Multi-factor authentication for Mendix

Category: Modules
Subcategory: Authentication

Overview

The musthave multi-factor(MFA) / twofactor(2FA) authentication module that uses the Mendix core login/authentication capabilities together with an additional layer of security. It creates a usersession after user+password AND an additional code is validated. It supports all the common ways to create/validating codes like SMS, e-mail and (Google) Authenticator app.

Documentation

Multi-factor authentication for Mendix

What is Multi-factor Authentication?

Multi-factor authentication (MFA; also known as Two-factor authentication or 2FA, along with similar terms) is an electronic authentication method in which a user is granted access to a website or application only after successfully presenting two or more pieces of evidence (or factors) to an authentication mechanism: knowledge (something only the user knows), possession (something only the user has), and inherence (something only the user is). MFA protects the user from an unknown person trying to access their data such as personal ID details or financial assets.

A third-party authenticator (TPA) app enables two-factor authentication, usually by showing a randomly generated and constantly refreshing code to use for authentication. (source:Wikipedia)

What is the problem we solve?

The available multi-factor implementations in the Marketplace offer the end-user of an Mendix application during the login procedure to enter the code from a SMS, E-mail or generated by an authenticator (Google or other) after the actual login (and creation of the user session). See the diagram below:

alt text

https://swimlanes.io/d/zEPQlLV3T

At a successful login and prior to entering an MFA code, the user already has a valid user session and access to the user's authorized pages, microflows etc. (but you cannot see them nor easy access them). This approach only works when dynamic role assignment is done after a valid MFA code (which is not default Mendix functionality).

What is the solution?

We have built a MFA module that extends the Mendix LoginAction, documented at https://apidocs.rnd.mendix.com/7/runtime/com/mendix/core/action/user/LoginAction.html The MFA code is validated first and only then the module creates a user session which grants the user access to their pages, microflows etc.

alt text

https://swimlanes.io/u/4o7jaAOjY

How did we prove that this module is secure?

At the point in time after login in the first step:

mx.data.get({ xpath:'//System.User', callback:function(data){console.log(data);} })

still returns the anonymous User object:

alt text

Scenarios to cover:

  • Default login via login.html for accounts with MFA disabled.
  • Default login via widgets for accounts with MFA disabled.
  • Default login for webservice and REST accounts.
  • Login by a customized login.html with MFA enabled (login-with-mfa.html + login-mfa.js + Authenticator app code only. Not compatible code sent by SMS or E-mail).
  • Login by default widgets but extended with ability to enter MFA code with MFA enabled.
  • Native mobile login

Configuration

  1. Download the module from the Mendix Marketplace here:

Or from Github: https://github.com/appronto/multifactor-authentication

  1. Download the Nanoflow Commons from the Mendix Marketplace

There are a few things to configure:

After startup configuration:

  1. Add ASU_MFA Microflow in your After Startup.

  2. Change SUB_MFA_UserDisabledCheck to call your logic to determine if the logged in user needs to be multi-factor authenticated.

    Example is available in SUB_MFA_UserDisabledCheck (copy this to your own module). If you use this example please Add the new attributes HasMFAenabled(Boolean) and LastLogin2FA (datetime) to the Account entity.

  3. Add your method(s) of multifactor authentication in SUB_MFA_ValidateCode.

    Examples are available:

  4. Add snippet SN_MFA_LoginPage / SN_Login_Native to your login page

  5. If applicable move the login-with-mfa.html and js/login-mfa.js from the resources directory to your theme directory to support login actions with MFA from these pages.

  6. Set the constant EnabledMFA to true to get started!

Keep in mind when upgrading the module from the Appstore in the future:

It will break the login mechanism, but you will be notified because by default an exception will be raised and warnings will be shown when the module with your MFA logic hasn't been configured correcty. Like this "An error has occurred while handling the request: java.lang.Exception: SUB_MFA_UserDisabledCheck microflow not yet implemented. Did you upgrade? ".

What we learned

We preferred a non-persistent approach to keep track of the anonymous user login steps (first with login, second with MFA code). We found out when the first attempt was successfully validated, in the second step when passing the MFA code, the context/relation to the previous anonymous session was deleted. Therefore we could not correlate this to the first step. When we use a persistent MFA entity (and commit the MFA object after the first login step) it works.

alt text

For native mobile we needed to change the sign in nanoflow activity to save the login object in the local mobile device storage(that is not possible in web for security reasons).

Advanced java challenges:

When extending the LoginAction class and trying to set parameters from this class in our extended class, we found out this was not possible in combination with the super.execute() method. We decided to use createSession. We have already validated the username and password in the first step and the MFA object can't be modified/created by the anonymous user (and is also checked twice).

We also wanted the module to be compatible via a login.html variant and the custom login-with-mfa.html. Therefore, it is necessary to send the MFA code together with your username and password. We need to pass this MFA code through the header because the payload is stripped by the Core LoginAction functionality.

Login-with-mfa.html:

alt text

Login-mfa.js:

alt text

MultiFactorAuthLoginAction.java:

alt text

Please report issues

Have you found an issue or a vulnerability in this module, please reach out to pim@appronto.nl. I will reward you with a nice goodie bag and will publish the new version to the Marketplace.

Releases

Version: 1.4.0
Framework Version: 8.18.8
Release Notes: Extra check on read rights on username in java, Snippet have onEnter event now for the code that prevents errors, Added log before the exception for SUB_MFA_ValidateCode Renamed UserDisabledCheck microflow
Version: 1.3.0
Framework Version: 8.18.8
Release Notes: - added native mobile login snippet - upgraded HTMLsnippet to the newest version - added more logging after upgrading (SUB_MFA_CreateCode, SUB_MFA_UserDisabledCheck, SUB_MFA_ValidateCode) - changed documentation - added check for MxAdmin - Mendix version 8.18.8
Version: 1.2.0
Framework Version: 8.14.1
Release Notes: Fixed a scenario with users without MFA
Version: 1.1.1
Framework Version: 7.23.19
Release Notes: Mendix 7.23.19 version. Thank to Jan B. Added example customized java code for SignIn Microflow and IP range module!
Version: 1.1.0
Framework Version: 8.14.1
Release Notes: Thnx for the feedback Jan B. Added examples for fallback scenarios (to support multiple MFA methods for an account). Check https://github.com/RoelandSalij/GoogleAuthenticator/issues/3 for a Mendix 8.14.1 version of Google Authenticator.