Validating a User with Challenge Questions

3-8 Oracle Fusion Middleware Developers Guide for Oracle Adaptive Access Manager See the sample application at the end of this chapter for details on displaying the questions in the UI and processing the user input Here, we assume that the qs and as are in the question object Register the questions and answers with OAAM VCryptResponse response = proxy.addQuestions user.CustomerId, questions; Retrive the question to challenge the user VCryptQuestion secretQuestion = proxy.getSecretQuestion user.CustomerId; Create QuestionPad authenticator to display the question text. See the sample application at the end of this chapter for details; Here, we assume that the user entered an answer stored in the string answer Validate the user entered answer VCryptAuthResult res = proxy.authenticateQuestioncustomerId, answer; bool isValid = res = null res.ResultCode == 0; For further details, see the sample applications in Section 3.5.1, ASP.NET Applications.

3.4.5 Resetting Challenge Failure Counters

Oracle Adaptive Access Manager records the number of wrong answers to the questions posed to the user in the failure counters. Failure counters are used to enforce a lock. The API includes a method, resetChallengeFailureCounters, to reset the failure counters for a given user or user and question combination. If a Question ID is specified i.e. questionId = BharosaGlobals.LongNull, in the call, only the failure counters associated with that question are reset; if no Question ID is specified, the failure counters for all registered questions of the user are reset. The following sample code illustrates a call to reset failure counters: VCryptResponse resetChallengeFailureCountersString requestId, String customerId, long questionId;

3.4.6 Virtual Authentication Devices

This section describes the creation and use of virtual authentication devices in ASP.NET applications in the following subsections: ■ Creating a Virtual Authentication Device ■ Embedding a Virtual Authentication Device in a Web Page ■ Validating User Input with a Virtual Authentication Device

3.4.6.1 Creating a Virtual Authentication Device

To create a virtual authentication device, use the method, BharosaClient.getAuthentiPad, as illustrated in the following sample code: IBharosaClient client = BharosaClientFactory.getClientInstance; String padName = passwordPad; if IsPostBack { Integrating Native .NET Applications 3-9 AuthentiPadType padType = AuthentiPadType.TYPE_ALPHANUMERICPAD; String bgFile = proxy.getImageuser.CustomerId; String captionText = proxy.getCaptionuser.CustomerId; String frameFile = BharosaConfig.get bharosa.authentipad.alphanumeric.frame.file, alphanumpad_bgkp_v2_frame_nologo.png; AuthentiPad authPad = client.getAuthentiPadpadType, padName, frameFile, bgFile, captionText, false, true, true; save the authenticator object in sessData: it will be needed in GetImage.aspx.cs to generate the authenticator image, and while decoding the user input sessionData[padName] = authPad; }

3.4.6.2 Embedding a Virtual Authentication Device in a Web Page

To display a virtual authentication device properly, such as the one created in the previous section, both the .ASPX file and the code-behind file need to be updated. To update these files, proceed as follows: 1. Include the JavaScript bharosa_webjsbharosa_pad.js in the ASPX file. 2. Create a label in the ASPX file where the virtual authentication device is to be displayed: asp:Label ID=authenticator runat=serverasp:Label 3. Generate the HTML in the code-behind file from the virtual authentication device object and assign it to the label: this.authenticator.Text = client.getAuthentiPadHTMLauthPad,false, false;

3.4.6.3 Validating User Input with a Virtual Authentication Device

The input that a user supplies to a virtual authentication device is posted to the application in the HTTP parameter named padName + DataField. This input should be decoded using the virtual authentication device as illustrated in the following sample code: if IsPostBack { AuthentiPad authPad = sessionData[padName]; String encodedPasswd = Request.Params[padName + DataField]; String passwd = authPad.decodeInputencodedPasswd; continue to validate the password }

3.4.7 Specifying Credentials to the Oracle Adaptive Access Manager SOAP Server

The credentials to access the Oracle Adaptive Access Manager SOAP Server can be specified in one of the following ways: ■ By adding the following settings to application web.config file: appSettings add key=BharosaSOAPUser value=soapUser