"This does not, however, lead directly to the desired entrance - but to a further barrier.\n",
"\n",
"The **second login step** prevents unauthorized third parties from gaining access to your account just because they might have stolen your password.\n",
"A quite common 2nd-factor is a time-based one-time **confirmation code** generated by a **2fa-generator app** you installs and initializes once on one of your personal devices.\n",
"This 2fa-generator app then provides (in our case every 30 seconds) a new confirmation code that needs to be entered on the login page.\n",
"A quite common 2nd-factor is a **One-Time Password (OTP)** generated by a so-called **OPT-App** you installs and initializes once on one of your personal devices.\n",
"This *OPT-app* then provides (in our case every 30 seconds) a new *one-time password* that needs to be entered on the login page.\n",
" \n",
"<div style=\"clear:both\"></div>"
]
...
...
@@ -51,7 +51,7 @@
"## Basic Principle\n",
"These two factors for authentication combine the building blocks **knowledge** and **possession** in the login procedure. \n",
"- **knowledge** - the secret knowledge is the password you enter. \n",
"- **possession** - With the confirmation code you show that you are in possession of a certain device (e.g. your smartphone), because only the *2fa-generator app*, installed on that device, can generate the necessary *confirmation code*. \n",
"- **possession** - With the *one-time password* you show that you are in possession of a certain device (e.g. your smartphone), because only the *OTP-App*, installed on that device, can generate it. \n",
"\n",
"<div style=\"clear:both\"></div>\n",
"<div>\n",
...
...
@@ -69,16 +69,16 @@
"</div>\n",
"\n",
"## Algorithm\n",
"The **2fa-generator app** calculates the current personal **confirmation code** completely autonomously from the outside world using a standardized and open algorithm for the generation of **Time-based One-Time Passwords (TOTP)**. \n",
"The **OTP-App** can calculate personal one-time passwords completely autonomously from the outside world using a standardized and open algorithm for the generation of **Time-based One-Time Passwords (TOTP)**. \n",
"\n",
"The TOTP algorithm was published in 2011 by the [Internet Engineering Task Force (IETF)](https://www.ietf.com) as [RFC 6238](https://tools.ietf.org/html/rfc6238). The TOTP algorithm is a hash function in which a secret code is hashed together with the current time.\n",
"The *TOTP algorithm* was published in 2011 by the [Internet Engineering Task Force (IETF)](https://www.ietf.com) as [RFC 6238](https://tools.ietf.org/html/rfc6238). The *TOTP algorithm* is a hash function in which a secret code is hashed together with the current time.\n",
"Behind the hash function is the HMAC-based One-time Password Algorithm according to [RFC 4226](https://tools.ietf.org/html/rfc4226) - in simple terms nothing more than a standard that forms a hash in a certain way.\n",
"\n",
"The calculation includes both a **\"secret initialization code\"**, that is known to both the server and the client, and the **current time**.\n",
"The final one-time *confirmation code* is generated from these two inputs and is valid for a certain period of time. (in our case for **30 seconds**).\n",
"The final *one-time password* is generated from these two inputs and is valid for a certain period of time. (in our case for **30 seconds**).\n",
"The procedure can be implemented in such a way that slight differences in time between client and server are accepted.\n",
"\n",
"Hence, any confirmation code is time-based, calculated locally, and always unique.\n",
"Hence, any *one-time password* is time-based, calculated locally, and always unique.\n",
"\n",
"<div style=\"clear:both\"></div>\n",
"\n",
...
...
@@ -101,11 +101,11 @@
"- (1) **request 2FA** for Jupyter-JSC, \n",
" - (a) login to [Jupyter-JSC](https://jupyter-jsc.fz-juelich.de) \n",
" - (b) visit https://jupyter-jsc.fz-juelich.de/2fa and request 2FA \n",
" - (c) wait for confirmation emails and click the provided activation link \n",
" - (c) wait for a *confirmation emails* and click the provided *activation link* \n",
"- (2) **activate 2FA** for Juypter-JSC,\n",
" - (a) install a **2fa-generator app**, which supports the TOTP algorithm \n",
" - (b) communicate the **secret initialization code** to this 2fa-generator app \n",
" - (c) test a first **confirmation code** generated. \n",
" - (a) install an **OTP-App**, which supports the TOTP algorithm \n",
" - (b) communicate the **secret initialization code** to this *OTP-App* \n",
" - (c) test a first **one-time password** generated. \n",
"\n",
"... and then 2FA is ready to be used next time you log in.\n",
"\n",
...
