java - 在 Java Web 应用程序中实现双因素身份验证

Question

我有一个通过 IBM WebSphere 运行的现有 Java Web 应用程序(我不确定版本，但可以了解它是否有帮助)，我希望用它来实现双因素身份验证。

该系统拥有不错的用户群，我想向系统的管理员用户分发硬件 token 以确保强身份验证。

希望对最终用户的影响最小，但我想避免让管理员需要通过 VPN 连接。

有没有人知道任何提供 Java API 的产品可以直接集成到现有应用程序或其他影响最小的产品中？我已经与 RSA SecurID 谈过，但他们的系统不会直接集成，需要更改基础架构。非常感谢任何其他想法/经验。

Answer 1

为了后代，我刚刚发布了我的简单 Java two factor authentication utility class to Github .有了它，您可以执行以下操作:

TwoFactorAuthUtil twoFactorAuthUtil = new TwoFactorAuthUtil();

// To generate a secret use:
// String base32Secret = generateBase32Secret();
String base32Secret = "NY4A5CPJZ46LXZCP";
// now we can store this in the database associated with the account

// this is the name of the key which can be displayed by the authenticator program
String keyId = "user@j256.com";
System.out.println("Image url = " + twoFactorAuthUtil.qrImageUrl(keyId, base32Secret));
// we can display this image to the user to let them load it into their auth program

// we can use the code here and compare it against user input
String code = twoFactorAuthUtil.generateCurrentNumber(base32Secret);

// this little loop is here to show how the number changes over time
while (true) {
    long diff = TwoFactorAuthUtil.TIME_STEP_SECONDS
        - ((System.currentTimeMillis() / 1000) % TwoFactorAuthUtil.TIME_STEP_SECONDS);
    code = twoFactorAuthUtil.generateCurrentNumber(base32Secret);
    System.out.println("Secret code = " + code + ", change in " + diff + " seconds");
    Thread.sleep(1000);
}