External program

Input parameters can be used to determine the modules that are presented to the user if configured to do so. The input parameters can be the chains that are available for the user (”chains” KVGroup), CGI parameters passed in from the browser (”cgi” KVGroup), parameters received from the user (”parameters” KVGroup), or user account/profile/request attributes for the current user (”viewer” ”user” KVGroup).

  "" "" = { 
   
        "can_use_response.pss" = "true" 
        "cfgid" = "DEFAULT_LOGIN:1" 
        "chain" = "DEFAULT_LOGIN" 
        "module" = "psf" 
   
        "sessionid" = "<session ID>" # The session ID of the viewer 

 
        "chains" "" = { # Supported chains 
             "<chain id>" = "1" 
             "<chain id>" = "1" 
             "<chain id>" = "1" 
             ... 
        } 

 
        "cgi" "" = { # HTTP HEADER information 
             ... 
        } 

 
        "parameters" "" = { # HTTP Post information 
        } 
 
        "viewer" "user" = { 
             # User account/profile/request attribute information 
        } 
   } 

The output KVGroup can be constructed within the script to determine the specific authentication modules that may be presented for the user logging in. One or more dialogs can be generated.

"" "" = { 
    "errmsg" = "" # error message, if any 
    "retval" = "0" # 0 on success; non-zero on failure 
    "status" = "<SUCCESS|FAILED|NEED_TOKENS|FAILED_NEED_TOKENS|IGNORE_STATUS|SERVICE_CHANGED|SYSTEM_ERROR>" 
    "parameters" "" = { 
        <name> = <value> 
        "NEW_SERVICE_NAME" = "<chain id>" # Required only for SERVICE_CHANGED status 
    } 
    "dialog" "" = { 
        "id" = "<id>" # unique dialog id 
        "subtitle" = "<subtitle" # subtitle of the dialog 
        "title" = "<title>" # title of the dialog 
        "entry" "" = { 
            "description" = "<description" # entry prompt description 
            "name" = "<field_name>" # entry field name in html 
            "type"= "<PASSWORD|TEXT|DATE|DROPDOWN|HIDDEN|RADIO|CHECKBOX|IMAGE|BUTTON|SUBMIT|LABEL>" 
            "value" "" { 
                description = "<description>" # value description 
                value = "<value>" 
            } 
        } 
        # additional entry KVGroups may also be added here 
    } 
    "redirect_url" = "<URL>" # redirect to specified url 
} 

Status

The status key must be set to one of the following values:

Parameters KVGroups

The parameters KVGroup can be used to determine the modules that are presented to the user after successful authentication.

The following example will send the authenticated user to the IDR page and allow them to enter a new user pre-defined request.

"parameters" "" = { 
    "JUMPTOCGI" = "IDR" 
    "LINK" = "NEWUSER" 
    "PREQID" = "NEWUSER" 
    "SESS_ANON" = "1" 
} 

See also

Redirect to URL

The external authentication chain can redirect the user to specific URL. parameters can be defined in the URL address or within the parameters section.

The following example will redirect a user to the specified site.

"" "" = { 
    "parameters" "" = { 
        "user" = "someuser" 
    } 
    "redirect_url" = "http://site/cgi.exe?ok=true" 
    "retval" = "0" 
    "errmsg" = "SUCCESS" 
} 

This example will redirect the user to http://site/cgi.exe?ok=true&user=someuser

Dialog KVGroups

The dialog KVGroup will allow the creation of a custom dialog box for the user to enter information.

The entry types for custom dialogs can be specified as one of the following:

The “value” KVGroup, outlined in the Output section, is configured differently depending on the type of dialog:

In the example above, the “description” fields for desc1, desc2, and desc3 are displayed as either drop-down list items, checkboxes, or radio button options.

You can customize the user interface for these views by modifying the !!!AUTH_VIEW_* tags in the authchain.m4 file, then recompiling the skins. For example:

See also

The authplugin.psl sample script, found in the samples directory, provides a simple demonstration of a customized authentication chain. The script generates a dialog for password authentication to the Front-end . The output KVGroup will include a status that is set to NEED_TOKENS to indicate that a response is required for the dialog. The sample script will then verify the password that is entered against a value defined within the script.

