Review the OpenSRP 2 access token expiry period

[dubdabasoduba]

Request Description

• Most authentication tokens are configured to expire after 10 minutes. This means that the app automatically redirects the user to the login screen after the token expires.
• Our implementation of this feature poses a challenge to user experience because users have to keep logging in while offering services in the field.

Expected Outcome

• Find a secure way to restrict data access if the login credentials expire, but provide a reasonable delay before doing so.

Current Options

1. Increase the refresh token duration to a longer period. This option has already been activated for some projects.
   • This requires R&D and collaboration with the Security team to identify potential threats.
   • We need to write documentation explaining the balance between security and user experience to share with clients.
2. Update the PIN functionality to allow Keycloak to recognize the PIN as a valid login option, enabling the authentication token to refresh.
   • We need to conduct R&D to determine the feasibility of this option.

[pld]

I think (1) is sufficient, this is a common pattern among many apps

…

On Sun, Sep 17, 2023 at 6:17 PM Benjamin Mwalimu ***@***.***> wrote: Assigned #2766 <#2766> to @pld <https://github.com/pld>. — Reply to this email directly, view it on GitHub <#2766 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAMMES6HIHZKRSYSCMHKCLX25ZILANCNFSM6AAAAAA434O7PQ> . You are receiving this because you were assigned.Message ID: ***@***.***>

[ageryck]

We tested several options for the three token times in Keycloak and we determined that setting them depending on the project requirements can work with the impending security risk if they are longer than usual.

Access Token Lifespan - this can be set to a limited period of 1-3 minutes
Session Idle - this can be set to accommodate the required time for the device to be idle while logged in from the same single login
Session Max - This will be the maximum period a single session can last, users will get automatically logged out if they ever get to this time within a single session

All the above are applicable if the device remains online, while offline the device defaults to PIN every other time, and only returns to login in the condition that the above timelines are met and the device is online

[joyce-x-chen]

Thanks Ben for creating this issue and Peter and Ager for the additional inputs. I also agree with taking a balanced approach and think we should work with implementing partners to train/build capacity of users to remember their own usernames and passwords. Catering for a situation where a user never has to remember their username and password is on the extreme end, and most digital health applications require users to remember a password. While there are risks with this due to literacy and competency levels of some CHWs, and inconveniences for our implementing partners, we can't overcompensate and shift too much of the risk to Ona.

cc: @AnnieMungai @Gental-Giant

[ndegwamartin]

Seems like PIN authentication is not provided out of the box by Keycloak. It however does provide a way to extend its functionality by implementing our own Service Provider Interface to create a Keycloak Extension.

The implication of this is of course that we will have to maintain custom Keycloak code. Anyone deploying Keycloak (and requires this type of PIN authentication) will need to include our custom code (in form of a Jar). We may have to always ensure the extension works across different Keycloak versions and/or document which versions of Keycloak we support incase of migrations/upgrades. On the brighter side, we wont be maintaining a fully fledged fork of Keycloak.

Resources
https://www.keycloak.org/docs/latest/server_development/index.html#_auth_spi

[pld]

Cool, this seems like a reasonable roadmap backlog issue, I'm not sure what other apps do here, is it common or are there widely used examples of PIN being used for remote auth vs only local unlock? I've always assumed it was just local unlock but I've never looked into it