\n",
"\n",
"## Introduction\n",
"2-Factor Authentication (2FA), sometimes referred to as two-factor verification, is a security method in which you provide **two different authentication factors** to identify yourself at login.\n",
"This process is **performed to better protect** both your credentials and the resources that you can access.\n",
"\n",
"In the **first login step**, you start with the usual entry of a good password. The service then confirms the correctness of the password entered.\n",
"This does not, however, lead directly to the desired entrance - but to a further barrier.\n",
"\n",
"The **second login step** prevents unauthorized third parties from gaining access to your account just because they might have stolen your password.\n",
"A quite common 2nd-factor is a **One-Time Password (OTP)** generated by a so-called **OTP-App** you install and initialize once on one of your personal devices.\n",
"This *OTP-app* then provides (in our case every 30 seconds) a new *one-time password* that needs to be entered on the login page.\n",
" \n",
""
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"
\n",
"
\n",
"\n",
"## Basic Principle\n",
"These two factors for authentication combine the building blocks **knowledge** and **possession** in the login procedure. \n",
"- **knowledge** - the secret knowledge is the password you enter. \n",
"- **possession** - With the *one-time password* you show that you are in possession of a certain device (e.g. your smartphone), because only the *OTP-App*, installed on that device, can generate it. \n",
"\n",
"\n",
"
\n",
"
Source: Bundesamt für Sicherheit in der Informationstechnik
\n",
"\n",
"## Algorithm\n",
"The **OTP-App** can calculate personal one-time passwords completely autonomously from the outside world using a standardized and open algorithm for the generation of **Time-based One-Time Passwords (TOTP)**. \n",
"\n",
"The *TOTP algorithm* was published in 2011 by the [Internet Engineering Task Force (IETF)](https://www.ietf.com) as [RFC 6238](https://tools.ietf.org/html/rfc6238). The *TOTP algorithm* is a hash function in which a secret code is hashed together with the current time.\n",
"Behind the hash function is the HMAC-based One-time Password Algorithm according to [RFC 4226](https://tools.ietf.org/html/rfc4226) - in simple terms nothing more than a standard that forms a hash in a certain way.\n",
"\n",
"The calculation includes both a **\"secret initialization code\"**, that is known to both the server and the client, and the **current time**.\n",
"The final *one-time password* is generated from these two inputs and is valid for a certain period of time. (in our case for **30 seconds**).\n",
"The procedure can be implemented in such a way that slight differences in time between client and server are accepted.\n",
"\n",
"Hence, any *one-time password* is time-based, calculated locally, and always unique.\n",
"\n",
"\n",
"\n",
"------------------"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"# How to get started with 2FA\n",
"
\n",
" \n",
" \n",
"
\n",
"\n",
"## Preparation\n",
"\n",
"To get ready to use 2-Factor Authentication (2FA) for Jupyter-JSC you have to **prepare** it ONCE: \n",
"- (1) **request 2FA** for Jupyter-JSC, \n",
" - (a) login to [Jupyter-JSC](https://jupyter-jsc.fz-juelich.de) \n",
" - (b) visit https://jupyter-jsc.fz-juelich.de/2fa and request 2FA \n",
" - (c) wait for a *confirmation emails* and click the provided *activation link* \n",
"- (2) **activate 2FA** for Juypter-JSC,\n",
" - (a) install an **OTP-App**, which supports the TOTP algorithm \n",
" - (b) communicate the **secret initialization code** to this *OTP-App* \n",
" - (c) test a first **one-time password** generated. \n",
"\n",
"... and then 2FA is ready to be used next time you log in.\n",
"\n",
"### 1. Request 2FA\n",
"Please login to Jupyter-JSC as usual through https://jupyter-jsc.fz-juelich.de \n",
"and visit the webpage **https://jupyter-jsc.fz-juelich.de/2fa** for requesting 2FA.\n",
"\n",
"Please read the notes on this webpage carefully and click the button **Request 2FA** to start. \n",
"A **confirmation email** including an **activation link** will be send to you directly.\n",
"\n",
"### 2. Activate 2FA\n",
"Please follow this *activation link* to instruct Jupyter-JSC for preparation of your 2FA. \n",
"You will be asked to re-login to your account to recieve a **secret initialization code** as QR-Code (and string) \n",
"for a required *OTP-App*. \n",
"\n",
"So first, you need to install an **OTP-App** on one of your personal devices (if you haven´t done so already), \n",
"which you plan to use in the future to generate the required **one-time passwords** for each time you log in:\n",
"\n",
"\n"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"
\n",
" \n",
" \n",
"
\n",
"
\n",
" \n",
" \n",
"
\n",
"\n",
"### a. OTP-App Installation\n",
"There are a large number of different *OTP-Apps* available that implemented the *TOTP algorithm*. \n",
"You have to install **one of them** - for example, take one of the following: \n",
"\n",
"Recommended, free & open-source:\n",
