Add MFA to Dashboard

[dblythy]

Hi all,

I'm currently working on adding MFA to Parse Dashboard.

How to enable MFA:

1. Create an MFA token for the user using parse-dashboard --generateMFA username
2. Set the MFA secret to the user json.
3. Open the MFA URL using Google Authenticator

Now, when you login, you can use the OTP from Google Auth to validate.

Example:

"users": [
    {
      "user":"user1",
      "pass":"pass",
      "mfa":"NBMCGFTWFBHUCE2G",
    }
],

Now, if you open this URL on your mobile with Google Authenticator, it will add the OTP code, specific to the secret NBMCGFTWFBHUCE2G.

This PR is functional, the only problem I'm having is I can't get parse-dashboard --generateMFA username to work. Could anyone point me in the right direction?

Thanks 😊

Closes #856

[ghost]

Danger run resulted in 1 warning; to find out more, see the checks page.

Generated by 🚫 dangerJS

[mtrezza]

This PR is functional, the only problem I'm having is I can't get parse-dashboard --generateMFA username to work. Could anyone point me in the right direction?

Maybe once parse-community/parse-server#7079 is merged, this PR can be adapted and that also fixes the issue.

[mtrezza]

I think this feature is simply too good to wait for the Auth adapter of Parse Server to be merged. I also assumed it would be merged faster, but unfortunately is has become stale for now.

@dblythy Would you rebase this on master and resolve any conflicts to we can look into the remaining issue you described and then merge this great feature?

[dblythy]

I have evolved this to node ./Parse-Dashboard/index.js --createUser, to allow users to generate bcrypt and MFA secrets for their dashboard. Here's what it looks like:

[dblythy]

Ready for review @mtrezza 😊

[dblythy]

Resolved @mtrezza! The OTP field now hides unless a login fails with an OTP error.

[mtrezza]

Can you please remove the RAS syndrome through-out the PR?

"OTP code" is like "MFA authentication", I suggest to simply spell it out, because in addition, not everyone may know what OTP refers to in this case. For example, instead of:

Please enter your OTP code.

let's write:

Please enter your one-time password.

[mtrezza]

I am slightly concerned about otplib, because it is not maintained since 2 years, however, according to snyk it has no vulnerabilities. Normally I would argue against adding an unmaintained package, but in this case, given its popularity, I think we can just use it and switch to anther one if needed.

[mtrezza]

@dblythy Could you try to delete package-lock.json and node_modules and run npm i to see whether it builds for you? It doesn't for me, but that may be another issue.

[dblythy]

I am slightly concerned about otplib,

Do you have any recommendations for other libraries? Probably a good suggestion.

I also had no issues before but now getting:

While resolving: parse-dashboard@2.2.0
npm ERR! Found: graphql@14.6.0
npm ERR! node_modules/graphql
npm ERR!   graphql@"14.6.0" from the root project

[mtrezza]

Do you have any recommendations for other libraries? Probably a good suggestion.

The other ones I found have the same issue; I guess it's ok if we just go with this one.

I also had no issues before but now getting:

Which node and npm version? Does that occur on master as well for you if you delete node_modules and package-lock?
For me it fails on Node 12 and 14 for webpack with:

ERROR in ../node_modules/stream-browserify/index.js
Module not found: Error: Can't resolve 'readable-stream/writable.js' in ...

[mtrezza]

I edited the readme a bit, let me know if you want to add anything, otherwise I think we're good to go!

[mtrezza]

So there is actually an issue, when I try to open the link on mobile safari, it says invalid link, it doesn't open any app.

Is that an issue or is the URI supposed to be used differently? Usually websites only display the secret to manually copy/paste to an auth app. Maybe we should remove the link and only show the secret, like most do.

This is what it looks now:

[pmmlo]

So there is actually an issue, when I try to open the link on mobile safari, it says invalid link, it doesn't open any app.

Is that an issue or is the URI supposed to be used differently? Usually websites only display the secret to manually copy/paste to an auth app. Maybe we should remove the link and only show the secret, like most do.

This is what it looks now:

I think the URI provides better compatibility. I believe you can paste either into most major authenticators, but the URI provides more explicit metadata.

To my knowledge, no web browser will deep link otpauth into an authenticator, but if you use certain iOS qr code readers, this would technically deep link into something like G Authenticator. A secret would not.

I vote for URI.

[mtrezza]

I have never seen any 2FA website providing a URL as alternative to the QR code. How would the user know what to do with the URL?

[mtrezza]

Well, Microsoft Authenticator and Google Authenticator, don't accept the URL, but 1pw does. Maybe we just display both.

[pmmlo]

Well, Microsoft Authenticator and Google Authenticator, don't accept the URL, but 1pw does. Maybe we just display both.

Interesting...DUO and Authy accept the URI. I think technically the standard is to provide a button to copy the URI. I trust your judgment on this. A quick fix if we get it wrong.

[mtrezza]

I think technically what you are saying makes sense, the URL provides more info for the auth app. But practically, auth apps are designed to be easy, so they just take the secret.

How about this?

[mtrezza]

Looks fantastic to me!

Great work @dblythy, this is truly a milestone for Parse Dashboard security - one of the most important security features added in recent times. And not only that, it's also done elegantly with a guided CLI that makes configuring it a piece of 🍰! I'll prepare a release soon to make this feature available. Definitely a feature we should mention in our first Parse Newsletter!

[dblythy]

Thanks again for your help @mtrezza!!

[Klaitos]

Hello guys, this PR breaks the docker image on the tag latest :

/src/node_modules/ora/index.js:401
 } catch {

SyntaxError: Unexpected token {
    at createScript (vm.js:80:10)
    at Object.runInThisContext (vm.js:139:10)
    at Module._compile (module.js:617:28)
    at Object.Module._extensions..js (module.js:664:10)
    at Module.load (module.js:566:32)
    at tryModuleLoad (module.js:506:12)
    at Function.Module._load (module.js:498:3)
    at Module.require (module.js:597:17)
    at require (internal/module.js:11:18)
    at Object.<anonymous> (/src/node_modules/inquirer/lib/utils/screen-manager.js:10:13)

[Klaitos]

Building the image docker with node 12 instead of 8 is fixing the issue. One of the dependencies included in this PR need node more than 8

[funkenstrahlen]

@dblythy A huge thank you for implementing this! ❤️ Works flawlessly and provides a much higher data security.

[dblythy]

@funkenstrahlen i’m glad you like it! Let me know if you have any other ideas for heightened security for the dashboard 🎉

[parseplatformorg]

🎉 This change has been released in version 3.3.0-beta.1

[parseplatformorg]

🎉 This change has been released in version 3.3.0