Enroll methods

class aucore.au.ap.virtual_password.VPEnrollProcess(policy)

Error reasons:

• PASSWORD_BAD_CONFIRMATION
• PASSWORD_EMPTY
• PASSWORD_UNCHANGED
• PASSWORD_TOO_SHORT
• PASSWORD_TOO_SIMPLE

class aucore.au.ap.virtual_password.EmergPasswordEnrollProcess(policy)

class aucore.au.ap.ldap_password.LdapEnrollProcess

class aucore.au.ap.messaging_otp.MessagingOTPEnrollProcess

class aucore.au.ap.otp.TotpEnrollProcess(policy)

Error reasons:

• TOTP_SCAN_QR

class aucore.au.ap.otp.HotpEnrollProcess(policy)

Remember user device (smartphone etc.) HOTP secret and algoritm parameters

class aucore.au.ap.radius.RadiusEnrollProcess

class aucore.au.ap.sec_quest.SecQuestEnrollProcess(policy)

Error reasons:

• SECQUEST_WAITING_ANSWERS

class aucore.au.ap.u2f.U2fEnrollProcess(policy)

Error reasons:

• U2F_WAITING_REG_RESPONSE
• U2F_NOT_ATTESTED

NOTE: U2F AP uses camelCasing for parameters. Chrome JS-API (u2f.js) uses this scheme. You simply forward objects such as SignRequest to/from AP and JS-API.

Example of enrollment

1. Create enroll process (login before that and use login_session_id):

   POST /api/v1/enroll
   { 'login_session_id': 'WXogCpZcHlsGsmmYiXkcxbg1qJMHJ4eD', 'method_id': 'U2F:1' }
   
   Return:
   { 'enroll_process_id': 'hn0k1pTx1T6MQwOIbhBPUlLIopROig4Q' }
   

2. Ask server for registerRequests:

   POST /api/v1/enroll/hn0k1pTx1T6MQwOIbhBPUlLIopROig4Q/do_enroll
   {
       'login_session_id': 'WXogCpZcHlsGsmmYiXkcxbg1qJMHJ4eD',
       'response': { 'userId': 'b133a41c092e11e5873d000c294fde0e',   # send userName or userId,
                    #'userName': 'LOCAL\user1',                     # not both
                    'appId': 'https://demo.yubico.com'  # maybe omitted, server will use default appId (VENDOR name)
                                                        # if you use browser u2f-api, pass https://<server_name>
                   }
   }
   Return:
   
   { 'method_id': 'U2F:1',
     'msg': 'Waiting register response',
     'reason': 'U2F_WAITING_REG_RESPONSE',
     'registerRequests': [ { 'appId': 'https://demo.yubico.com',
                             'challenge': 'Ij3TTvLi3H-oWNA18BDeIp_p1zN5bkzPipjQeuIbntQ',
                             'version': 'U2F_V2'}],
     'signRequests': [],
     'status': 'MORE_DATA'
   }
   

