mfa

Documentation

Overview

Package mfa provides supports for Multi-Factor authentication modules

Index

• func GenerateTOTPSecret(configName, username string) (string, *otp.Key, []byte, error)
• func GetAvailableTOTPConfigNames() []string
• func ValidateTOTPPasscode(configName, passcode, secret string) (bool, error)
• func ValidateTOTPSecret(secret string) error
• type Config
  • func (c *Config) Initialize() error
• type ServiceStatus
  • func GetStatus() ServiceStatus
• type TOTPConfig
  • func GetAvailableTOTPConfigs() []*TOTPConfig
• type TOTPHMacAlgo

Functions

func GenerateTOTPSecret

func GenerateTOTPSecret(configName, username string) (string, *otp.Key, []byte, error)

GenerateTOTPSecret generates a new TOTP secret and QR code for the given username using the configuration with configName

func GetAvailableTOTPConfigNames

func GetAvailableTOTPConfigNames() []string

GetAvailableTOTPConfigNames returns the available TOTP config names

func ValidateTOTPPasscode

func ValidateTOTPPasscode(configName, passcode, secret string) (bool, error)

ValidateTOTPPasscode validates a TOTP passcode using the given secret and configName

func ValidateTOTPSecret

func ValidateTOTPSecret(secret string) error

ValidateTOTPSecret rejects a plain secret weaker than the 20 random bytes we generate (the RFC 6238 recommended size), decoded as base32 without padding, as we issue it.

This is a defense-in-depth hygiene check at the enrollment boundary, not a security control. A TOTP secret protects the account owner's own second factor and the owner necessarily knows it, so a deliberately weak secret only weakens that single account and crosses no trust boundary. The check keeps enrollment consistent with the secret the server issues; it does not, and cannot, guarantee secret strength: a low-entropy 20 byte secret still passes.

Types

type Config

type Config struct {
	// Time-based one time passwords configurations
	TOTP []TOTPConfig `json:"totp" mapstructure:"totp"`
}

Config defines configuration parameters for Multi-Factor authentication modules

func (*Config) Initialize

func (c *Config) Initialize() error

Initialize configures the MFA support

type ServiceStatus

type ServiceStatus struct {
	IsActive    bool         `json:"is_active"`
	TOTPConfigs []TOTPConfig `json:"totp_configs"`
}

ServiceStatus defines the service status

func GetStatus

func GetStatus() ServiceStatus

GetStatus returns the service status

type TOTPConfig

type TOTPConfig struct {
	Name   string       `json:"name" mapstructure:"name"`
	Issuer string       `json:"issuer" mapstructure:"issuer"`
	Algo   TOTPHMacAlgo `json:"algo" mapstructure:"algo"`
	// contains filtered or unexported fields
}

TOTPConfig defines the configuration for a Time-based one time password

func GetAvailableTOTPConfigs

func GetAvailableTOTPConfigs() []*TOTPConfig

GetAvailableTOTPConfigs returns the available TOTP configs

type TOTPHMacAlgo

type TOTPHMacAlgo = string

TOTPHMacAlgo is the enumerable for the possible HMAC algorithms for Time-based one time passwords

const (
	TOTPAlgoSHA1   TOTPHMacAlgo = "sha1"
	TOTPAlgoSHA256 TOTPHMacAlgo = "sha256"
	TOTPAlgoSHA512 TOTPHMacAlgo = "sha512"
)

supported TOTP HMAC algorithms