twofactor

Documentation

Overview

Example

package main

import (
	"context"
	"fmt"
	"net/http"

	"github.com/shaj13/go-guardian/auth"
	"github.com/shaj13/go-guardian/auth/strategies/basic"
	"github.com/shaj13/go-guardian/auth/strategies/twofactor"
	"github.com/shaj13/go-guardian/tfa"
)

type OTPManager struct{}

func (OTPManager) Enabled(_ auth.Info) bool { return true }

func (OTPManager) Load(_ auth.Info) (twofactor.OTP, error) {
	// user otp configuration must be loaded from persistent storage
	cfg := tfa.OTPConfig{
		OTPType: tfa.HOTP,
		Label:   "LABEL",
		Counter: 0,
		Secret:  "GXNRHI2MFRFWXQGJHWZJFOSYI6E7MEVA",
	}
	_, otp, err := tfa.NewOTP(&cfg)
	return otp, err
}

func (OTPManager) Store(_ auth.Info, otp twofactor.OTP) error {
	// persist user otp after verification
	fmt.Println("Failed: ", otp.(tfa.OTP).Failed())
	return nil
}

func main() {
	strategy := twofactor.Strategy{
		Parser:  twofactor.XHeaderParser("X-Example-OTP"),
		Manager: OTPManager{},
		Primary: basic.AuthenticateFunc(
			func(ctx context.Context, r *http.Request, userName, password string) (auth.Info, error) {
				return auth.NewDefaultUser("example", "1", nil, nil), nil
			},
		),
	}

	r, _ := http.NewRequest("GET", "/", nil)
	r.SetBasicAuth("example", "example")
	r.Header.Set("X-Example-OTP", "345515")

	info, err := strategy.Authenticate(r.Context(), r)
	fmt.Println(info.UserName(), err)

}

Output:

Failed:  0
example <nil>

Index

• Constants
• Variables
• type OTP
• type OTPManager
• type Parser
  • func CookieParser(key string) Parser
  • func JSONBodyParser(key string) Parser
  • func QueryParser(key string) Parser
  • func XHeaderParser(header string) Parser
• type Strategy
  • func (s Strategy) Authenticate(ctx context.Context, r *http.Request) (auth.Info, error)

Examples

• Package

Constants

const StrategyKey = auth.StrategyKey("2FA.Strategy")

StrategyKey export identifier for the two factor strategy, commonly used when enable/add strategy to go-guardian authenticator.

Variables

var ErrInvalidPin = errors.New("strategies/twofactor: Invalid one time password")

ErrInvalidPin is returned by strategy, When the user-supplied an invalid one time password and verification process failed.

var ErrMissingPin = errors.New("strategies/twofactor: One-time password missing or empty")

ErrMissingPin is returned by Parser, When one-time password missing or empty in HTTP request.

Types

type OTP

type OTP interface {
	// Verify user one-time password.
	Verify(pin string) (bool, error)
}

OTP represents one-time password verification.

type OTPManager

type OTPManager interface {
	// Enabled check if two factor for user.
	Enabled(user auth.Info) bool
	// Load return user OTP or error.
	Load(user auth.Info) (OTP, error)
	// Store user OTP.
	Store(user auth.Info, otp OTP) error
}

OTPManager load and store user OTP.

type Parser

type Parser interface {
	PinCode(r *http.Request) (string, error)
}

Parser parse and extract one-time password from incoming HTTP request.

func CookieParser

func CookieParser(key string) Parser

CookieParser return a one-time password parser, where pin extracted form HTTP Cookie.

func JSONBodyParser

func JSONBodyParser(key string) Parser

JSONBodyParser return a one-time password parser, where pin extracted form request body.

func QueryParser

func QueryParser(key string) Parser

QueryParser return a one-time password parser, where pin extracted form HTTP query string.

func XHeaderParser

func XHeaderParser(header string) Parser

XHeaderParser return a one-time password parser, where pin extracted form "X-" header.

type Strategy

type Strategy struct {
	// Primary strategy that authenticates the user before verifying the one time password.
	// The primary strategy Typically of type basic or LDAP.
	Primary auth.Strategy
	Parser  Parser
	Manager OTPManager
}

Strategy represents two factor authentication strategy.

func (Strategy) Authenticate

func (s Strategy) Authenticate(ctx context.Context, r *http.Request) (auth.Info, error)

Authenticate returns user info or error by authenticating request using primary strategy, and then verifying one-time password.