...
@@ -117,12 +117,12 @@
"A **confirmation email** including an **activation link** will be send to you directly.\n",
"\n",
"### 2. Activate 2FA\n",
"Please follow this activation link to instruct Jupyter-JSC for preparation of your 2FA. \n",
"Please follow this *activation link* to instruct Jupyter-JSC for preparation of your 2FA. \n",
"You will be asked to re-login to your account to recieve a **secret initialization code** as QR-Code (and string) \n",
"for a required 2fa-generator app. \n",
"for a required *OTP-App*. \n",
"\n",
"So first, you need to install a **2fa-generator app** on one of your personal devices (if you haven´t done so already), \n",
"which you plan to use in the future to generate the required **confirmation codes** for each time you log in:\n",
"So first, you need to install an **OTP-App** on one of your personal devices (if you haven´t done so already), \n",
"which you plan to use in the future to generate the required **one-time passwords** for each time you log in:\n",
"The TOTP algorithm can also be implemented in hardware as a so-called \"hardware token\" (e.g. [Protectimus Tokens](https://www.protectimus.com/tokens/)) \n",
"The *TOTP algorithm* can also be implemented in hardware as a so-called \"hardware token\" (e.g. [Protectimus Tokens](https://www.protectimus.com/tokens/)) \n",
"Before you can use 2FA for Jupyter-JSC a random, user-specific, unique and **secret initialization code** must be known by both Jupyter-JSC and the users 2fa-generator app.\n",
"### b. OTP-App Initialization & Validation\n",
"Before you can use 2FA for Jupyter-JSC a random, user-specific, unique and **secret initialization code** must be known by both Jupyter-JSC and the your *OTP-App*.\n",
"This *secret initialization code* gets generated by Jupyter-JSC and is shown as a **QR-Code** (or string) on the activation page.\n",
"\n",
"The QR-Code provides the *secret initialization code* with the descriptive data (1) algorithm = TOTP, (2) period of validity = 30s.\n",
"Please ensure you set these descriptive dates manually in your 2fa-generator app **if you prefer to use the string** instead of the QR-Code.\n",
"**If you prefer to use the string** instead of the QR-Code, please ensure you set these descriptive dates manually in your *OTP-App*.\n",
"\n",
"Next, the 2fa-generates app provides now a **verification code** you have to enter on the activation webpage.\n",
"Jupyter-JSC now compares the *verification code* you provide with the one generated by Jupyter-JSC.\n",
"Next, the *OTP-App* provides now a **verification code** you have to enter on the activation webpage.\n",
"Jupyter-JSC compares the *verification code* you provide with the one generated by Jupyter-JSC.\n",
"\n",
"If they match, **2FA is now activated**.\n",
"\n",
...
...
@@ -193,16 +193,25 @@
"Congratulation! You are now ready to use 2-Factor Authentication with Jupyter-JSC.\n",
"\n",
"Login is now as simple as this\n",
"1. **Enter your password** \n",
" Each time you log in, you enter your password as usual. \n",
"2. **Enter the current confirmation code** \n",
" You will then be asked for a confirmation code that you can read from your installed & initialized 2fa-generator app (e.g. on your smartphone). \n",
"1. **Enter your JSC-account password** \n",
" Each time you log in, you enter your JSC-account password as usual. \n",
"2. **Enter the current one-time password** \n",
" You will then be asked for a *one-time password* that you can read from your installed & initialized *OTP-App* (e.g. on your smartphone). \n",
" \n",
"**Remember me** \n",
"Jupyter-JSC can set a cookie to remember, that you have logged in from this device already. \n",
"Just check the \"Remember me\" **checkbox** where you enter confirmation code. \n",
"Jupyter-JSC **skips the evaluation** of the confirmation code in this browser on that device then for **one week**."
"Just check the \"Remember me\" **checkbox** where you enter *one-time password* . \n",
"Jupyter-JSC **skips the request** of a *one-time password* in this browser on that device then for **one week**. \n",
2-Factor Authentication (2FA), sometimes referred to as two-factor verification, is a security method in which you provide **two different authentication factors** to identify yourself at login.
This process is **performed to better protect** both your credentials and the resources that you can access.
In the **first login step**, you start with the usual entry of a good password. The service then confirms the correctness of the password entered.
This does not, however, lead directly to the desired entrance - but to a further barrier.
