Automatic upgrade from one step authentication to two step authentication via application programming interface
A client transmits a user identifier and a password to a server via an application programming interface (API). The client establishes an authenticated session with the server in which the client has a first set of permissions for operations associated with the API. The client receives, responsive to a verification of the user identifier and password by the server, a logon response and a shared secret. The client generates a one time passcode (OTP) based upon the shared secret. The client sends the OTP to the server via the API. Responsive to the server validating the OTP against the shared secret, the server grants a second set of permissions for operations associated with the API.
1. A method comprising:
transmitting, by a client, a user identifier and a password to a server via an application programming interface (API);
establishing an authenticated session with the server, the client having a first set of permissions for operations associated with the API;
receiving, responsive to a verification of the user identifier and password by the server, a logon response a shared secret,
wherein the server determines whether the user identifier is to be upgraded from one step authentication to two step authentication after successful verification of the user identifier and the password and grants the client limited permission with respect to permitted API operations and requires the two step authentication for each subsequent logon attempt;
generating, by the client, a one time passcode (OTP) based upon the shared secret;
sending the OTP to the server via the API;
granting, responsive to the server validating the OTP against the shared secret, a second set of permissions for operations associated with the API; and
transmitting the user ID, the password, and a current OTP generated based upon the shared secret to the server in a subsequent logon operation.
2. The method of claim 1 , further comprising:
receiving, by the client device, the user identifier and password, from a user.
3. The method of claim 1 , wherein the receiving of the logon response and shared secret is responsive to a determination that a user associated with the user identifier is designated for upgrading from one factor authentication to two factor authentication.
4. The method of claim 1 , further comprising:
storing, by the client, the shared secret within client preferences associated with a user.
5. The method of claim 1 , wherein the server is configured to store the shared secret within a user profile associated with a user.
6. The method of claim 1 , wherein the API includes a Representational state transfer (REST) API.
7. The method of claim 1 , wherein the second set of permissions is greater than the first set of permissions.