep authentication
3. offer Social logins
4. proactively perform fraud detection and block the user.

## Default authentication method:
In an OpenID Connect authentication request, one of the optional parameters defined is `acr_values`. This is the primary way for a client to signal to the OpenID Provider (OP) the preferred way to authenticate the subject.
Expand All @@ -27,7 +28,7 @@ By default, users will get the default authentication mechanism as specified abo
1. Obtain the json contents of a custom script by using a jans-cli command like `get-config-scripts-by-type`, `get-config-scripts-by-inum` etc.
Example :
- `/opt/jans/jans-cli/config-cli.py --operation-id get-config-scripts-by-type --url-suffix type:PERSON_AUTHENTICATION`
- `/opt/jans/jans-cli/config-cli.py --operation-id get-config-scripts-by-inum --url-suffix inum:6122281b-b55d-4dd0-8115-b098eeeee2b7`
- `/opt/jans/jans-cli/config-cli.py --operation-id get-config-scripts-by-inum --url-suffix inum:6122281b-b55d-4dd0-8115-b098eeeee2b7`

2. [Update the custom script](https://github.com/JanssenProject/jans-cli/blob/main/docs/cli/cli-custom-scripts.md#update-an-existing-custom-script) and change the `enabled` attribute to `true`

Expand Down Expand Up @@ -83,6 +84,7 @@ You can use a `PersonAuthenticationType` script to allow users to sign using cre

An example of a complete URL looks like this -
```

https://<your.jans.server>/jans-auth/authorize.htm? \
response_type=code&redirect_uri=https://<your.jans.server>/admin \
&client_id=17b8b82e-b3ec-42a2-bd90-097028a37f3 \
Expand Down
Binary file modified docs/assets/image-fido2-ldap-structure.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.

0 comments on commit 94e79d6

Please sign in to comment.