Computing systems and methods for protecting application programming interfaces with two-factor authentication
In order to extend an OAuth 2.0 framework in a way that an application programming interface (API) is to be protected with two-factor authentication, an API provider may be presented with a set of options for different types of second authentication factors that can be used to carry out the two-factor authentication for the API, and then after the API provider selects its desired type of second authentication factor, an OAuth resource endpoint or an OAuth token endpoint may function to perform a second-factor authentication of each client application attempting to access the API based on a second authentication factor of the type selected by the API provider. Other comparable technology for protecting APIs may be extended to allow for two-factor authentication in a similar manner.
1 . A computing platform comprising:
at least one network interface;
at least one processor;
at least one non-transitory computer-readable medium; and
program instructions stored on the at least one non-transitory computer-readable medium that are executable by the at least one processor such that the computing platform is configured to:
cause a first end-user device associated with an application programming interface (API) provider to display a first interface for registering an API that exposes resources of the API provider and is to be protected using two-factor authentication, wherein the first interface presents a set of options for two or more types of authentication factors that are available for use as a second authentication factor of the two-factor authentication for the API, and wherein the set of options for the two or more types of authentication factors includes two or more of (i) a first type of authentication factor comprising a JSON (JavaScript Object Notation) Web Token (JWT) that is to be signed by a shared secret, (ii) a second type of authentication factor comprising a JWT that is to be signed by a private key from a public-private key pair, and (iii) a third type of authentication factor that comprises a hash of a shared secret;
receive, from the first end-user device associated with the API provider, registration information for the API that includes an indication of the API provider's selection of a given type of authentication factor that is to be used as the second authentication factor of the two-factor authentication for the API, wherein the given type of authentication factor comprises one of the first type of authentication factor, the second type of authentication factor, or the third type of authentication factor;
cause a second end-user device associated with an API consumer to display a second interface for registering a client application that is to access resources exposed by the API;
receive, from the second end-user device associated with the API consumer, registration information for the client application;
register first-factor credential information for the client application that is to be utilized to perform a first-factor authentication of the client application when the client application requests access to the API, wherein registering the first-factor credential information involves (i) obtaining the first-factor credential information for the client application, (ii) presenting the first-factor credential information for the client application via the second interface, and (iii) storing the first-factor credential information for the client application; and
register vaultless second-factor credential information for the client application that is to be utilized to perform a second-factor authentication of the client application when the client application requests access to the API, wherein the vaultless second-factor credential information is of a type that corresponds to the API provider's selection of the given type of authentication factor that is to be used as the second authentication factor of the two-factor authentication for the API, and wherein registering the vaultless second-factor credential information involves:
if the given type of authentication factor comprises the first type of authentication factor, (i) obtaining a first shared secret for the client application that is to be utilized by the client application to generate a JWT that is signed by the first shared secret, (ii) presenting the first shared secret for the client application via the second interface, and (iii) after presenting the first shared secret for the client application, discarding the first shared secret rather than storing the first shared secret for future use during two-factor authentication of the client application;
if the given type of authentication factor comprises the second type of authentication factor, obtaining and storing a public key for the client application without obtaining or storing a corresponding private key for the client application that is to be utilized by the client application to generate a JWT that is signed by the private key; or
if the given type of authentication factor comprises the third type of authentication factor, (i) obtaining a second shared secret for the client application that is to be utilized by the client application to generate a hash of the second shared secret for the client application, (ii) presenting the second shared secret for the client application via the second interface, and (iii) after presenting the second shared secret for the client application, discarding the second shared secret rather than storing the second shared secret for future use during two-factor authentication of the client application.
2 . The computing platform of claim 1 , further comprising program instructions stored on the at least one non-transitory computer-readable medium that are executable by the at least one processor such that the computing platform is configured to:
after receiving the registration information for the API, store a data record for the API that includes at least a portion of the received registration information for the API.
3 . The computing platform of claim 1 , further comprising program instructions stored on the at least one non-transitory computer-readable medium that are executable by the at least one processor such that the computing platform is configured to:
after receiving the registration information for the client application, store a data record for the client application that includes at least a portion of the received registration information for the client application.
4 . The computing platform of claim 3 , wherein the stored data record for the client application further includes the first-factor credential information for the client application but does not include the vaultless second-factor credential information for the client application.
5 . The computing platform of claim 1 , wherein the first-factor credential information comprises a client identifier and a client secret.
6 . The computing platform of claim 1 , wherein obtaining the first shared secret for the client application comprises:
providing a second-factor credentials manager with a request to generate the first shared secret for the client application; and
thereafter receiving the first shared secret for the client application that is generated by the second-factor credentials manager.
7 . The computing platform of claim 1 , wherein obtaining the first shared secret for the client application comprises:
requesting that a second-factor credentials manager generate the first shared secret for the client application; and
thereafter receiving the first shared secret for the client application that is generated by the second-factor credentials manager, wherein the second-factor credentials manager also discards the first shared secret rather than storing the first shared secret for future use during two-factor authentication of the client application.
8 . The computing platform of claim 1 , wherein obtaining the public key for the client application comprises:
receiving the public key for the client application from the second end-user device associated with the API consumer.