Output KVGroup for the sample authplugin.psl:

  "" "" = { 
     "errmsg" = "" 
     "retval" = "0" 
     "status" = "NEED_TOKENS" 
     "dialog" "" = { 
       "id" = "authplugin" 
       "subtitle" = "Please provide a valid password" 
       "title" = "Verifying password" 
       "entry" "" = { 
         "description" = "Password" 
         "name" = "response_field" 
         "type" = "PASSWORD" 
         "value" "" = { 
           "description" = "" 
           "value" = "<your password>" 
         } 
       } 
     } 
   } 

Bravura Security Fabric includes a component, Scenario.hid_authchain_recaptcha, which allows you to use the reCAPTCHA program as part of an authentication chain. The reCAPTCHA program is a web service that provides an image-based authentication method.

Bravura Security Fabric also includes the Scenario.hid_authchain_recaptcha_v3 component that supports reCAPTCHA v3 for score-based reCAPTCHA authentication. reCAPTCHA v3 acts similarly to v2 invisible, in that when you log in, the page will reload as it invisibly evaluates the user’s activity.

All images are generated and graded by the reCAPTCHA servers. Adding reCAPTCHA to your authentication chains creates another layer of security for your authentication process without adding the cost of running image generation scripts on your servers. See http://www.google.com/search?q=recaptcha for more information.

To configure Bravura Security Fabric to include an authentication chain using the reCAPTCHA plugin:

Generate the site and secret keys using v3 Admin Console

To generate the site and secret keys using v3 Admin Console:

Install hid_authchain_recaptcha or hid_authchain_recaptcha_v3

Install the Scenario.hid_authchain_recaptcha or Scenario.hid_authchain_recaptcha_v3 component, then modify the RECAPTCHA settings in the hid_global_configuration external data store (extdb) table to populate the SITE_KEY and SECRET_KEY fields with the keys generated from the reCAPTCHA website . The MIN_ALLOWED_SCORE field can also be added to set the minimum passing score for recaptcha v3.

After updating the hid_global_configuration table with the SITE_KEY and SECRET_KEY, it can take some time before reCAPTCHA can be used. It may take 5-10 minutes for the skin to rebuild in the background.

Troubleshooting reCAPTCHA

After upgrading Bravura Security Fabric or on secondary nodes, the reCAPTCHA plugin may not render properly with the "Human or Robot?" checkbox.

Bravura Security Fabric includes a generic tool, httpauth, for web server authentication integration. The httpauth.exe program is both a CGI executable and an authentication plugin. Once the tool is properly set up on a web server to run as an protected CGI executable, it will detect the user logging on the web server via the REMOTE_USER environment variable, and issue a one-time pass for the user to login to Bravura Security Fabric transparently, or with other Bravura Security Fabric authentication methods.

See Use case: Adding Smart Card authentication for a use case incorporating smart card authentication.

To configure Bravura Security Fabric to include an authentication chain using httpauth:

When a user attempts to login:

 "" "" = { 
      "environments" "" = { 
          <available common gateway interface environment variables> 
          ... 
      } 
      "parameters" "" { 
          <parameters received from user> 
      } 
  } 

 "" "" = { 
           "errmsg" = "<error messages if any>" 
           "retval" = "<#>" # 0 on success; non-zero on error 
           "userid" = "<profile ID>" # set the USERID parameter 
           "accountid" = "<account ID>" # overrides the USER_IDENT parameter 
           "hostid" = "<target system ID>" # overrides the HOSTID parameter 
           "url" = "<redirect URL>" # optional 
           "export_envs" = "<environment variables name>; ..."" 
       } 

Troubleshooting httpauth

If Bravura Security Fabric returns a login failure, or the user is prompted for Bravura Security Fabric password input, it is likely that:

Bravura Security Fabric includes a sample plugin, authanonreg, that allows anonymous users who do not have pre-existing credentials to create a new user profile using a pre-defined request.

The anonymous user authenticates using a CAPTCHA, and Bravura Security Fabric redirects them to the pre-defined request for a new user account. The CAPTCHA ensures that profiles are not created by automated programs.

To configure Bravura Security Fabric to include an authentication chain using authanonreg :

When a user logs in:

You can configure email notification in order to send the user an activation email containing a link to a page that allows him to activate his own account. By default, activation emails are not sent.

By default, the activation link expires 24 hours after the request is submitted. The value for the length of expiry is controlled by the registry key “AnonymousRequestExpiry” DWORD value.

Bravura Security Fabric includes a sample plugin, authuserattr, that allows users to authenticate using profile attributes.

To configure Bravura Security Fabric to include an authentication chain using authuserattr :

When a user logs in they will attempt to authenticate using their date of birth and email address. If the response is validated, then authentication proceeds.

The fedidp_response.py plugin is called by the fedidp-assert authentication chain module, and generates a SAML assertion using a Mako XML template. This plugin is used by the Scenario.hid_saml_idp component as part of SAML federated login .