|
|
Post by raviteja on Jun 7, 2024 9:13:33 GMT
Hi All
I have few questions on how Google/Microsoft Authenticators supported on Account service schema.
1. I see "GoogleAuthenticator" has "SecretKey" property at AccountService level, but Google Authenticator suggests to generate separate key for each user
why can't we have "SecretKey" property at User level instead of AccountService level?
does redfish schema recommends to use single GoogleAuthenticator SecretKey for all MFA enabled users on the system?
2. as per my understanding, "SecretKey" property is to populate of SecretKey generated by Google Authenticator or microsoft authenticator
but documentation does not clear state what does this secretkey property contains and did not understand this "SecretKeySet" property
since this single "SecretKey" property populated in redfish response, what's the purpose of "SecretKeySet"?
3. I observed that TOTP SecretKey generated by Google Authenticator can be added on Microsoft authenticator app as well to generate OTPs
basically any app which follows TOTP RFC can use SecretKey generated by Google Authenticator, generate OTPs then authentication works.
then why do we need to have both "MicrosoftAuthenticator" and "GoogleAuthenticator" properties separately?
|
|
|
|
Post by mraineri on Jun 7, 2024 13:49:48 GMT
1) This was a design choice to enforce the usage of Google Authenticator/Microsoft Authenticator without having to access each user's Google or Microsoft account. When either authenticator is enabled, users are required to use MFA to access the service. So, unless the administrator has access to each user's secret key or users are put into the bypass list, there's no way to a user to set their secret key on the service.
2) "SecretKey" is always shown as null in responses regardless if there is a key configured or not. We use "SecretKeySet" as an indicator if the service currently has a key configured. So, if an administrator never set a value for SecretKey, you'll see this property as false, which gives an indication that further configuration is required to be able to use the authenticator.
3) While the setup between Microsoft and Google are very similar, both have unique features that requires their separation. For example, Microsoft allows for one-time codes (not just time based codes) including ones automatically provided by Edge when you unlock your computer with your face.
|
|
|
|
Post by raviteja on Jun 10, 2024 4:03:23 GMT
1) That means "SecretKey" in "GoogleAuthenticator" section property at AccountService can be populated in response based on redfish session user ?? since each user has its own Google Authenticator secret key
say MFA Google Authenticator enabled for all users on the system, then "SecretKey" in "GoogleAuthenticator" at AccountService response can be populated based on the user to which this redfish session belongs?
2) why "SecretKey" is always shown as null in responses regardless if there is a key configured or not ---> there are cases where redfish client needs to query "SecretKey" property so that secret key can be used by clients to configure on corresponding authenticator apps to generate OTP right? how does redfish clients gets to know secret key of user?
"SecretKey" property description says that property shall contain the client key to use when communication with the Microsoft Authenticator.
but you have mentioned that "SecretKey" is always shown as null in responses regardless if there is a key configured or not, its really confusing.
I understand that there's no need to support set secret key on the service, but when Google Authenticator enabled then "SecretKey" should populate in redfish response with right SecretKey for that user so that redfish client use this secret key for authentication
3) is there any HTTP header that can be used to share MFA authenticator secret key similar to Xauth-token header ?
4) how does MFA Google/Microsoft Authenticator enabled for each user?? does one administrator privileged user can enable Google/Microsoft Authenticator for other users??
|
|
|
|
Post by mraineri on Jun 10, 2024 14:20:23 GMT
1) No, it's the secret key for the Redfish service when communicating with the Google/Microsoft Authenticator server. It's not on a per user basis.
2) It's to prevent leaking sensitive info. Best practices do not want passwords or other secrets to be retrievable. The client does not ever need to fetch the service's secret key. However, an administrator setting up the configuration might need to know if the key is even configured in the first place. Since the key itself needs to be protected, "SecretKeySet" is used to give that indication without leaking the key. "SecretKeySet = false" is a clear indicator to an administrator that they need to configure the key; if they simply try to enable GoogleAuthenticator at this point without setting the key, they'll end up in an invalid state.
3) No, again, this is not supposed to be shared.
