Mercurial > prosody-modules

comparison mod_auth_token/README.markdown @ 3471:b4bcb84997e7

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_auth_token: Update README. Add luarocks dependencies and explain how to generate the token.
author JC Brand <jc@opkode.com>
date Tue, 26 Feb 2019 15:58:58 +0100
parents b8834fec4b7e
children
comparison
equal deleted inserted replaced
3470:c0fc739a1b81 3471:b4bcb84997e7
9 Prosody via the XMPP client and Prosody verifies the authenticity of this 9 Prosody via the XMPP client and Prosody verifies the authenticity of this
10 token. 10 token.
11 11
12 If the token is verified, then the user is authenticated. 12 If the token is verified, then the user is authenticated.
13 13
14 ## How to generate the token 14 ## Luarocks dependencies
15
16 You'll need to install the following luarocks
17
18 otp 0.1-5
19 luatz 0.3-1
20
21 ## How to generate the TOTP seed and shared signing secret
15 22
16 You'll need a shared OTP_SEED value for generating time-based one-time-pin 23 You'll need a shared OTP_SEED value for generating time-based one-time-pin
17 values and a shared private key for signing the HMAC token. 24 (TOTP) values and a shared private key for signing the HMAC token.
18 25
19 You can generate the OTP_SEED value with Python, like so: 26 You can generate the OTP_SEED value with Python, like so:
20 27
21 >>> import pyotp 28 >>> import pyotp
22 >>> pyotp.random_base32() 29 >>> pyotp.random_base32()
26 33
27 >>> import pyotp 34 >>> import pyotp
28 >>> pyotp.random_base32(length=32) 35 >>> pyotp.random_base32(length=32)
29 u'JYXEX4IQOEYFYQ2S3MC5P4ZT4SDHYEA7' 36 u'JYXEX4IQOEYFYQ2S3MC5P4ZT4SDHYEA7'
30 37
31 These values then need to go into your Prosody.cfg file: 38 ## Configuration
32 39
33 token_secret = "JYXEX4IQOEYFYQ2S3MC5P4ZT4SDHYEA7" 40 Firest you need to enable the relevant modules to your Prosody.cfg file.
34 otp_seed = "XVGR73KMZH2M4XMY" 41
42 Look for the line `modules_enabled` (either globally or for your
43 particular `VirtualHost`), and then add the following to tokens:
44
45 modules_enabled = {
46 -- Token authentication
47 "auth_token";
48 "sasl_token";
49 }
50
51 The previously generated token values also need to go into your Prosody.cfg file:
52
53 authentication = "token";
54 token_secret = "JYXEX4IQOEYFYQ2S3MC5P4ZT4SDHYEA7";
55 otp_seed = "XVGR73KMZH2M4XMY";
35 56
36 The application that generates the tokens also needs access to these values. 57 The application that generates the tokens also needs access to these values.
37 58
38 For an example on how to generate a token, take a look at the `generate_token` 59 For an example on how to generate a token, take a look at the `generate_token`
39 function in the `test_token_auth.lua` file inside this directory. 60 function in the `test_token_auth.lua` file inside this directory.
44 is provided by the file `mod_sasl_token.lua`. 65 is provided by the file `mod_sasl_token.lua`.
45 66
46 Prosody doesn't automatically pick up this file, so you'll need to update your 67 Prosody doesn't automatically pick up this file, so you'll need to update your
47 configuration file's `plugin_paths` to link to this subdirectory (for example 68 configuration file's `plugin_paths` to link to this subdirectory (for example
48 to `/usr/lib/prosody-modules/mod_auth_token/`). 69 to `/usr/lib/prosody-modules/mod_auth_token/`).
70
71 ## Generating the token
72
73 Here's a Python snippet showing how you can generate the token that Prosody
74 will then verify:
75
76 import base64
77 import pyotp
78 import random
79
80 # Constants
81 OTP_INTERVAL = 30
82 OTP_DIGITS = 8
83
84 jid = '{}@{}'.format(username, domain)
85
86 otp_service = pyotp.TOTP(
87 OTP_SEED, # OTP_SEED must be set to the value generated previously (see above)
88 digits=OTP_DIGITS,
89 interval=OTP_INTERVAL
90 )
91 otp = otp_service.generate_otp(otp_service.timecode(datetime.utcnow()))
92
93 nonce = ''.join([str(random.randint(0, 9)) for i in range(32)])
94 string_to_sign = otp + nonce + jid
95 signature = hmac.new(token_secret, string_to_sign, hashlib.sha256).digest()
96 token = u"{} {}".format(otp+nonce, base64.b64encode(signature))
97