Validating Time-Based One-Time Passwords

There are various techniques to enforce multi-factor authentication in web applications. One approach is to use Time-Based One-Time Passwords (TOTPs) as an additional authentication factor. I did a write-up on how to implement Google Authenticator to enforce this style of multi-factor authentication in PeopleSoft. In that article, I use a custom Java class on the app server to implement the TOTP validation algorithm. The problem with this approach is that it causes an undesirable app server dependency. I recently came across an article that demonstrates a JavaScript implementation of the TOTP algorithm. Since we have the ability to run JavaScript on the app server using Java’s built-in JavaScript interpreter, then we can make use of this JavaScript implementation of the TOTP algorithm to validate user submitted TOTPs. I would like to share a handy project that demonstrates this dependency-less TOTP validation technique.

This project demonstrates TOTP validation in the context of a two-factor authentication (2FA) enrollment process. This 2FA enrollment utility can be used in a self service manner to allow users to setup and enable 2FA enforcement on their accounts. If you are interesting in using this project, then perform the following installation steps.

Download and Import Project into App Designer
Build Project (Create Table)
Assign PSM_2FA Permission List to User Role

Login as a privileged user and navigate to Main Menu > PSM Projects > 2FA Enrollment. You will be presented with the following page:

On this page, the user can configure a mobile authenticator application by scanning a QR code. Once configured, the mobile device will generate TOTPs for the user. The user can input a generated TOTP into the input box to verify that their application is generating proper TOTPs. When the user submits the TOTP, the server validates the submitted TOTP with a JavaScript-based algorithm.

Since JavaScript is doing all of the leg work there is not really much to see PeopleCode-wise, but below is the PeopleCode that handles the TOTP validation. The real magic happens in the PSM_SHA and PSM_TOTP HTML Objects.

Function IScript_ValidateTotp()
   
   /* Respond with error if the totp parameter is blank */
   Local string &sTotpInput = %Request.GetParameter("totp");
   If None(&sTotpInput) Then
      %Response.Write("{""status"": ""error"", ""message"": ""No Token Provided""}");
      Return;
   End-If;
   
   /* Get the user's secret ket from the DB */
   Local string &sEncryptedKey, &sKey;
   SQLExec("SELECT PSM_ENCRYPTED_KEY FROM PS_PSM_TOTP_USER WHERE PSM_USERID = :1", %UserId, &sEncryptedKey);
   
   /* Respond with error if the user does not have a secret key in the DB */
   If None(&sEncryptedKey) Then
      %Response.Write("{""status"": ""error"", ""message"": ""No Key Exists""}");
      Return;
   End-If;
   
   /* Decrypt the user's secret key */
   &sKey = Decrypt("", &sEncryptedKey);
   
   /* Use the Java ScriptEngineManager to run the JavaScript program to validate the totp value */
   Local JavaObject &manager = CreateJavaObject("javax.script.ScriptEngineManager");
   Local JavaObject &engine = &manager.getEngineByName("JavaScript");
   Local string &program = GetHTMLText(HTML.PSM_SHA) | GetHTMLText(HTML.PSM_TOTP);
   
   /* Provide the JS program with the required parameters */
   &engine.put("userKey", &sKey);
   &engine.put("userOtp", &sTotpInput);
   &engine.put("w", 5); /* Window: 30s * 5 = 2.5min */
   &engine.eval(&program);
   
   /* Respond with error if the totp value is invalid */
   Local string &result = &engine.get("result").toString();
   If &result <> "true" Then
      %Response.Write("{""status"": ""error"", ""message"": ""Invalid Token Provided""}");
      Return;
   End-If;
   
   /* Generate the url to redirect the user to */
   Local string &sUrl = GenerateScriptContentURL(%Portal, %Node, Record.WEBLIB_PTBR, Field.ISCRIPT1, "FieldFormula", "IScript_StartPage");
   
   /* Respond with success message */
   %Response.Write("{""status"": ""success"", ""message"": ""Token is Valid"", ""redirectUrl"": """ | &sUrl | """}");
   
End-Function;

By using Java’s built-in JavaScript interpreter, we are able to run JavaScript on the app server to validate TOTPs rather than relying on a custom Java class to do this. This technique reduces server side dependencies and results in a more easily manged solution. I look forward to discovering and sharing the integration of more JavaScript-based tools into PeopleSoft using this technique.

Colton Fischer