Two factor login event

IN THIS PAGE

Trust this browser: How to modify the second factor prompt
Additional user login data for triggering Two-Factor Authentication

Description

An Xbasic function to call prior to display the 2nd factor dialog in an application with two-factor authentication.

Discussion

In some cases, even though a user has turned on two-factor authentication, you might want to suppress the 2nd factor dialog.

You can specify the name of an Xbasic function (in both the TabbedUI and UX component) to call before the 2nd factor dialog is shown. If the code in your Xbasic function sets:

e.suppress2ndfactorLogin = .t.

then the 2nd factor dialog will not be shown and the user will be logged in.

Turn Two Factor On/Off for All Users - If you have two factor authentication turned on for your application you might want temporarily turn two factor authentication off for all users or certain users.

This is easily done by defining code in the Xbasic function for the Two factor login event.

One approach might be to use the GlobalSettings table to store settings to control whether two factor authentication is enabled or not.

See the Global Settings table for more details on how to use this function with Two Factor login for your web applications.

Trust this browser: How to modify the second factor prompt

When a UX component is used as a login component and if two factor authentication is turned on for a user, when that user logs in the 2nd factor authentication prompt fill be shown. The user can then check the Trust this browser checkbox or button (depending on the browser) so that the next time that they log in, the 2nd factor prompt will not be shown.

To counter this, you can set a property in the Xbasic function that fires when Two Factor login is enabled to force the 2nd factor prompt to be shown regardless of the setting for the Trust this browser property.

Then Xbasic function can set this property:

e.forceToFactorLogin - if set to .t. the 2nd factor prompt is shown regardless of whether the user has previously checked the Trust this browser checkbox

Additional user login data for triggering Two-Factor Authentication

Additional data are available in the xbasic function to use when computing if the two factor authentication prompt should be suppressed.

The new information that is available is listed below (the values are in the e object that is passed into the function):

if you have an existing External User Information table, you must edit the table structure and add a new field called MiscJSON (data type longtext). If you recreate the External User Information table, this field is automatically added.

numberOfLoginsSinceLastTwoFactorAuthentication: number of logins since the last two factor authentication was performed
numberOfLogins: total number of times user has logged in. (includes logins that did not use two factor authentication)
IPAaddressesForPreviousLogins: a CRLF delimited list of IP address from which the user previously logged in. Useful if you want to only show the two factor authentication prompt if the user is logging in from an IP address that has not previously been used.
IPAddressForCurrentLoginAttempt: the IP address for the user who is logging in.
lastLoginDate: date of last login (character value. format is yyyy-mm-dd 0h:0m)
lastLoginDateUsingTwoFactorAuth: date of last login that used two factor authentication (character value. format is yyyy-mm-dd 0h:0m) - Useful if you want to only require two factor authentication every x days.

Here are some examples of how these new properties can be used in your Two factor login event:

1. To suppress the two factor authentication prompt if the user has previously logged in from the same IP address as they are currently using

if atc(e.IPAddressForCurrentLoginAttempt,e.IPAaddressesForPreviousLogins) > 0 then
    e.suppressTwoFactorPrompt = .t.
end if

2. To suppress the two factor authentication prompt if it is less than 14 days since the user last logged in using two factor authentication

dim dateLastTwoFactorLogin as d = convert_type(e.lastLoginDateUsingTwoFactorAuth,"d")

if date() - dateLastTwoFactorLogin < 14 then

    e.suppressTwoFactorPrompt = .t.

end if

3. To require two factor authentication every 10 login attempts. For example, once the user has successfully logged in using two factor authentication, the next time the user tries to log in, the two factor authentication prompt will be suppressed. The 10th time the user tries to log in the two factor authentication prompt will be shown.

The user will then be able to log in 9 more times without having to go through a two factor login.

if mod(e.numberOfLogins,10) <> 0 then
    e.suppressTwoFactorPrompt = .t.
end if