I need to build a mobile app where i need to first register a user by phone number followed by setting up a 4 digit PIN. Next time when user logs in user can directly input the set 4 digit PIN and logs in on the app.
How can i implement it with spring security?
My thought is, when user registers with his/her phone no + PIN then do i need to keep this combination in Spring token store or an IDP like keycloack so that when user opens the app again then i can do a check in db if the device is registered in the db (with IMEA no) with mpin set up then show the PIN screen to input? In this case, will PIN be a part of IDP then which field in IDP should hold PIN? like password or something..?
can you pls give me some direction around this.
Flutter package : local_auth: ^1.1.11
The authenticate() method uses biometric authentication, but also allows users to use pin, pattern, or passcode.
Related
I need to implement a standard user registration/activation workflow with Firebase. There doesn't seem to be an obvious way to implement this. When I say "standard", I mean how most email/password accounts work - not necessarily specific to Firebase. I'm sure you're familiar with this. This is the workflow:
User enters their username/password on a form with some validation and submits details
The back-end creates the user record in the database, but the account remains deactivated (i.e. user cannot authenticate - the activated flag is set to false)
The back-end sends an email to the user with a link to activate the account
The user clicks the link in their email which triggers activation. This is probably a Web API of some description.
At this point, the user record's activated flag ticks over to true, and the user can now authenticate
The link probably also has a deep link that opens the app or navigates to a web page
The user can now log into the app
How do I configure Firebase to do all this?
Currently, the app allows the user to register. I am using the Flutterfire SDK. I call createUserWithEmailAndPassword, which successfully creates the user in Firebase. But, the user is already activated. The user should have a state of "disabled" in firebase until the account becomes activated. I can't find any settings to default the user to disabled when the account is first created.
I also managed to get Firebase to send out an activation email by calling sendSignInLinkToEmail, but this call is really designed for email authentication - not email activation. Opening the link should activate the account, but I have not figured out how to do this. This documentation makes it sound like it is possible. Perhaps, the Flutterfire SDK is missing this? I don't want to allow people to log in without a password. I only want to use this call to send out an email.
What am I missing here? Is this non-standard behavior for Firebase? If so, why? If the user is allowed to use an app with an email address that is not activated, they can impersonate someone else. We need to confirm at least that they are custodians of the email address that they are claiming to have.
Do other Firebase people just not worry about this?
Lastly, I know I can achieve this by creating a collection for users in Firebase and putting an "activated" flag there. But, if I do that, I've got to write a cloud function that accepts the link and then updates the user in the collection based on the received link. But I thought this would be automatic in Firebase. If Firebase doesn't have this built-in, I have to put all the security over the top to stop users from authenticating when they have not yet activated their account.
This is a pretty valid concern. I suppose the way around this is to check whether the signed-in user is verified whenever the app is launched. The User object that is returned from Firebase Auth has an emailVerified flag. Check this page for more details.
Using this flag you can choose to show a different screen or pop-up that has a button to send a verification link to the registered email address. Until the user verifies this address, you can limit access to some of the app's screens if you want.
Please note that I have not checked if this emailVerified flag is true for sign ups using Federated login providers like Google Sign-in and Apple Sign In. You might want to check that out.
I need to build a mobile app where i need to first register a user by phone number followed by setting up a 4 digit PIN. Next time when user logs in user can directly input the set 4 digit PIN and logs in on the app. How can i implement it with spring security? My thought is, when user registers with his/her phone no + PIN then do i need to keep this combination in Spring token store or an IDP like keycloack so that when user opens the app again then i can do a check in db if the device is registered in the db (with IMEA no) with mpin set up then show the PIN screen to input? In this case, will PIN be a part of IDP then which field in IDP should hold PIN? like password or something..? can you pls give me some direction around this.
I'm making a Flutter application where the user has to register and log in with email and password.
Is there a way to ask the registered user to enter his password every time he wants to log in ?
The output would be like this :
Welcome back UserName#email.com
please type your password to enter the app
I've searched the subject in the FirebaseAuth documentation, but couldn't find any relative information.
You can explicitly sign any current user out when loading the page. See the bottom of the documentation page on email+password authentication for an example.
Realistically and practically speaking, you would use some type of local storage to signal to your app that the user is signed in, or out. If you use page load events only to signout the user, they will be signed out when opening a new tab which would probably be annoying.
You could use an unload event to prompt the user "You will be signed out of this application when you leave this page"
Doing all of that, the onload event could look for that auth state variable in local storage.
Starting from Keycloak 8.0.1 users can register multiple OTP devices:
screen of user setup page on Keycloak admin ui
Is there any way to restrict a number of OTP credentials (devices) for a user?
The behavior I want to achieve is to allow only one OTP device to be active for a user so users don't need to select a device from a dropdown on the login page (the behavior prior to the previous Keycloak versions).
There is a related problem, when you do a OTP reset, a new OTP device is added. So no real reset I would say.
Being able to limit to only one OTP device in the list would in fact make it possible to reset the OTP as the new OTP would push previous OTP device out from the list.
It doesn't make sense. You may somehow restrict user to have just one OTP device instance in the Keycloak. But you can't restrict user to have that single OTP instance on just single device. User can scan the same initial OTP QR code to many devices and then all these devices provide the same OTP code. (I use it as well, because single OTP device seems to be risky for me).
This kind of "OTP device replication" is not a problem especially for TOTP. HOTP may have a problem with that.
Currently I am developing an authentication module for my application. The user provides his phone number and a SMS with some pin code is send to him.
The user enters the code and if it is valid his phone number is authenticated. Maybe you know WhatsApp, it does quite the same when you run the app first time.
However if the user puts a new sim card in his phone he should authenticate it again.
I want to know how to determine if phone number has changed. I read in some other question that it is not possible to determine the phone number itself. But e.g. WhatsApp recognizes that there is another phone number.
Any ideas?
Update 2
One (not the best) way it's detecting carrier changing. Here you can see how to get carrier's name. Save it at first launch and do compare on next launches.
Update 3
I'd recommend to you look at Core Telephony Network reference and especially at CTTelephonyNetworkInfo reference
subscriberCellularProviderDidUpdateNotifier allow you respond on events such like:
... when the user’s cellular provider information changes. This occurs, for example, if a user
swaps the device’s SIM card with one
from another provider, while your
application is running