Multifactor authentication without a user footprint
Embodiments implement multifactor authentication without a user footprint. An application programming interface call from a client application can be received that includes a messaging identifier. A transaction identifier can be transmitted to the client application and stored. Using a shared secret, a temporary password can be generated, where the shared secret can be associated with the transaction identifier and can be stored. The temporary password can be transmitted to the messaging identifier. A second application programming interface call can be received that includes a reference transaction identifier and input, where a user provides the input to the client application. The user can be authenticated when the reference transaction identifier matches a transaction identifier stored and the input matches an expected password that is based on a stored shared secret associated with the matching stored transaction identifier. A success indicator can be transmitted to the client application based on the authentication.
1. A method for implementing multifactor authentication (MFA) service, the method comprising:
receiving, at an authentication server from a first client application, a first application programming interface call that comprises a client access token and a messaging identifier, wherein the authentication server does not persistently store personal user data and the authentication server does not persistently store the messaging identifier;
transmitting, by the authentication server to the first client application in response to the first application programming interface call, a transaction identifier, wherein the authentication server stores the transaction identifier in a transactional MFA data structure;
generating, using a shared secret and the transaction identifier, a temporary password, wherein the authentication server stores the shared secret with the transaction identifier in the transactional MFA data structure, the transactional MFA data structure storing a plurality of transaction identifiers and shared secrets;
transmitting, to the messaging identifier, a message that comprises the temporary password;
receiving, at the authentication server from a second client application, a second application programming interface call that comprises a reference transaction identifier and input, wherein a user provides the input to the second client application;
authenticating, at the authentication server, the user when the reference transaction identifier matches one of the transaction identifiers stored in the transactional MFA data structure and the input matches an expected password, wherein the expected password is generated using the matching stored transaction identifier and the shared secret stored with the matching stored transaction identifier in the transactional MFA data structure; and
transmitting a success indicator to the second client application based on the authentication.
2. The method of claim 1 , wherein the messaging identifier comprises an email address or a mobile phone number.
3. The method of claim 1 , wherein the transaction identifier comprises an embedded timestamp associated with the first application programming interface call, and the generated temporary password is based on the shared secret, the transaction identifier, and the embedded timestamp.
4. The method of claim 3 , wherein the reference transaction identifier and the matching stored transaction identifier comprise matching embedded timestamps.
5. The method of claim 2 , wherein the first application programming interface call and the second application programming interface call comprise secure REST API calls.
6. The method of claim 2 , wherein the client access token is issued by an identity cloud management system and is used to secure communication between the authentication server and the first client application.
7. The method of claim 6 , wherein the first client application is issued the client access token based on registration with the identity cloud management system.
8. The method of claim 2 , wherein the multifactor authentication service performs the authentication of the user without persistently storing the user's personal data at the authentication server, wherein the user's personal data comprises the user's name and address.
9. The method of claim 2 , wherein the user is permitted to access a secure resource based on the success indicator.
10. A system for implementing multifactor authentication (MFA), the system comprising:
an authentication server comprising a processor and memory storing instructions for execution by the processor, the instructions configuring the processor to:
receive, at the authentication server from a first client application, a first application programming interface call that comprises a client access token and a messaging identifier, wherein the authentication server does not persistently store personal user data and the authentication server does not persistently store the messaging identifier;
transmit, by the authentication server to the first client application in response to the first application programming interface call, a transaction identifier, wherein the authentication server stores the transaction identifier in a transactional MFA data structure;
generate, using a shared secret and the transaction identifier, a temporary password, wherein the authentication server stores the shared secret with the transaction identifier in the transactional MFA data structure, the transactional MFA data structure storing a plurality of transaction identifiers and shared secrets;
transmit, to the messaging identifier, a message that comprises the temporary password;
receive, at the authentication server from a second client application, a second application programming interface call that comprises a reference transaction identifier and input, wherein a user provides the input to the second client application;
authenticate, at the authentication server, the user when the reference transaction identifier matches one of the transaction identifiers stored in the transactional MFA data structure and the input matches an expected password, wherein the expected password is generated using the matching stored transaction identifier and the shared secret stored in association with the matching stored transaction identifier in the transactional MFA data structure; and
transmit a success indicator to the second client application based on the authentication.
11. The system of claim 10 , wherein the messaging identifier comprises an email address or a mobile phone number.
12. The system of claim 10 , wherein the transaction identifier comprises an embedded timestamp associated with the first application programming interface call, and the generated temporary password is based on the shared secret, the transaction identifier, and the embedded timestamp.
13. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to implement multifactor authentication (MFA), wherein, when executed, the instructions cause the processor to:
receive, at an authentication server from a first client application, a first application programming interface call that comprises a client access token and a messaging identifier, wherein the authentication server does not persistently store personal user data and the authentication server does not persistently store the messaging identifier;
transmit, by the authentication server to the first client application in response to the first application programming interface call, a transaction identifier, wherein the authentication server stores the transaction identifier in a transactional MFA data structure;
generate, using a shared secret and the transaction identifier, a temporary password, wherein the authentication server stores the shared secret with the transaction identifier in the transactional MFA data structure, the transactional MFA data structure storing a plurality of transaction identifiers and shared secrets;
transmit, to the messaging identifier, a message that comprises the temporary password;
receive, at the authentication server from a second client application, a second application programming interface call that comprises a reference transaction identifier and input, wherein a user provides the input to the second client application;
authenticate, at the authentication server, the user when the reference transaction identifier matches one of the transaction identifiers stored in the transactional MFA data structure and the input matches an expected password, wherein the expected password is generated using the matching stored transaction identifier and the shared secret stored with the matching stored transaction identifier in the transactional MFA data structure; and
transmit a success indicator to the second client application based on the authentication.
14. The method of claim 1 , wherein the first client application is the second client application, and the first application programming interface call is received earlier in time than the second application programming interface call.
15. The system of claim 10 , wherein the first client application is the second client application, and the first application programming interface call is received earlier in time than the second application programming interface call.
16. The computer readable medium of claim 13 , wherein the first client application is the second client application, and the first application programming interface call is received earlier in time than the second application programming interface call.
17. The method of claim 1 , wherein the authentication server is part of the MFA service, and the MFA service does not include an identity store that persistently stores personal user data.
18. The computer readable medium of claim 13 , wherein the messaging identifier comprises an email address or a mobile phone number.
19. The computer readable medium of claim 13 , wherein the transaction identifier comprises an embedded timestamp associated with the first application programming interface call, and the generated temporary password is based on the shared secret, the transaction identifier, and the embedded timestamp.
20. The computer readable medium of claim 19 , wherein the reference transaction identifier and the matching stored transaction identifier comprise matching embedded timestamps.