9 . The computing platform of claim 1 , wherein obtaining the second shared secret for the client application comprises:
requesting that a second-factor credentials manager generate the second shared secret for the client application; and
thereafter receiving the second shared secret for the client application that is generated by the second-factor credentials manager, wherein the second-factor credentials manager also discards the second shared secret rather than storing the second shared secret for future use during two-factor authentication of the client application.
10 . The computing platform of claim 1 , wherein the computing platform comprises an API portal.
11 . The computing platform of claim 10 , wherein the computing platform further comprises one or more credentials managers.
12 . The computing platform of claim 1 , wherein the client application is thereafter configured to automatically utilize the first-factor credential information and the vaultless second-factor credential information when requesting access to the API.
13 . At least one non-transitory computer-readable medium, wherein the at least one non-transitory computer-readable medium is provisioned with program instructions that, when executed by at least one processor, cause a computing platform to:
cause a first end-user device associated with an application programming interface (API) provider to display a first interface for registering an API that exposes resources of the API provider and is to be protected using two-factor authentication, wherein the first interface presents a set of options for two or more types of authentication factors that are available for use as a second authentication factor of the two-factor authentication for the API, and wherein the set of options for the two or more types of authentication factors includes two or more of (i) a first type of authentication factor comprising a JSON (JavaScript Object Notation) Web Token (JWT) that is to be signed by a shared secret, (ii) a second type of authentication factor comprising a JWT that is to be signed by a private key from a public-private key pair, and (iii) a third type of authentication factor that comprises a hash of a shared secret;
receive, from the first end-user device associated with the API provider, registration information for the API that includes an indication of the API provider's selection of a given type of authentication factor that is to be used as the second authentication factor of the two-factor authentication for the API, wherein the given type of authentication factor comprises one of the first type of authentication factor, the second type of authentication factor, or the third type of authentication factor;
cause a second end-user device associated with an API consumer to display a second interface for registering a client application that is to access resources exposed by the API;
receive, from the second end-user device associated with the API consumer, registration information for the client application;
register first-factor credential information for the client application that is to be utilized to perform a first-factor authentication of the client application when the client application requests access to the API, wherein registering the first-factor credential information involves (i) obtaining the first-factor credential information for the client application and (ii) presenting the first-factor credential information for the client application via the second interface, and (iii) storing the first-factor credential information for the client application for future use during two-factor authentication of the client application; and
register vaultless second-factor credential information for the client application that is to be utilized to perform a second-factor authentication of the client application when the client application requests access to the API, wherein the vaultless second-factor credential information is of a type that corresponds to the API provider's selection of the given type of authentication factor that is to be used as the second authentication factor of the two-factor authentication for the API, and wherein registering the vaultless second-factor credential information involves:
if the given type of authentication factor comprises the first type of authentication factor, (i) obtaining a first shared secret for the client application that is to be utilized by the client application to generate a JWT that is signed by the first shared secret, (ii) presenting the first shared secret for the client application via the second interface, and (iii) after presenting the first shared secret for the client application, discarding the first shared secret rather than storing the first shared secret for future use during two-factor authentication of the client application;
if the given type of authentication factor comprises the second type of authentication factor, obtaining and storing a public key for the client application without obtaining or storing a corresponding private key for the client application that is to be utilized by the client application to generate a JWT that is signed by the private key; or
if the given type of authentication factor comprises the third type of authentication factor, (i) obtaining a second shared secret for the client application that is to be utilized by the client application to generate a hash of the second shared secret for the client application, (ii) presenting the second shared secret for the client application via the second interface, and (iii) after presenting the second shared secret for the client application, discarding the second shared secret rather than storing the second shared secret for future use during two-factor authentication of the client application.
14 . The at least one non-transitory computer-readable medium of claim 13 , wherein the at least one non-transitory computer-readable medium is also provisioned with program instructions that, when executed by at least one processor, cause the computing platform to:
after receiving the registration information for the API, store a data record for the API that includes at least a portion of the received registration information for the API.
15 . The at least one non-transitory computer-readable medium of claim 13 , wherein the at least one non-transitory computer-readable medium is also provisioned with program instructions that, when executed by at least one processor, cause the computing platform to:
after receiving the registration information for the client application, store a data record for the client application that includes at least a portion of the received registration information for the client application.
16 . The at least one non-transitory computer-readable medium of claim 13 , wherein obtaining the first shared secret for the client application comprises:
requesting that a second-factor credentials manager generate the first shared secret for the client application; and
thereafter receiving the first shared secret for the client application that is generated by the second-factor credentials manager, wherein the second-factor credentials manager also discards the first shared secret rather than storing the first shared secret for future use during two-factor authentication of the client application.
17 . The at least one non-transitory computer-readable medium of claim 13 , wherein obtaining the second shared secret for the client application comprises:
requesting that a second-factor credentials manager generate the second shared secret for the client application; and
thereafter receiving the second shared secret for the client application that is generated by the second-factor credentials manager, wherein the second-factor credentials manager also discards the second shared secret rather than storing the second shared secret for future use during two-factor authentication of the client application.