Swekey Authentication Module Instructions ============ 1) Obtain a Swekey from http://store.swekey.com/index.php?sel=buy 2) Build the authnswekey project, either in NetBeans or from command line ant. authnswekey.jar should be created in authnswekey/dist/ 3) Copy SwekeyLoginModule.xml and swekeyLogin.jsp from authnswekey to /config/auth/default 4) Copy swekey.js and swekey_integrate.js from the Swekey PHP Integration Kit (available at http://www.swekey.com/?sel=support&option=downloads under the 'Developer Tools' category) to /js 5) Copy authnswekey/dist/authnswekey.jar to /WEB-INF/lib 6) Add com.sun.identity.authentication.modules.swekey.SwekeyLoginModule to the list of pluggable authentication module classes on the Configuration/ Authentication/Core page. Don't forget to hit 'Save'! 7) Restart OpenSSO 8) We assume that the Swekey ID (you can determine the ID for a Swekey at http://managment.swekey.com/index.php?sel=manage) has been provisioned into an attribute in the user's profile. At present, the Swekey ID attribute name is hardcoded as "employeeNumber". Thus, to test the authentication module, you should set a user's employeeNumber to the Swekey ID - you can do this in the OpenSSO console: Access Control/select a realm/ Subjects/select a user/Employee Number. 9) Verify with http://openssohost:openssoport/opensso/UI/Login?module=SwekeyLoginModule - enter the username and hit return, or click 'Log In'. If no Swekey is present then an error message is shown directing the user to insert one and try again. If all is well then the user is authenticated and you will see their OpenSSO profile page. Notes ===== In this implementation, the user provides their username and the Swekey. This is to reduce the possibility of compromise by an attacker finding a lost key. Other implementations might simply ask for the Swekey output alone, perhaps assuming that a first level authentication has already been done. Future Directions ================= Set Swekey random token service URL, Swekey check service URL and Swekey ID attribute name via the console, rather than in the code. Allow the admin to select whether or not users will be prompted for their username as well as the Swekey output.