Skip to content
GluuGluu
Browse Gluu Server 4.4

Release

FIDO U2F

#Overview

FIDO Universal 2nd Factor (U2F) is an open authentication standard that strengthens and simplifies two-factor authentication using specialized USB or NFC devices.

This document explains how to use the Gluu Server's included U2F interception script to implement a two-step, two-factor authentication (2FA) process with username / password as the first step, and any U2F device as the second step.

#Prerequisites

#U2F Devices

Some well known U2F devices and manufacturers include:

Purchase U2F devices on Amazon. Or, check FIDO's certified products for a comprehensive list of U2F devices (sort by Specification == U2F).

#Properties

The script has the following properties

PropertyDescriptionExample
u2f_application_idUnique Identifer, normally url of IDPhttps://idp.mycompany.com
u2f_server_uriURL of the oxAuth U2F serverhttps://idp.mycompany.com

#Enable U2F

Follow the steps below to enable U2F authentication:

  1. Navigate to Configuration > Person Authentication Scripts.

  2. Find the U2F script u2f-script

  3. Enable the script by checking the box enable

  4. Scroll to the bottom of the page and click Update

Now U2F is an available authentication mechanism for your Gluu Server. This means that, using OpenID Connect acr_values, applications can now request U2F authentication for users.

#Make U2F the Default

If U2F should be the default authentication mechanism, follow these instructions:

  1. Navigate to Configuration > Manage Authentication.

  2. Select the Default Authentication Method tab.

  3. In the Default Authentication Method window you will see two options: Default acr and oxTrust acr.

u2f

  • oxTrust acr sets the authentication mechanism for accessing the oxTrust dashboard GUI (only managers should have acccess to oxTrust).

  • Default acr sets the default authentication mechanism for accessing all applications that leverage your Gluu Server for authentication (unless otherwise specified).

If U2F should be the default authentication mechanism for all access, change both fields to U2F.

#U2F Login Page

Below is an illustration of the Gluu Server's default U2F login page:

u2f

The design is being rendered from the U2F xhtml page. To customize the look and feel of this page, follow the customization guide.

#Using U2F Tokens

#Credential Enrollment

U2F device enrollment happens during the first authentication attempt.

#Subsequent Authentications

All subsequent U2F authentications for that user account will require the enrolled U2F key.

#U2F Credential Management

A users FIDO U2F devices can be removed by a Gluu administrator either via the oxTrust UI in Users > Manage People, or in LDAP under the user entry as shown in the below screenshot.

fidoldap

#U2F Discovery Endpoint

A discovery document for U2F is published by the Gluu Server at: https://<hostname>/.well-known/fido-configuration This document specifies the URL of the registration and authentication endpoints. The endpoint was https://<hostname>/.well-known/fido-2fa-configuration in previous versions, but has been deprecated.

#U2F SCIM APIs

For a discussion of how to manage FIDO devices using the SCIM protocol, see the SCIM documentation.

#U2F Linux

From your terminal run below commands and reboot your computer.

  • sudo curl https://hypersecu.com/downloads/files/configurations/70-u2f.rules > /etc/udev/rules.d/70-u2f.rules
  • chmod +x /etc/udev/rules.d/70-u2f.rules