This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP JOTP Project"

From OWASP
Jump to: navigation, search
m
(→‎Description)
 
(10 intermediate revisions by the same user not shown)
Line 8: Line 8:
 
==OWASP jOTP==
 
==OWASP jOTP==
  
−
OWASP jOTP is a lightweight web application, implemented in Java as a small set of RESTful services, that can be used to generate, validate, and automatically expire one-time use password tokens.  This tool could be useful in scenarios that require multi-factor authentication, but do not allow for more expensive / complex solutions that require physical tokens (magnetic id cards, RSA hard tokens, etc).  Tokens generated may be sent either via email or SMS text message to end users.
+
OWASP jOTP is a microservice implemented in Java that can be used to generate, validate, and automatically expire one-time use password tokens.
  
 
==Description==
 
==Description==
  
 
A common use case for jOTP is as follows:
 
A common use case for jOTP is as follows:
−
1. Client web application displays login page to user.
+
1. Client applications displays a login page requesting the user enter his/her username and password.
−
2. User enters username, password, and cell phone number.
+
2. If the credentials check passes, the user's email is looked up and a message containing the token is sent.
−
3. Client application makes a call to jOTP, which subsequently generates a token and sends it to the user's cell phone.
+
3. The application then requests that the OTP token that was sent be entered in a text box. Once entered, it is sent to jOTP.
−
4. The user receives the token, and enters it on the login page.
+
4. jOTP validates the token. If the token was valid, the application finishes authenticating the user. If the token was not valid, the user is redirected to the login page.
−
5. The client application contacts jOTP to validate the token. If the token was valid, along with the username/password (validated separately), the user is logged in.
 
  
 
==Licensing==
 
==Licensing==
  
−
OWASP jOTP is available under the BSD 2-clause license.
+
OWASP jOTP is available under the [http://opensource.org/licenses/BSD-2-Clause BSD 2-Clause License].
  
  
 
| valign="top"  style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |
 
| valign="top"  style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |
  
−
== What is JOTP? ==
+
== What is jOTP? ==
  
−
OWASP JOTP provides:
+
OWASP jOTP provides:
  
 
* OTP token generation, validation, and expiration.
 
* OTP token generation, validation, and expiration.
Line 34: Line 33:
 
== Project Leader ==
 
== Project Leader ==
  
−
Robert Upcraft
+
Rob Upcraft
  
  
Line 42: Line 41:
 
== Quick Download ==
 
== Quick Download ==
  
 +
* [https://bintray.com/upcrob/generic/jOTP/_latestVersion Bintray Download]
 
* [https://github.com/upcrob/jOTP GitHub Repository]
 
* [https://github.com/upcrob/jOTP GitHub Repository]
  
 
== Email List ==
 
== Email List ==
  
−
[https://lists.owasp.org/mailman/listinfo/owasp_jotp_project OWASP jOTP Mailing List]
+
[https://lists.owasp.org/mailman/listinfo/owasp_jotp_project OWASP jOTP Mailing List] NOTE: Include "jOTP" in the subject heading of all emails to this list.
  
 
== News and Events ==
 
== News and Events ==
Line 72: Line 72:
 
; Where can OWASP jOTP be downloaded?
 
; Where can OWASP jOTP be downloaded?
 
: The source code, along with basic documentation, is located here: [https://github.com/upcrob/jOTP GitHub Repository]
 
: The source code, along with basic documentation, is located here: [https://github.com/upcrob/jOTP GitHub Repository]
 +
 +
; I can see the /sys/monitor endpoint, but when I try to test the other endpoints (eg. /otp/validate), I don't get anything in the response.
 +
: The endpoints under /otp only respond to POST requests, and will return an empty response if they are requested via GET.
  
 
= Acknowledgements =
 
= Acknowledgements =

Latest revision as of 22:36, 13 March 2016

OWASP Project Header.jpg

OWASP jOTP

OWASP jOTP is a microservice implemented in Java that can be used to generate, validate, and automatically expire one-time use password tokens.

Description

A common use case for jOTP is as follows: 1. Client applications displays a login page requesting the user enter his/her username and password. 2. If the credentials check passes, the user's email is looked up and a message containing the token is sent. 3. The application then requests that the OTP token that was sent be entered in a text box. Once entered, it is sent to jOTP. 4. jOTP validates the token. If the token was valid, the application finishes authenticating the user. If the token was not valid, the user is redirected to the login page.

Licensing

OWASP jOTP is available under the BSD 2-Clause License.


What is jOTP?

OWASP jOTP provides:

  • OTP token generation, validation, and expiration.

Project Leader

Rob Upcraft


Quick Download

Email List

OWASP jOTP Mailing List NOTE: Include "jOTP" in the subject heading of all emails to this list.

News and Events

Classifications

New projects.png Owasp-builders-small.png
Owasp-defenders-small.png
Cc-button-y-sa-small.png
Project Type Files CODE.jpg
Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_JOTP_Project&oldid=211057"