You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This project allows you to record behavioral keystroke data and use it as a second factor of authentication by leveraging the Typekey API. For more information you can check:
* A SCAN subscription. Please visit [Agama Lab](https://gluu.org/agama-lab) and sign up for a free SCAN subscription, which gives you 500 credits. Each successful Typekey API call costs 4 credits.
18
15
19
-
### Software Statement Assertion
20
16
21
-
In order to call the Typekey API, you will need an OAuth client. Once you have a SCAN subscription on Agama Lab, navigate to `Market` > `SCAN` and create an SSA with the software claim `typekey`. The Typekey flow will register its own client via DCR with the SSA you provide in the configuration.
[Releases](https://github.com/GluuFederation/agama-typekey/releases) to download
65
+
the `.gama` package.
66
+
67
+
### Add The Project To The Server
68
+
69
+
The Janssen Server provides multiple ways an Agama project can be
70
+
deployed and configured. Either use the command-line tool, REST API, or a
71
+
TUI (text-based UI). Refer to
72
+
[Agama project configuration page](https://docs.jans.io/head/admin/config-guide/auth-server-config/agama-project-configuration/) in the Janssen Server documentation for more details.
73
+
74
+
### Configure The Project
75
+
76
+
The Agama project accepts configuration parameters in the JSON format. Every Agama
77
+
project comes with a basic sample configuration file for reference.
78
+
79
+
Below is a typical configuration of the Agama-typekey project. As shown, it contains
80
+
configuration parameters for the [flows contained in it](#flows-in-the-project):
50
81
51
-
## Sample JSON
52
82
```json
53
83
{
54
84
"org.gluu.agama.typekey": {
@@ -65,64 +95,108 @@ In order to call the Typekey API, you will need an OAuth client. Once you have a
65
95
}
66
96
}
67
97
```
98
+
Check the flow detail section for details about configuration parameters.
68
99
69
-
### Configuration details
70
100
71
-
-`keystoreName` and `keystorePassword` are optional, in case you want to include a signature when sending the Typekey data. Leave them as blank otherwise.
72
-
-`orgId` is the organization ID that can be obtained by decoding the software statement JWT and looking at the `org_id` claim (You may use `https://jwt.io` to decode the SSA).
73
-
-`scan_ssa` is the JWT string you obtain from Agama Lab
74
-
-`authHost` and `scanHost` can be left as is
75
-
-`phrases` is a dictionary of strings from which the phrase used for behavioral metrics is selected. The dictionary pairs must be in format `string:string` where keys are unique numbers in string format and values are unique phrases.
101
+
### Test The Flow
76
102
77
-
## Details
103
+
Use any relying party implementation (like [jans-tarp](https://github.com/JanssenProject/jans/tree/main/demos/jans-tarp))
104
+
to send an authentication request that triggers the flow.
78
105
79
-
The first time a user starts the Typekey flow, Typekey will choose a random phrase from the `phrases` dict in the configuration and store it in persistence. Then, the Typekey API is called to provide the keystroke data recorded during the flow. The first 5 times, Typekey API will train on the data provided. This phase is called "Enrollment". On the 6th attempt onward, Typekey API will validate the provided keystroke data using the training data stored during enrollment. If the behavioral data is sufficiently different from the trained data, Typekey API will deny the request.
106
+
From the incoming authentication request, the Janssen Server reads the `ACR`
107
+
parameter value to identify which authentication method should be used.
108
+
To invoke the `org.gluu.agama.typekey` flow contained in the Agama-typekey project,
109
+
specify the ACR value as `agama_<qualified-name-of-the-top-level-flow>`,
110
+
i.e `agama_org.gluu.agama.typekey`.
80
111
81
-
In case Typekey API denies the request, Agama Typekey falls back to password authentication, and retrains the API on the provided data.
82
112
83
-
## Demo
113
+
## Customize and Make It Your Own
84
114
85
-
Enrollment:
115
+
Fork this repo to start customizing the Agama-PW project. It is possible to
116
+
customize the user interface provided by the flow to suit your organization's
117
+
branding
118
+
guidelines. Or customize the overall flow behavior. Follow the best
0 commit comments