B4J Question Google Authenticator

[aaronk]

Hi,

I am wanting to add 2 step authorization to my B4J, B4A & B4i apps.

Currently my app allows a user to login to my B4J app via a web browser, and also in my B4A & B4i App.

However it only needs a username and password to allow the user to login.

I was hoping to use Google Authenticator so the user needs to enter the 6 digit code as well to allow the user to login.

I have had a look on the forum but couldn't find anything.

Does anyone know if google authenticator can be used or if there is any library that I have missed ?

 

[alwaysbusy]

I have written a library for B4J for myself some time ago to use the Google Authenticator app. I'll try to find it back and post it here.

 

[alwaysbusy]

Found it!

Usage:
Download the B4J lib and dependencies here: http://gorgeousapps.com/ABGoogleAuthB4JLib.zip
Download the B4A lib and dependencies here: http://gorgeousapps.com/ABGoogleAuthB4ALib.zip
Put all files in your Additional Libraries folder.

Download the demo.

Fill in your app name and your gmail email address, generate a secret key and use the second part in your actual app to verify the 6 digit code. It also generates a URL with a QRCode you can send to your user to add your app to Google Authenticator.

Sub Process_Globals
   Private fx As JFX
   Private MainForm As Form
 
   Private Auth As ABGoogleAuth
   Private Button1 As Button
   Private Button2 As Button
   Private TextField1 As TextField
End Sub

Sub AppStart (Form1 As Form, Args() As String)
   Auth.Initialize("YOURAPPNAME", "YOURGMAILADDRESS")
 
   MainForm = Form1
   MainForm.RootPane.LoadLayout("Layout1") 'Load the layout file.
   MainForm.Show
End Sub

'Return true to allow the default exceptions handler to handle the uncaught exception.
Sub Application_Error (Error As Exception, StackTrace As String) As Boolean
   Return True
End Sub

' first run this once to get your secret key from google
' you also get a url link to a QR code you can give to your user to scan in the Google Authenticator
Sub Button1_Action
   Dim credentials As ABGACredentials
   credentials = Auth.CreateCredentials
   Log("QRCodeURL: " & credentials.QRCodeURL)
   Log("Secret key: " & credentials.Secret)
   Log("Scratch Codes: ")
   For i = 0 To credentials.ScratchCodes.Size - 1
       Log(credentials.ScratchCodes.Get(i))
   Next
End Sub

' in your real app, you can then use this secret key to check the users 6 digit code
Sub Button2_Action
   If Auth.Authorize("YOURSECRETKEY", TextField1.Text) Then
       fx.Msgbox(MainForm, "You are allowed to access this application!", "Demo")
   Else
       fx.Msgbox(MainForm, "You are NOT allowed! Get a valid 6 digit code from the Google Authenticate App.", "Demo")
   End If
End Sub

 

[aaronk]

Wow, thanks heaps. I will have a play with it and let you know how it goes.

 

[aaronk]

Can't seem to get it to work. I am testing it only using B4J (v6.00) (not using B4A/B4i for now)

I changed:
Auth.Initialize("YOURAPPNAME", "YOURGMAILADDRESS") with my app name and my gmail email address.

When I press Button1 it returns a URL, Secret Key & 5 Scratch codes. (the secret key and the scratch codes seem to change each time I press Button1).

When I open the URL in a browser on my computer it shows a QR code. Using the Google Authenticator app I scan this QR code and it then shows a 6 digit number.

Looks like that part worked.

When I enter that 6 digit code in the B4J app (into the TextField1 field), and I press Button2 it says it's not allowed.

Do I need to put the value of credentials.Secret in:

If Auth.Authorize("YOURSECRETKEY", TextField1.Text) Then ' replace YOURSECRETKEY with the value of credentials.Secret

If so, I tried that but it didn't seem to work.

Any ideas on what I might of done wrong ?

 

[alwaysbusy]

When I press Button1 it returns a URL, Secret Key & 5 Scratch codes. (the secret key and the scratch codes seem to change each time I press Button1).

You should run this only ONCE. Then stop the app. Add the key in button 2, run the app again, enter the 6 digit code and press button 2 (DO NOT PRESS button 1 again, else the key will change and not match the one you just changed in the code). The user should never have button1, this is just for you to create the secret key ONCE per application type.

Do I need to put the value of credentials.Secret in:

yes, see above

 

[alwaysbusy]

Added also the B4A version in the third post. Unfortunately, the B4i version I can't make so someone slse will have to do this.

 

[aaronk]

You should run this only ONCE. Then stop the app. Add the key in button 2, run the app again, enter the 6 digit code and press button 2 (DO NOT PRESS button 1 again, else the key will change and not match the one you just changed in the code). The user should never have button1, this is just for you to create the secret key ONCE per application type.

Thanks heaps, that worked.