Hi everyone, Modern identity security standards (*NIST SP 800-63B, PCI-DSS 4.0*) increasingly require *Multi-Factor Authentication (MFA)* for enterprise and administrative applications.
- While Apache OFBiz provides solid primary credential handling, secondary factor verification has historically required custom integration or third-party gateways. Over the past few weeks, I have designed and implemented a native, *RFC 6238 Time-Based One-Time Password (TOTP)* architecture for Apache OFBiz. The goal is to provide a production-ready, zero-trust MFA capability that adheres strictly to core OFBiz idioms without breaking existing deployments. - *Detailed Proposal Document:* I have compiled a comprehensive architecture proposal covering entity models, session state boundaries, controller flows, and REST token specifications: *Document:* https://docs.google.com/document/d/1Ugqe8Z5vm2Ikkr55o2eDlYbjpvszVbuuEK8P-e-tzYw/edit?usp=sharing *Architectural Highlights:* • *Staged Authentication Lifecycle:* -- Introduces an isolated intermediate stage (*PRIMARY_VERIFIED ➔ MFA_PENDING ➔ AUTHENTICATION_COMMITTED*). -- This guarantees that user sessions, cookies, or successful login histories are never committed to the database until the second factor is successfully verified, preventing pre-MFA state poisoning. • *Air-Gapped RFC 6238 TOTP:* -- Compatible with standard authenticators (*Google Authenticator, Microsoft Authenticator,* etc.). -- QR codes are generated directly *in-memory *as SVG Data URIs—no external CDNs or third-party web APIs (like Google Charts) are ever contacted. • *Double Session Rotation:* -- HTTP session IDs are regenerated upon primary password entry, and regenerated again immediately upon TOTP verification to mitigate session fixation. • *Granular Policy & Interstitials:* -- Supports self-service enrollment under user profiles as well as group-level mandatory enforcement (requireAuthFactor="Y" on SecurityGroup) with forced enrollment interstitials. • *Two-Step REST API Handshake:* *-- *The /rest component supports an interactive two-step token exchange (HTTP 202 MFA_REQUIRED challenge returning opaque ID ➔ verification returning JWT with RFC 8176 amr: ["pwd", "totp"] and acr: "loa-mfa" claims). • *Complete UI Support (Backoffice + B2C Storefront):* *-- *Fully integrated into core backoffice themes, as well as the public customer storefront (plugins/ecommerce). • *100% Backward Compatibility:* -- The feature is globally disabled by default ( *security.login.authFactor.enable=false*). -- Existing service calls, automated integration test suites, and password-only workflows continue to operate without any breaking changes. *Implementation & Verification:* The code has been verified with comprehensive integration tests (UserLoginTests.groovy, LoginEventsTests.java, and JWTManagerAssuranceTests.java covering challenge lifecycles, replay rejection, forced enrollment, step-up password changes, and token claims). - The implementation is split cleanly across the framework and plugins repositories: • *Framework Pull Request:* https://github.com/apache/ofbiz-framework/pull/2620 • *Plugins Pull Request:* https://github.com/apache/ofbiz-plugins/pull/523 I would like to invite the community to review the proposal document, look through the PR's, and share your valuable thoughts and feedback. Kind Regards, Krishna Uprit Application Security Engineer *HotWax Systems* *Enterprise open source experts* cell: +91-7999304341 <+91%2079993%2004341> http://www.hotwaxsystems.com