The **second login step** prevents unauthorized third parties from gaining access to your account just because they might have stolen your password.
A quite common 2nd-factor is a time-based one-time **confirmation code** generated by a **2fa-generator app** you installs and initializes once on one of your personal devices.
This 2fa-generator app then provides (in our case every 30 seconds) a new confirmation code that needs to be entered on the login page.
A quite common 2nd-factor is a **One-Time Password (OTP)** generated by a so-called **OPT-App** you installs and initializes once on one of your personal devices.
This *OPT-app* then provides (in our case every 30 seconds) a new *one-time password* that needs to be entered on the login page.
These two factors for authentication combine the building blocks **knowledge** and **possession** in the login procedure.
-**knowledge** - the secret knowledge is the password you enter.
-**possession** - With the confirmation code you show that you are in possession of a certain device (e.g. your smartphone), because only the *2fa-generator app*, installed on that device, can generate the necessary *confirmation code*.
-**possession** - With the *one-time password* you show that you are in possession of a certain device (e.g. your smartphone), because only the *OTP-App*, installed on that device, can generate it.
<div style="clear:both"></div>
<div>
<p style="float:right">Source: Bundesamt für Sicherheit in der Informationstechnik</p>
The **2fa-generator app** calculates the current personal **confirmation code** completely autonomously from the outside world using a standardized and open algorithm for the generation of **Time-based One-Time Passwords (TOTP)**.
The **OTP-App** can calculate personal one-time passwords completely autonomously from the outside world using a standardized and open algorithm for the generation of **Time-based One-Time Passwords (TOTP)**.
The TOTP algorithm was published in 2011 by the [Internet Engineering Task Force (IETF)](https://www.ietf.com) as [RFC 6238](https://tools.ietf.org/html/rfc6238). The TOTP algorithm is a hash function in which a secret code is hashed together with the current time.
The *TOTP algorithm* was published in 2011 by the [Internet Engineering Task Force (IETF)](https://www.ietf.com) as [RFC 6238](https://tools.ietf.org/html/rfc6238). The *TOTP algorithm* is a hash function in which a secret code is hashed together with the current time.
Behind the hash function is the HMAC-based One-time Password Algorithm according to [RFC 4226](https://tools.ietf.org/html/rfc4226) - in simple terms nothing more than a standard that forms a hash in a certain way.
The calculation includes both a **"secret initialization code"**, that is known to both the server and the client, and the **current time**.
The final one-time *confirmation code* is generated from these two inputs and is valid for a certain period of time. (in our case for **30 seconds**).
The final *one-time password* is generated from these two inputs and is valid for a certain period of time. (in our case for **30 seconds**).
The procedure can be implemented in such a way that slight differences in time between client and server are accepted.
Hence, any confirmation code is time-based, calculated locally, and always unique.
Hence, any *one-time password* is time-based, calculated locally, and always unique.
The TOTP algorithm can also be implemented in hardware as a so-called "hardware token" (e.g. [Protectimus Tokens](https://www.protectimus.com/tokens/))
The *TOTP algorithm* can also be implemented in hardware as a so-called "hardware token" (e.g. [Protectimus Tokens](https://www.protectimus.com/tokens/))
Before you can use 2FA for Jupyter-JSC a random, user-specific, unique and **secret initialization code** must be known by both Jupyter-JSC and the users 2fa-generator app.
### b. OTP-App Initialization & Validation
Before you can use 2FA for Jupyter-JSC a random, user-specific, unique and **secret initialization code** must be known by both Jupyter-JSC and the your *OTP-App*.
This *secret initialization code* gets generated by Jupyter-JSC and is shown as a **QR-Code** (or string) on the activation page.
The QR-Code provides the *secret initialization code* with the descriptive data (1) algorithm = TOTP, (2) period of validity = 30s.
Please ensure you set these descriptive dates manually in your 2fa-generator app **if you prefer to use the string** instead of the QR-Code.
**If you prefer to use the string** instead of the QR-Code, please ensure you set these descriptive dates manually in your *OTP-App*.
Next, the 2fa-generates app provides now a **verification code** you have to enter on the activation webpage.
Jupyter-JSC now compares the *verification code* you provide with the one generated by Jupyter-JSC.
Next, the *OTP-App* provides now a **verification code** you have to enter on the activation webpage.
Jupyter-JSC compares the *verification code* you provide with the one generated by Jupyter-JSC.