3. Forward registerRequests and signRequests to JSAPI (u2f.register), get registerResponse and forward to server:

   POST /api/v1/enroll/hn0k1pTx1T6MQwOIbhBPUlLIopROig4Q/do_enroll
   {
     'login_session_id': 'WXogCpZcHlsGsmmYiXkcxbg1qJMHJ4eD',
     'response': { 'registerResponse': { 'clientData': 'eyJ0eXAiOiJuYXZpZ2F0b3IuaWQuZmluaXNoRW5yb2xsbWVudCIsImNoYWxsZW5nZSI6IjFNX2hrbkxka0Ixb1hySFQxWUZqSHA5NDRpT2w4N2kwd1B5UUV0MW5DYzQiLCJvcmlnaW4iOiJodHRwczovL2RlbW8ueXViaWNvLmNvbSIsImNpZF9wdWJrZXkiOiIifQ',
                                         'registrationData': 'BQQ_jNAqemWkTfI9uL4CVo3eQSNIMe66u-pasr8BMuu9maA764C7jDPqXMUWhw8_4tDxeUbM72VJH5fssT6F2vT5QKheRH3Tk0hCuJD94ZRHf0Nkg-JDmLOivamSUeVXvRJaBLOp7N-hhxvoxlChQ-CSzMDqrC7EZ7IqWvl7Ac3xejswggIcMIIBBqADAgECAgRyWMLqMAsGCSqGSIb3DQEBCzAuMSwwKgYDVQQDEyNZdWJpY28gVTJGIFJvb3QgQ0EgU2VyaWFsIDQ1NzIwMDYzMTAgFw0xNDA4MDEwMDAwMDBaGA8yMDUwMDkwNDAwMDAwMFowKzEpMCcGA1UEAwwgWXViaWNvIFUyRiBFRSBTZXJpYWwgMTQ4MDMzMjE1NzgwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASisDmTIlQxnUH6SFTVfKGN62nMmz5Nga45nzI-gRZDme8qlRRnPRV87L-18LzHiQhT7lXPPxogZvTVE5uTizELoxIwEDAOBgorBgEEAYLECgECBAAwCwYJKoZIhvcNAQELA4IBAQG8zBr5C3uVeBjVVaQzcWpgFqztyzEyw0EPNmFkEGwj2SqwbF0cLLaSmtQhSKoqOvOuU4k6aqFAyukyZZMVPZKqAP0Vh0sCMpRMzpDvEZjO3v6gh5Z8bIDmtQAJ5B2nnILyVpc7DA7taj3dUrZzNMD8v-bYjKdTsZJ_QzQstsewIPkoFOIRRtqta0iwkEFiX_cwR11IF-USGcQHKUBoMX65JP9nY6DzQ3XHplOD3bHUOHsCi2MqBZU-1fKOrQJpNP0w8cBQpSk_hsVTm7UiGW_FGrxrIKXfpGfCGICKDxCMfuWKIshu0HjP0pEhowAX1Ls1pie2SoK3-VEhYtkOFRLqMEUCIFnX5ZcO8ZWOKyF6R-tAse3rYdzwFBq4LZzEeXUwn6oMAiEAwNuC4mkjobmeyilaLM4twOAicm-R_x_YKzcQcXIx5cU'}}
   }
   Return:
   
   {'method_id': 'U2F:1', 'msg': 'Enroll complete', 'status': 'OK'}
   

4. Assign enrolled data to user, create authenticator:

   POST /api/v1/users/e7c62c0c055011e5810a000c294fde0e/templates
   { 'enroll_process_id': 'hn0k1pTx1T6MQwOIbhBPUlLIopROig4Q',
     'login_session_id': 'WXogCpZcHlsGsmmYiXkcxbg1qJMHJ4eD'
   }
   
   Return:
   {'auth_t_id': 'e7f7edc8055011e5810a000c294fde0e'}
   

How to build APPID from inside browser

function getOriginFromUrl(url) {
  var re = new RegExp('^(https?://)[^/]*/?');
  var originarray = re.exec(url);
  if (originarray == null) return originarray;
  var origin = originarray[0];
  while (origin.charAt(origin.length - 1) == '/') {
    origin = origin.substring(0, origin.length - 1);
  }
  if (origin == 'http:' || origin == 'https:')
    return null;
  return origin;
}

var appId = getOriginFromUrl(window.location);

class aucore.au.ap.smartphone_ap.SmartphoneEnrollProcess(policy)

Error reasons:

• SMARTPHONE_ENROLL_TIMEOUT
• SMARTPHONE_WAITING_DATA
• SMARTPHONE_SCAN_QR

class aucore.au.ap.voice.VoiceEnrollProcess(policy)

class aucore.au.ap.smartcard.SmartcardEnrollProcess

Now only support contactless cards (UID).

Example of enrollment

1. Create enroll process (login before that and use login_session_id):

   POST /api/v1/enroll
   { "login_session_id": "mDclxFuBrCNAHddXazdAeu06bsxlyfqY", "method_id": "CARD:1" }
   
   Return:
   { "enroll_process_id": "23AEHu4uoISJBZ3KEjUo3Y7s2MN7MQe2" }
   

2. Store card UID and validate card certificate(for PKI-cards):

   POST /api/v1/enroll/23AEHu4uoISJBZ3KEjUo3Y7s2MN7MQe2/do_enroll
   {
     "login_session_id": "mDclxFuBrCNAHddXazdAeu06bsxlyfqY",
     "response": {"card_uid": "11223344", "card_cert": "<hex cert in DER format>"}
   }
   Return:
   
   { "status": "OK",
     "msg": "Enroll complete",
     "method_id": "CARD:1"
   }
   

3. Assign enrolled data to user, create authenticator:

   POST /api/v1/users/6104a6cf424b11e5b7ebdc85de0b0889/templates
   {
     "enroll_process_id": "23AEHu4uoISJBZ3KEjUo3Y7s2MN7MQe2",
     "login_session_id": "mDclxFuBrCNAHddXazdAeu06bsxlyfqY"
   }
   
   Return:
   { "auth_t_id": "92a19590425911e5b7ebdc85de0b0889" }