Authorizer. OAuth2-провайдер для emcSSL
На сайте криптор есть множество статей, посвященных технологии беспарольной авторизации emcSSL. К сожалению эта технология до сих пор не нашла массового применения. На то есть множество причин, основная из которых — сложность настройки для владельца сайта.
Совместными усилиями нам удалось запустить открытый некоммерческий проект — authorizer.io, основная задача которого — упростить подключение emcSSL для владельцев сайтов.
Authorizer — это провайдер OAuth2, который авторизует пользователя через ssl-сертификат и отправляет на ваш сайт с токеном авторизации. Т.е. работает по такому-же принципу как и «войти через facebook».
Проект практически готов. Сейчас идет активное тестирование, поэтому если есть интерес — милости просим. Поможем подключить и настроить.
Этапы подключения сайта
- Создание сертификата. Сертификат позволит авторизоваться на странице приложений Authorizer и добавить свой сайт.
- Создание приложения. Тут все просто. Указываете название сайта и RedirectURL (о нем чуть дальше )
- Настройка модуля на своем сайте. Есть готовые модули для WordPress, Drupal и October. В настройках модуля нужно просто указать Client Id и Secret. Эти данные можно взять на странице приложений. RedirectURL зависит от выбранной CMS и указан в инструкциях к модулям.
На сайте authorizer.io все довольно подробно расписано, но если возникнут вопросы или трудности — задавайте в комментариях к этому посту.
Чуть не забыл — посмотреть как это работает, можно нажав на кнопку SSL-логин.
Authorizer Save Abandoned
Authorizer is a Password Manager for Android. It emulates an HID keyboard over USB and enters your credentials on your target device. Additionally it supports OTP :key::mobile_phone_off:
- Overview
- Versions
- Reviews
- Resources
Authorizer
Transform Android devices into secure, offline password managers with USB/Bluetooth Auto-Type, OTP, and FIDO support.
Use your Android device as a dedicated hardware password manager. It avoids manual typing of lengthy and complicated passwords by offering USB and Bluetooth Auto-Type features. Acting as a keyboard, Authorizer enables users to automatically input passwords on their PC, laptop, tablet, or another smartphone with a simple in-app button press.
By having your Authorizer-device offline using airplane mode, you create a physical separation between your credentials and the devices commonly used for daily activities. Similar to Security Keys but with enhanced functionality and comfort. This concept helps reduce the likelihood of password breaches and unauthorized access, ensuring stored credentials remain secure from online threats and unrelated apps.
Even if you don’t fully trust the Authorizer app, you can maintain security as long as your Authorizer-device’s underlying OS provides network isolation and data encryption.
Table of Contents
- Features
- Getting started
- Device Recommendation
- Requirements
- Compatibility
Features
- Auto-Type over USB
- Auto-Type over Bluetooth
- Auto-type keyboard layouts for English, German, French, Apple and Neo 2
- Bluetooth FIDO U2F & WebAuthn integration
- OTP integration (TOTP/HOTP)
- Asymmetric encrypted offline backup
- Auto-type keyboard-«commands» like TAB or ENTER for Username and Password fields
- Predefined usernames with placeholders for fast record creation
- Tree list
- Icons
- pwsafe3 file compatible (*)
- Yubikey support (*)
- Biometric protection of your file password (*)
- Time-based file-close (*)
- Screen off can trigger file-close (*)
- Read-only file mode (*)
- Record protection (*)
- Local file backup (*)
- Password expirations (*)
- Password Policies (*)
- Password History (*)
- Notes (*)
- Groups (*)
- Shortcut & alias records (*)
- Home screen widgets (*)
- Powerful Search (*)
- Light & Dark mode (*)
* As Authorizer has its foundation in PasswdSafe for Android, it has also adopted these features.
Getting started
Device Recommendation
For security and privacy reasons, the recommended device is any maintained Google Pixel with GrapheneOS.
