Introduction to Secure Password Resets
As a Solutions Architect, the best part of my job is finding ways to make our products do what our customers want them to do...even when they don't exactly do that. So, when One Identity acquired OneLogin last October, we entered an exciting interim period — a time during which our products would not have native, built-in, fully supported integration, but one in which we would soon be selling integration and customers would be asking to see integration.
So began a mad dash to configure, script, and pull together all the integrations we could feasibly manage – Single Sign-On into everything (Active Roles, Safeguard, Identity Manager) via native federation support (SAML2, WS-FED), lifecycle management of OneLogin accounts from Identity Manager via the API, device-level MFA using One Identity Defender (major kudos to Eric Hibar Jr. for that one). And, the topic of this blog post, OneLogin as a Multifactor Authentication step during a Self-Service Secure Password Reset (or really ANY workflow) in One Identity Password Manager.
One Identity Password Manager
For those unfamiliar with Password Manager (PWM), it's a secure enterprise Self-Service Password Reset (SSPR) tool. What's particularly relevant here is that PWM is highly configurable and customizable, with a drag-and-drop interface for building end-user workflows, and custom activities built with PowerShell (my favorite!) and an in-depth SDK.
In short, you can customize the entire process an end-user goes through to do anything in PWM. In particular, we'll focus on a secure Password Reset.
OneLogin by One Identity
For those unfamiliar with OneLogin, it is a Market-Leading Access Management platform, providing SSO, MFA, Unified Directory, User Lifecycle Management, and so much more.
For this integration, we will focus on Multi-Factor Authentication (MFA) to include as part of a PWM workflow.
Sidebar: Standards-Based Authentication (RADIUS)There's a reason I'm calling this "API-Based" MFA, and not just MFA” or "OneLogin Integration" — RADIUS. PWM natively supports the RADIUS protocol to provide multifactor authentication in any workflow. And, of course, OneLogin includes a RADIUS server that PWM can authenticate against. Since Day 1 (okay...maybe day 7) of our OneLogin acquisition, we've been able to demonstrate and support this scenario. But there are limitations.
Now, One Identity used to have an in-house MFA Solution, Starling 2FA, that had native support in PWM for auth via an Android and iOS app, as well as SMS, Email, and Voice. RADIUS by definition cannot support all of these features...but OneLogin can, with its REST API. |
My Over-Zealous Plan
Before I even read the documentation of the OneLogin API, one of my talented colleagues in EMEA shared a set of scripts to do...well...exactly this. Use OneLogin for MFA in PWM. But also create users, register new Security Factors...really a whole dev kit of useful sample scripts (some more useful and relevant than others) that immediately grabbed my attention.
Now, my initial reaction was not to pop this into my lab and call it a day, or just to refactor it to fit the Unofficial PowerShell Style Guide (which, let's be honest...I rarely follow completely). It was "hey, pretty much all of our products support PowerShell for extensibility, it would be REALLY cool if there was a PowerShell Module SDK that wrapped the OneLogin API!
There was not
So, I thought "I can write that," and started working on what would be my first major PowerShell Module.
Perhaps I focused too much on trying to do it proper, and official or whatever, but after dumping tons of time and effort into the development with nothing to publicly share, I realized my scope was a bit large to start, at least for an "as I get the time during work hours" side project.
After getting the framework of an SDK, and wrapping enough endpoints to process MFA requests, I shifted focus to making this work seamlessly with Password Manager.
Introducing...
Password Manager: API-Based MFA with OneLogin
I am excited to release this project, which allows you to utilize the OneLogin REST API to provide flexible, secure Multifactor Authentication capabilities to Password Manager Workflows, without the limitations of the RADIUS protocol.
Take advantage of PWM's extensibility, and OneLogin's powerful REST API to support a wide range of Security Factors, so your users can authenticate the way they prefer:
- OneLogin Protect
- Voice
- SMS
- Email OTP and Magic Link
- TOTP-based Authenticators (e.g. Microsoft, Google)
The included OneLoginByOneIdentity PowerShell Module takes care of all the necessary steps to interact with the API, so the PWM Actions can focus on the logic. This "early stages" SDK can also be used to streamline other OneLogin automations.
By utilizing features of the PWM SDK, the UI is generated by the code; no UI elements need to be created manually.
Sample exports of the actions, and an example authentication workflow, are included in the repository for ease of deployment.
Keep up with progress on my personal Github, or grab the latest stable release on the One Identity Github.
Refer to the README for instructions.
One Identity GitHub Note:
One Identity open source projects are supported through One Identity GitHub issues and the One Identity Community. This includes all scripts, plugins, SDKs, modules, code snippets or other solutions. For assistance with any One Identity GitHub project, please raise a new Issue on the One Identity GitHub project page. You may also visit the One Identity Community to ask questions. Requests for assistance made through official One Identity Support will be referred back to GitHub and the One Identity Community forums where those requests can benefit all users.
Get More info about OneLogin Client SDKs
Read the original article at OneLogin.com
