Rev 1282 | Rev 1298 | Go to most recent revision | Details | Compare with Previous | Last modification | View Log | RSS feed
Rev | Author | Line No. | Line |
---|---|---|---|
1207 | daniel-mar | 1 | |
2 | SERVER_SECRET |
||
3 | ============= |
||
4 | |||
5 | In the base configuration, you will see something like this: |
||
6 | |||
1282 | daniel-mar | 7 | OIDplus::baseConfig()->setValue("SERVER_SECRET", "................................"); |
1207 | daniel-mar | 8 | |
9 | This value is chosen randomly by the configuration file generator (setup). |
||
10 | |||
1282 | daniel-mar | 11 | Derivation of secrets and auth keys |
12 | ----------------------------------- |
||
1207 | daniel-mar | 13 | |
1283 | daniel-mar | 14 | The usage of `OIDplus::baseConfig()->getValue("SERVER_SECRET")` |
1282 | daniel-mar | 15 | is deprecated due to security considerations. |
16 | |||
17 | Instead, please always use `OIDplus::authUtils()->makeSecret()` |
||
18 | with a unique `$data` argument (prefer a GUID) |
||
19 | if you need a secret that is derived from the server secret. |
||
20 | |||
21 | If you want to generate an authentication key (e.g. to send via an email), |
||
22 | use `OIDplus::authUtils()->makeAuthKey()` |
||
23 | with a unique `$data` argument (prefer a GUID) |
||
24 | in combination with `OIDplus::authUtils()->validateAuthKey()`. |
||
1283 | daniel-mar | 25 | An auth key is usually temporary; therefore `makeAuthKey` encodes a timestamp |
26 | which can be checked by `validateAuthKey` by providing |
||
27 | a validity period in seconds. |
||
1282 | daniel-mar | 28 | |
29 | Where are makeAuthKey and makeSecret being used? |
||
30 | ------------------------------------------------ |
||
31 | |||
32 | System / Core: |
||
1207 | daniel-mar | 33 | - Auth content Store (OIDplusAuthContentStoreJWT.class.php): |
1283 | daniel-mar | 34 | Key to sign JWT tokens (used for Automated AJAX requests, REST API and logins with "Remember me") |
1282 | daniel-mar | 35 | * If a private/public key pair exists: Sign the JWT using that private key. |
1283 | daniel-mar | 36 | * Otherwise sign it using PBKDF2+HMAC: |
37 | `JWT = HS512(hash_pbkdf2("sha512", OIDplus::authUtils()->makeSecret(["0be35e52-f4ef-11ed-b67e-3c4a92df8582"]), "", 10000, 64/*256bit*/, false))` |
||
1207 | daniel-mar | 38 | - Session Handler (OIDplusSessionHandler.class.php): |
39 | Encryption of session contents (regular logins) |
||
1282 | daniel-mar | 40 | * if OpenSSL is installed: sha512-pbkdf2 + AES-256-CBC + sha3-512-hmac |
41 | * if OpenSSL is not installed: sha3-512-hmac |
||
1283 | daniel-mar | 42 | * In both cases, the key is `OIDplus::authUtils()->makeSecret(["b118abc8-f4ec-11ed-86ca-3c4a92df8582"])`. |
1207 | daniel-mar | 43 | |
1282 | daniel-mar | 44 | Temporary auth keys (sent via email etc.): |
45 | * used at plugin forgot RA password (public/091): |
||
1283 | daniel-mar | 46 | `makeAuthKey(["93a16dbe-f4fb-11ed-b67e-3c4a92df8582", email])` |
1282 | daniel-mar | 47 | * used at plugin ViaThinkSoft FreeOID activation (public/200): |
1283 | daniel-mar | 48 | `makeAuthKey(["40c87e20-f4fb-11ed-86ca-3c4a92df8582", email])` |
1282 | daniel-mar | 49 | * used at plugin invite RA (ra/092): |
1283 | daniel-mar | 50 | `makeAuthKey(["ed840c3e-f4fa-11ed-b67e-3c4a92df8582", email])` |
1282 | daniel-mar | 51 | * used at plugin change RA email (ra/102): |
1283 | daniel-mar | 52 | `makeAuthKey(["5ef24124-f4fb-11ed-b67e-3c4a92df8582", old_email, new_email])` |
1207 | daniel-mar | 53 | |
1282 | daniel-mar | 54 | Plugin OID-IP (public/100): |
1283 | daniel-mar | 55 | - Authentication token for hidden OIDs = `smallhash(OIDplus::authUtils()->makeSecret(["d8f44c7c-f4e9-11ed-86ca-3c4a92df8582", id]))` |
1282 | daniel-mar | 56 | |
1207 | daniel-mar | 57 | Plugin VNag version check (admin/901): |
1283 | daniel-mar | 58 | - Webreader password = `OIDplus::authUtils()->makeSecret(["65d9f488-f4eb-11ed-b67e-3c4a92df8582"])` |
1207 | daniel-mar | 59 | |
1282 | daniel-mar | 60 | Plugin RDAP (frdl): |
1283 | daniel-mar | 61 | - `OIDplus::authUtils()->makeSecret(["cee75760-f4f8-11ed-b67e-3c4a92df8582"])` is used to generate a cache filename |
1207 | daniel-mar | 62 | |
1282 | daniel-mar | 63 | Plugin VTS Client Challenge Captcha: |
1283 | daniel-mar | 64 | - Challenge integrity : `OIDplus::authUtils()->makeAuthKey(["797bfc34-f4fa-11ed-86ca-3c4a92df8582", challenge])` |
65 | - Cache filename : `"vts_client_challenge_" + OIDplus::authUtils()->makeSecret(["461f4a9e-f4fa-11ed-86ca-3c4a92df8582", ipTarget, random]) + ".tmp"` |
||
1207 | daniel-mar | 66 | |
1282 | daniel-mar | 67 | GUID Registry |
68 | ------------- |
||
1207 | daniel-mar | 69 | |
1283 | daniel-mar | 70 | The "realm GUIDs" are documented at the [ViaThinkSoft OIDplus Registration Authority](https://oidplus.viathinksoft.com/oidplus/?goto=guid%3Aoidplus%2FauthRealms). |