Rev 1322 | Details | Compare with Previous | Last modification | View Log | RSS feed
Rev | Author | Line No. | Line |
---|---|---|---|
1207 | daniel-mar | 1 | |
2 | SERVER_SECRET |
||
3 | ============= |
||
4 | |||
5 | In the base configuration, you will see something like this: |
||
6 | |||
1282 | daniel-mar | 7 | OIDplus::baseConfig()->setValue("SERVER_SECRET", "................................"); |
1207 | daniel-mar | 8 | |
9 | This value is chosen randomly by the configuration file generator (setup). |
||
10 | |||
1282 | daniel-mar | 11 | Derivation of secrets and auth keys |
12 | ----------------------------------- |
||
1207 | daniel-mar | 13 | |
1283 | daniel-mar | 14 | The usage of `OIDplus::baseConfig()->getValue("SERVER_SECRET")` |
1282 | daniel-mar | 15 | is deprecated due to security considerations. |
16 | |||
17 | Instead, please always use `OIDplus::authUtils()->makeSecret()` |
||
18 | with a unique `$data` argument (prefer a GUID) |
||
19 | if you need a secret that is derived from the server secret. |
||
20 | |||
21 | If you want to generate an authentication key (e.g. to send via an email), |
||
22 | use `OIDplus::authUtils()->makeAuthKey()` |
||
23 | with a unique `$data` argument (prefer a GUID) |
||
24 | in combination with `OIDplus::authUtils()->validateAuthKey()`. |
||
1283 | daniel-mar | 25 | An auth key is usually temporary; therefore `makeAuthKey` encodes a timestamp |
26 | which can be checked by `validateAuthKey` by providing |
||
27 | a validity period in seconds. |
||
1282 | daniel-mar | 28 | |
29 | Where are makeAuthKey and makeSecret being used? |
||
30 | ------------------------------------------------ |
||
31 | |||
32 | System / Core: |
||
1207 | daniel-mar | 33 | - Auth content Store (OIDplusAuthContentStoreJWT.class.php): |
1305 | daniel-mar | 34 | Key to sign JWT tokens (used for Automated AJAX requests, REST API and web browser logins) |
1282 | daniel-mar | 35 | * If a private/public key pair exists: Sign the JWT using that private key. |
1283 | daniel-mar | 36 | * Otherwise sign it using PBKDF2+HMAC: |
37 | `JWT = HS512(hash_pbkdf2("sha512", OIDplus::authUtils()->makeSecret(["0be35e52-f4ef-11ed-b67e-3c4a92df8582"]), "", 10000, 64/*256bit*/, false))` |
||
1298 | daniel-mar | 38 | - The JWT additionally contains a member `oidplus_ssh = OIDplus::authUtils()->makeSecret(["bb1aebd6-fe6a-11ed-a553-3c4a92df8582"]` (SSH = Server Secret Hash) |
39 | with the sole purpose of allowing to invalidate all issued JWT by changing the server secret. |
||
40 | (This would be more secure than the Blacklist feature, since changing the server secret) |
||
41 | also invalidates JWT which might have been maliciously postdated). |
||
1207 | daniel-mar | 42 | |
1282 | daniel-mar | 43 | Temporary auth keys (sent via email etc.): |
44 | * used at plugin forgot RA password (public/091): |
||
1283 | daniel-mar | 45 | `makeAuthKey(["93a16dbe-f4fb-11ed-b67e-3c4a92df8582", email])` |
1282 | daniel-mar | 46 | * used at plugin ViaThinkSoft FreeOID activation (public/200): |
1283 | daniel-mar | 47 | `makeAuthKey(["40c87e20-f4fb-11ed-86ca-3c4a92df8582", email])` |
1282 | daniel-mar | 48 | * used at plugin invite RA (ra/092): |
1283 | daniel-mar | 49 | `makeAuthKey(["ed840c3e-f4fa-11ed-b67e-3c4a92df8582", email])` |
1282 | daniel-mar | 50 | * used at plugin change RA email (ra/102): |
1283 | daniel-mar | 51 | `makeAuthKey(["5ef24124-f4fb-11ed-b67e-3c4a92df8582", old_email, new_email])` |
1207 | daniel-mar | 52 | |
1282 | daniel-mar | 53 | Plugin OID-IP (public/100): |
1283 | daniel-mar | 54 | - Authentication token for hidden OIDs = `smallhash(OIDplus::authUtils()->makeSecret(["d8f44c7c-f4e9-11ed-86ca-3c4a92df8582", id]))` |
1282 | daniel-mar | 55 | |
1207 | daniel-mar | 56 | Plugin VNag version check (admin/901): |
1283 | daniel-mar | 57 | - Webreader password = `OIDplus::authUtils()->makeSecret(["65d9f488-f4eb-11ed-b67e-3c4a92df8582"])` |
1207 | daniel-mar | 58 | |
1282 | daniel-mar | 59 | Plugin RDAP (frdl): |
1283 | daniel-mar | 60 | - `OIDplus::authUtils()->makeSecret(["cee75760-f4f8-11ed-b67e-3c4a92df8582"])` is used to generate a cache filename |
1207 | daniel-mar | 61 | |
1282 | daniel-mar | 62 | Plugin VTS Client Challenge Captcha: |
1283 | daniel-mar | 63 | - Challenge integrity : `OIDplus::authUtils()->makeAuthKey(["797bfc34-f4fa-11ed-86ca-3c4a92df8582", challenge])` |
64 | - Cache filename : `"vts_client_challenge_" + OIDplus::authUtils()->makeSecret(["461f4a9e-f4fa-11ed-86ca-3c4a92df8582", ipTarget, random]) + ".tmp"` |
||
1207 | daniel-mar | 65 | |
1282 | daniel-mar | 66 | GUID Registry |
67 | ------------- |
||
1207 | daniel-mar | 68 | |
1439 | daniel-mar | 69 | The "realm GUIDs" are documented at the [ViaThinkSoft OIDplus Registration Authority](https://hosted.oidplus.com/viathinksoft/?goto=guid%3Aoidplus%2FauthRealms). |