4) An admin of the service just needs to set the appropriate object in AccountService (like "Enabled" in the "GoogleAuthenticator" object). Once enabled, unless a specific user is called out in the "MFABypass" property, everyone is required to use MFA to log into the service.
|
|
|
|
Post by raviteja on Jun 10, 2024 17:28:42 GMT
1) How does Redfish service communicates with the Google/Microsoft Authenticator server ?? as per my understanding this secret key can be added into google/MS authenticator apps/tool by admin to generate TOTP.
As per Google Authenticator spec, its strictly recommended to have separate SecretKey for each user, looks like using same secret key for each user on system security concern
2) actually this SecretKey is used to generate TOTP, are you saying that TOTP generated on the same system and delivered to redfish clients? and no secret key shared to redfish clients?
3)can you please share interface specification doc which describes mfa redfish design ?
please do share redfish mockups for MFA Google/Microsoft Authenticator configuration
|
|
|
|
Post by mraineri on Jun 12, 2024 12:54:48 GMT
With the way it's modeled today, this would be the sequence:
First, an admin configures Google or Microsoft Authenticator:
PATCH /redfish/v1/AccountService
{
"MultiFactorAuth": {
"GoogleAuthenticator": {
"Enabled": true,
"SecretKey": "my-secret-for-the-service"
}
}
}
Second, the admin needs to give this secret key to users. This would be done outside of Redfish and is not covered by the spec.
Third, users calculate their token with the secret key obtained in the previous step and use this when creating Redfish sessions.
POST /redfish/v1/SessionService/Sessions
{
"UserName": "Bob",
"Password": "Bob's Password",
"Token": "TOTP token calculated with key my-secret-for-the-service"
}
I did notice when going over this with others that the descriptions for "SecretKey" really aren't correct; there's no communication with any server and it's the value used in TOTP calculation. We'll need to fix this.
I do recognize this isn't ideal per the security recommendations you've highlighted. There are some challenges though when it comes to users managed by third party sources like LDAP and Active Directory; one of the use cases brought to use was to enforce MFA on all users, including those from external providers. It does not appear there is a method in place for us to perform token validation on these types of users, unless we want to allow an admin to specify an arbitrary "attribute to secret key" mapping method so we can extract the user's key from a predefined attribute on each request.
If there really is a need to have this configured on a user-by-user basis, we can certainly discuss this further.
|
|
|
|
Post by raviteja on Jun 13, 2024 16:30:10 GMT
First of all, supporting PATCH operation to update secretKey which is generated on some other system into redfish service does not look right. I still did not understand why is that patch operation required? as per google-authenticator, this secret key should be generated on the same system which is hosting AccountService. so technically this SecretKey should be generated on the same system for which google-authentication needs to enabled and displayed this readonly secret keys to redfish client to register these secret key to get TOTPs generated by google/Microsoft Authenticator apps please refer github.com/google/google-authenticator-libpam/tree/master?tab=readme-ov-file#setting-up-a-userPATCH /redfish/v1/AccountService
{
"MultiFactorAuth": {
"GoogleAuthenticator": {
"Enabled": true,
"SecretKey": "my-secret-for-the-service"
}
}
}
allowing this kind of secretkey upload is major security concern, suppose if I upload random string which is not valid secret key then whole system is screwed up, no further logins allowed second, I dont agree with the below statement, from where does admin gets secret key which should generated on same system while enabling google-authenticator "the admin needs to give this secret key to users. This would be done outside of Redfish and is not covered by the spec" yes these MFA enable/disable, Google-authenticator and Microsoft Authenticator properties should be supported at user level for sure. please let me if i need to open any issue to get these schemas fixed? I think these schemas needs to be fixed |
|
|
|
Post by mraineri on Jun 13, 2024 17:33:59 GMT
I'll raise it for further discussion.
|
|
|
|
Post by raviteja on Jun 13, 2024 18:12:10 GMT
sure, let me know. I can work on creating PR with schema changes for user level Google-authenticator and Microsoft Authenticator properties
|
|
|
|
Post by raviteja on Jun 17, 2024 10:39:00 GMT
let me know if this topic added to next DMTF meeting ?? I am also interested to join this discussion.
|
|
