Sandy: Achievo/Howto/User/Yubikey authentication moved to Achievo/Howto/Users/Yubikey authentication

2008-06-07T21:26:44Z

← Older revision	Revision as of 21:26, 7 June 2008
(No difference)

Sandy: New page: {{Achievo_Howto|Easy|Sandy Pleyte
2008-06-07T21:18:46Z

New page: {{Achievo_Howto|Easy|Sandy Pleyte <sandy@achievo.org}} This howto explains how you can turn on authenciation with [http://www.yubico.com/products/yubikey/ Yubikey]. '''Important:''' Only...

New page
{{Achievo_Howto|Easy|Sandy Pleyte <sandy@achievo.org}}

This howto explains how you can turn on authenciation with [http://www.yubico.com/products/yubikey/ Yubikey].

'''Important:''' Only the key itself is implemented now. For maximum security, you will need to add a password to the Yubikey to make it true multi-factor authentication.

== Database ==
For enabling yubikey support we need to extend the table 'person' with a field that can hold the yubikey. You can add the field with [http://www.phpmyadmin.net phpMyAdmin] or execute this query:

ALTER TABLE `person` ADD `yubikey` VARCHAR( 12 ) NULL ;

== Configuration ==
After changing the database you need to change some configuration settings in the config.inc.php file:

$config_authentication = "yubikey";

$config_auth_yubikey_id = <Yubico API ID>;
$config_auth_yubikey_key = '<Yubico API key>';
$config_auth_yubikeyfield = 'yubikey';

== Alter the employee class ==
In the employee class (modules/employee/class.employee.inc) search for the following lines:

if (in_array("db",explode(",",strtolower(atkconfig('authentication')))))
$this->addPasswordAttribute();

And before these lines you need to add:

// If authentication method yubikey is active:
if (in_array("yubikey",explode(",",strtolower(atkconfig('authentication')))))
$this->add(new atkAttribute(atkconfig("auth_yubikeyfield"), AF_HIDE_LIST, 12));

== Finalize ==
Now log in as a user that has the admin rights for employees and set a yubikey identity (the first 12 characters of any OTP from your device) for each Employee in the new "yubikey" field and you can authenticate using the [http://www.yubico.com/products/yubikey/ Yubikey].