Function Repository Resource:

AuthenticatorAppVerify

Source Notebook

Authenticate users using authenticator apps

Contributed by: Jon McLoone

ResourceFunction["AuthenticatorAppVerify"]["New",{issuer,user}]

generates a secret value for storage in an authenticator app.

ResourceFunction["AuthenticatorAppVerify"][code,secret]

tests an authenticator app generated code against the stored secret.

Details

Time-based one-time passwords are generated using authenticator apps such as Microsoft Authenticator or Google Authenticator that adhere to RFC 6238.

The code in ResourceFunction["AuthenticatorAppVerify"][code,secret] is generated by the authenticator app.

Examples

Basic Examples (4)

Create secret information to share with user "jonm" of our website "mywebsite":

In[1]:=

Out[1]=

You can display the barcode and/or the URI to help the user to enter the secret into an authenticator app. When the barcode is scanned by the authenticator app. it will generate and display temporary six digit authentication codes. Enter a code from the authenticator app here:

Verify these codes against the secret:

In[2]:=

Out[2]=

If the authentication code is incorrect or is more then 30 seconds old, the test returns False:

In[3]:=

Out[3]=

The secret should be stored against the user's account information in your application, and should never be displayed again after initial creation.

Applications (3)

A minimal interface that implements two-factor authentication:

In[4]:=

$CloudSymbol["DemoUserTable"] = {}; CloudDeploy[APIFunction[{}, Function[ With[ {storedSecret = FirstCase[ CloudSymbol["DemoUserTable"], {$RequesterWolframID, secret_} :> secret]}, If[ MissingQ[storedSecret], With[{secretValue = ResourceFunction["AuthenticatorAppVerify"][ "New", {"DemoApp", $RequesterWolframID}]}, CloudSymbol["DemoUserTable"] = Append[CloudSymbol["DemoUserTable"], {$RequesterWolframID, secretValue["Secret"]}]; Column[{Row[{"This is your first visit, to set up your Authenticator App, please follow this  ", Hyperlink[" link »", secretValue["URI"]]}], "Or scan the barcode below:", secretValue["Barcode"], "Next time you visit this page, you will be asked to authenticate", Hyperlink["Click here to reload page", "#"]}] ] , FormFunction[{"AuthenticatorCode" -> "String"}, Function[ If[ ResourceFunction["AuthenticatorAppVerify"][#AuthenticatorCode, storedSecret], Row[{"You are authenticated correctly as  ", $RequesterWolframID}], Row[{"You have failed to authenticate as  ", $RequesterWolframID}] ]]]] ] ], "HTML"], "DemoApp", Permissions -> {"Authenticated" -> {"Read", "Execute"}}]$