" - [**FreeOTP**](https://freeotp.github.io) ([iOS](https://apps.apple.com/de/app/freeotp-authenticator/id872559395), [Android](https://play.google.com/store/apps/details?id=org.fedorahosted.freeotp&hl=de)) \n",
" - [**KeeWeb**](https://keeweb.info) ([Windows](https://keeweb.info), [macOS](https://keeweb.info), [Linux](https://keeweb.info), [online](https://keeweb.info))\n",
"\n",
"Free, but closed source:\n",
" - [**Authy**](https://authy.com/download/) ([iOS](https://apps.apple.com/de/app/authy/id494168017), [Android](https://play.google.com/store/apps/details?id=com.authy.authy), [Windows](https://authy.com/download/), [macOS](https://authy.com/download/), [Linux](https://snapcraft.io/authy)) \n",
" - [**Protectimus Smart OTP**](https://www.protectimus.com/protectimus-smart) ([iOS](https://apps.apple.com/ie/app/protectimus-smart/id854508919), [Android](https://play.google.com/store/apps/details?id=com.protectimus.android)) \n",
" - [**Google Authenticator**](https://de.wikipedia.org/wiki/Google_Authenticator) ([iOS](https://apps.apple.com/de/app/google-authenticator/id388497605), [Android](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2) ) \n",
" - [**Microsoft Authenticator**](https://www.microsoft.com/en-us/account/authenticator) ([iOS](https://apps.apple.com/de/app/microsoft-authenticator/id983156458), [Android](https://play.google.com/store/apps/details?id=com.azure.authenticator), [Windows 10 Mobile](https://www.microsoft.com/en-us/p/microsoft-authenticator/9nblgggzmcj6)) \n",
"\n",
"The *TOTP algorithm* can also be implemented in hardware as a so-called \"hardware token\" (e.g. [Protectimus Tokens](https://www.protectimus.com/tokens/), [Microcosm Tokens](https://www.microcosm.com/products/oath-otp-authentication-tokens)) \n",
" \n",
""
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"
\n",
" \n",
" \n",
"
\n",
"\n",
"### b. OTP-App Initialization & Validation\n",
"Before you can use 2FA for Jupyter-JSC a random, user-specific, unique and **secret initialization code** must be known by both Jupyter-JSC and the your *OTP-App*.\n",
"This *secret initialization code* gets generated by Jupyter-JSC and is shown as a **QR-Code** (or string) on the activation page.\n",
"\n",
"The QR-Code provides the *secret initialization code* with the descriptive data (1) algorithm = TOTP, (2) period of validity = 30s.\n",
"**If you prefer to use the string** instead of the QR-Code, please ensure you set these descriptive dates manually in your *OTP-App*.\n",
"\n",
"Next, the *OTP-App* provides now a **verification code** you have to enter on the activation webpage.\n",
"Jupyter-JSC compares the *verification code* you provide with the one generated by Jupyter-JSC.\n",
"\n",
"If they match, **2FA is now activated**.\n",
"\n",
"\n",
"\n",
"----------------------"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"
\n",
" \n",
" \n",
"
\n",
"\n",
"### 2FA-Login at Jupyter-JSC\n",
"Congratulation! You are now ready to use 2-Factor Authentication with Jupyter-JSC.\n",
"\n",
"Login is now as simple as this\n",
"1. **Enter your JSC-account password** \n",
" Each time you log in, you enter your JSC-account password as usual. \n",
"2. **Enter the current one-time password** \n",
" You will then be asked for a *one-time password* that you can read from your installed & initialized *OTP-App* (e.g. on your smartphone). \n",
" \n",
"**Remember me** \n",
"Jupyter-JSC can set a cookie to remember, that you have logged in from this device already. \n",
"Just check the \"Remember me\" **checkbox** where you enter *one-time password* . \n",
"Jupyter-JSC **skips the request** of a *one-time password* in this browser on that device then for **one week**. \n",
" \n",
" "
]
}
],
"metadata": {
"kernelspec": {
"display_name": "Python 3 (ipykernel)",
"language": "python",
"name": "python3"
},
"language_info": {
"codemirror_mode": {
"name": "ipython",
"version": 3
},
"file_extension": ".py",
"mimetype": "text/x-python",
"name": "python",
"nbconvert_exporter": "python",
"pygments_lexer": "ipython3",
"version": "3.8.5"
}
},
"nbformat": 4,
"nbformat_minor": 4
}
![](https://jupyter-jsc.fz-juelich.de/hub/static/default/images/2fa/jupyter-jsc_2fa_img01.png "\\"2-factor-authentication\\"")
\n",
" \n",
"![](https://jupyter-jsc.fz-juelich.de/hub/static/default/images/2fa/jupyter-jsc_2fa_img02.png "\\"2-factor-authentication\\"")
\n",
" \n",
"![](https://jupyter-jsc.fz-juelich.de/hub/static/default/images/2fa/jupyter-jsc_2fa_img03.png "\\"2-factor-authentication\\"")
\n",
" \n",
"![](https://jupyter-jsc.fz-juelich.de/hub/static/default/images/2fa/jupyter-jsc_2fa_img04.png "\\"2-factor-authentication\\"")
\n",
" \n",
"![](https://raw.githubusercontent.com/FZJ-JSC/jupyter-jsc-notebooks/master/001-Jupyter/images/jupyter-jsc_2fa_img04-1.png "\\"2-factor-authentication\\"")
\n",
"![](https://jupyter-jsc.fz-juelich.de/hub/static/default/images/2fa/jupyter-jsc_2fa_img05.png "\\"2-factor-authentication\\"")
\n",
" \n",
"![](https://jupyter-jsc.fz-juelich.de/hub/static/default/images/2fa/jupyter-jsc_2fa_img06.png "\\"2-factor-authentication\\"")
\n",
" \n",
"