Logon methods¶

class aucore.au.ap.virtual_password.VPLogonProcess(policy)¶

Error reasons:

PASSWORD_UNDEFINED
PASSWORD_WRONG
PASSWORD_EXPIRED

class aucore.au.ap.virtual_password.EmergPasswordLogonProcess(policy)¶

Error reasons:

EMERG_PASSWORD_EXPIRED
EMERG_PASSWORD_INEFFECTIVE
EMERG_PASSWORD_EXHAUSTED

class aucore.au.ap.ldap_password.LdapLogonProcess(policy)¶

Error reasons:

LDAP_PASSWORD_UNDEFINED
LDAP_PASSWORD_WRONG
LDAP_PASSWORD_ACCOUNT_RESTRICTION
LDAP_PASSWORD_INVALID_LOGON_HOURS
LDAP_PASSWORD_INVALID_WORKSTATION
LDAP_PASSWORD_ACCOUNT_DISABLED
LDAP_PASSWORD_TOO_MANY_CONTEXT_IDS
LDAP_PASSWORD_ACCOUNT_EXPIRED
LDAP_PASSWORD_MUST_CHANGE
LDAP_PASSWORD_ACCOUNT_LOCKED_OUT

class aucore.au.ap.messaging_otp.MessagingOTPLogonProcess(policy)¶

Generic logon process for SMS and Email logons.

Error reasons:

OTP_CANNOT_SEND
OTP_TOO_MANY_SENT
OTP_WAITING_PASSWORD
OTP_NO_PASSWORD
OTP_PASSWORD_EXPIRED
OTP_WRONG_PASSWORD
OTP_TOO_MANY_REQUESTS

class aucore.au.ap.otp.TotpLogonProcess(policy)¶

Error reasons:

TOTP_PASSWORD_UNDEFINED
TOTP_WAIT_MINUTE
TOTP_PASSWORD_WRONG

class aucore.au.ap.otp.HotpLogonProcess(policy)¶

Error reasons:

HOTP_PASSWORD_WRONG
HOTP_PASSWORD_UNDEFINED

class aucore.au.ap.radius.RadiusLogonProcess(policy)¶

Error reasons:

RADIUS_WRONG_PASSWORD

class aucore.au.ap.sec_quest.SecQuestLogonProcess(policy)¶

Error reasons:

SECQUEST_WRONG_ANSWERS
SECQUEST_WAITING_ANSWERS

class aucore.au.ap.u2f.U2fLogonProcess¶

Error reasons:

U2F_ALL_TOKENS_COMPROMISED
U2F_NO_TOKENS
U2F_WAITING_AUTH_RESPONSE

Example of login

Create logon process:

POST /api/v1/logon
{
  'endpoint_session_id': 'eSFakgjm0o7eCb0hlUTVf1jzf2uGs9Y9',
  'event': 'TEST',
  'method_id': 'U2F:1',
  'user_name': 'user1'
}

Return:
{ 'chains': [ { 'image_name': 'default',
                'is_enabled': True,
                'is_trusted': None,
                'methods': ['U2F:1'],
                'name': 'Test-chain',
                'position': 0,
                'short_name': ''}],
  'completed_methods': [],
  'current_method': 'U2F:1',
  'event_data_id': '',
  'event_name': 'TEST',
  'logon_process_id': 'kytfmodEy4QmcMKgEb9cuGpLpNv9ooYp',
  'msg': 'Process started',
  'plugins': [],
  'reason': 'PROCESS_STARTED',
  'status': 'MORE_DATA'
}

Ask server for signRequests (of enrolled devices):

POST /api/v1/logon/EXh0irMhPrWvEuSgVZuimGIiyU6ECBKc
{
 'endpoint_session_id': 'eSFakgjm0o7eCb0hlUTVf1jzf2uGs9Y9',
 'response': { 'appId': 'https://demo.yubico.com'  # maybe omitted, server will use default appId (VENDOR name)
                                                   # if you use browser u2f-api, pass https://<server_name>
             }
}

Returns:
{ 'chains': [ { 'image_name': 'default',
                'is_enabled': True,
                'is_trusted': None,
                'methods': ['U2F:1'],
                'name': 'Test-chain',
                'position': 0,
                'short_name': ''}],
  'completed_methods': [],
  'current_method': 'U2F:1',
  'event_data_id': '',
  'event_name': 'TEST',
  'logon_process_id': 'kytfmodEy4QmcMKgEb9cuGpLpNv9ooYp',
  'msg': 'Waiting authentication response',
  'plugins': [],
  'signRequests': [ { 'appId': 'https://demo.yubico.com',
                      'challenge': 'aU1A3-GQkcYDmgH78bGeO55dXN4fEyeTHGObhRr8GgI',
                      'keyHandle': 'qF5EfdOTSEK4kP3hlEd_Q2SD4kOYs6K9qZJR5Ve9EloEs6ns36GHG-jGUKFD4JLMwOqsLsRnsipa-XsBzfF6Ow',
                      'version': 'U2F_V2'}],
  'reason': 'U2F_WAITING_AUTH_RESPONSE',
  'status': 'MORE_DATA'
}

Forward signRequests to JSAPI (u2f.sign), get signResponse and forward to server:

POST /api/v1/logon/kytfmodEy4QmcMKgEb9cuGpLpNv9ooYp
{
   'endpoint_session_id': 'Xgn32atsnmFIkx9V4QTzJNXil9y5gNsz',
  'response': { 'signResponse': { 'clientData': 'eyJ0eXAiOiJuYXZpZ2F0b3IuaWQuZ2V0QXNzZXJ0aW9uIiwiY2hhbGxlbmdlIjoiZXYwd3dLR3l5bV9YamdZZkExd2tNT3Y4bGpsOHphS0F5WGdBV3gyUW91OCIsIm9yaWdpbiI6Imh0dHBzOi8vZGVtby55dWJpY28uY29tIiwiY2lkX3B1YmtleSI6IiJ9',
                                  'keyHandle': 'qF5EfdOTSEK4kP3hlEd_Q2SD4kOYs6K9qZJR5Ve9EloEs6ns36GHG-jGUKFD4JLMwOqsLsRnsipa-XsBzfF6Ow',
                                  'signatureData': 'AQAAAKowRAIgFrmzsrUHiUw2ixt20cXLjBRDo7-UoqWqZlNsFcXZL4ECIH45ALRE86ijsKPv_r3zmzhoE34N3NqzgvRJ1f49C1UA'}}
}

Returns:
{ 'chains': [ { 'image_name': 'default',
                'is_enabled': True,
                'is_trusted': None,
                'methods': ['U2F:1'],
                'name': 'Test-chain',
                'position': 0,
                'short_name': ''}],
  'completed_methods': ['U2F:1'],
  'current_method': 'U2F:1',
  'data_id': '',
  'event_data_id': '',
  'event_name': 'TEST',
  'login_session_id': 'dkQsnIAMsCxQrcJP9AgIB2tSCkDDZQML',
  'logon_process_id': 'kytfmodEy4QmcMKgEb9cuGpLpNv9ooYp',
  'msg': 'Welcome!',
  'plugins': [],
  'repo_id': 'e960429a3a8011e58604000c294fde0e',
  'status': 'OK',
  'user_id': 'e964ce283a8011e58604000c294fde0e',
  'user_name': 'LOCAL\user1'
}

class aucore.au.ap.smartphone_ap.SmartphoneLogonProcess(policy)¶

Error reasons:

SMARTPHONE_SAME_TOTP
SMARTPHONE_WRONG_TOTP
SMARTPHONE_AUTH_CONFIRM_TIMEOUT
SMARTPHONE_AUTH_REJECTED
SMARTPHONE_LOGON_IN_PROGRESS
SMARTPHONE_WAITING_DATA

class aucore.au.ap.voice.VoiceLogonProcess(policy)¶

Error reasons:

VOICE_PIN_NOT_VERIFIED
VOICE_CALL_IN_PROGRESS
VOICE_PIN_EXPIRED
VOICE_CANNOT_CALL
VOICE_CALL_INITIATED

class aucore.au.ap.smartcard.SmartcardLogonProcess¶

Now only support contactless cards (UID) and certificate-based (PKI) cards. This method supports 1N-logon, you can define card UID in ‘unit_id’ parameter instead of user_name. Yes, you send card_uid twice. Second one is needed for not 1N-logon scenarios, card AP is not first method of the chain. Non-1N logon is also supported.

Example of login

Create logon process:

POST /api/v1/logon
{
  "endpoint_session_id": "P7p3JJuenqo0SnyJ4HnbRbbJIqDhtt0u",
  "event": "TEST",
  "method_id": "CARD:1",
  "unit_id": "11223344",
  "is_1N": true
}

Return:
{ "event_name": "TEST",
  "current_method": "CARD:1",
  "plugins": [],
  "completed_methods": [],
  "msg": "Process started",
  "logon_process_id": "t9HZES2DFD6vDjhA3wNtizyjAuqMTrwi",
  "event_data_id": "",
  "chains": [{ "short_name": "",
               "methods": ["ANY"],
               "position": 1000,
               "name": "TEST CHAIN",
               "is_trusted": null,
               "is_enabled": true,
               "image_name": "default"}],
  "reason": "PROCESS_STARTED",
  "status": "MORE_DATA"
}

Send Smartcard UID and card certificate(for PKI-cards):

POST /api/v1/logon/t9HZES2DFD6vDjhA3wNtizyjAuqMTrwi/do_logon
{
   "endpoint_session_id": "P7p3JJuenqo0SnyJ4HnbRbbJIqDhtt0u",
   "response": {"card_uid": "112233", "card_cert": "<hex cert in DER format>"}
}

Return:
{ "repo_obj_id": "6104a6ce424b11e5b7ebdc85de0b0889",
  "repo_id": "6104a6c5424b11e5b7ebdc85de0b0889",
  "logon_process_id": "t9HZES2DFD6vDjhA3wNtizyjAuqMTrwi",
  "status": "OK",
  "plugins": [],
  "msg": "Welcome!",
  "current_method": "CARD:1",
  "completed_methods": ["CARD:1"],
  "chains": [{ "methods": ["ANY"],
               "image_name": "default",
               "short_name": "",
               "position": 1000,
               "is_enabled": true,
               "is_trusted": null,
               "name": "TEST CHAIN"}],
  "event_data_id": "",
  "user_id": "6104a6cf424b11e5b7ebdc85de0b0889",
  "user_name": "LOCAL\ADMIN",
  "login_session_id": "DirIO8s41TbT1lm7Dh5BNfK6gRTHhXTl",
  "data_id": "",
  "event_name": "TEST"
}

Logon methods¶

Previous topic

Next topic

This Page