Other devices might work as well. But as a lot of smartphone vendors are not publishing its underyling kernel and Android source, they can’t be recommended.Requirements
Authorizer can run on every Android device with version 5 or higher (Lollipop: API/SDK level 21).
For Bluetooth features, minimum version 9 is required (Pie: API/SDK level 28). Higher is recommended for stability reasons.For Auto-Type over USB, low-level root permissions are required to run USB Gadget Tool.
Authorizer does not require root permissions when it is allowed to write to /dev/hidg1 natively (file permissions and selinux needs to be configured for this).Compatibility
Features Windows Linux MacOS iOS Android AutoType — USB X X X X X AutoType — Bluetooth X X X X X FIDO U2F X X X FIDO WebAuthn X X X Features in Detail
Auto-Type over USB and Bluetooth
Authorizer is able to pretend to be an HID Keyboard so it can auto-type the credentials over USB and Bluetooth.
There are Auto-Type buttons at the password entry view. If a button is pressed longer, a different keyboard layout can be choosen. Additional, there is a USB Quick Auto-Type button in the TreeView which auto-types the respective password on a long press.
There are different settings per password entry like delimiter and the password return suffix. In the general App preferences a default keyboard layout can be choosen.Auto-Type over USB requires support of the USB HID device role. This can be enabled with my USB Gadget Tool.
Auto-Type over Bluetooth is currently an experimental feature and only available on Android Pie (9.0) or higher.
Asymmetric encrypted backup on USB mass storage
The concept behind Authorizer is to have an offline device. As a consequence, it can’t create password file backups over the network. To create backups in a comfortable way, Authorizer will open a backup dialog if it detects a new connected mass-storage (e.g. an USB stick connected over an USB On-The-Go adapter). By pressing «Backup now» in this dialog, a backup folder can be selected. It must contain a GPG public key with the file name «pubkey.asc». The default password file will be encrypted with this GPG key and stored in the selected folder.
This feature can be enabled over the general App preference «Enable GPG backup on USB storage».OTP integration
Besides standard username & password entries, Authorizer also supports two-factor authentication (2FA) over one-time passwords (OTP). Time-based (TOTP) and HMAC-based (HOTP) one-time passwords are supported.
The OTP secret can be added to a password entry manually or by scanning a QR code. Afterwards, a press on the empty token field («——«) will generate a new OTP. It is also possible, to auto-type the OTP over USB or Bluetooth by addingas a placeholder directly in the username or password, e.g. in the password «myPa$sword » will be replaced with a newly generated OTP.
Like username, password and other data, the OTP secret is stored in the password file.Additional Auto-Type placeholders
In addition to the
placeholder, Authorizer also supports and for the tabulator and return key. Adding these to the username and/or password will result in auto-typing the respective key (tab or return) instead of the placeholder.
Example: if «peter» is set as the username, «peter» followed by the tabulator key and a newly generated OTP will be auto-typed. Roadmap
Limitations and Known Issues
- When Authorizer creates or modifies psafe3 files, it will add extra fields like auto-type settings, FIDO keys, and icons, which may not be displayed when using other software that supports psafe3.
- Running Authorizer app on tablets is currently not tested.
- The experience of Bluetooth-stack stability can differ between devices, as it is dependent on both the Android version and the specific device being used.
- Due to limitations in the Bluetooth-stack, Authorizer can only be paired as Keyboard OR as FIDO Security key and not both.
- It is important to unpair from the other device as well to prevent unexpected behavior, when establishing a new pairing under a separate profile (like Keyboard or FIDO).
- FIDO U2F & WebAuthn is currently not compatible with Apple MacOS and Apple iOS, as they expecting a different HID_REPORT_SIZE.
- Currently, FIDO credentials can’t be added to existing records.
Contributions & Community
Contributions are highly welcome.
For contributions, discussions and questions around Authorizer, feel free to- Create an issue
- Create a discussion discussion
Please note that I am not interested in further localization of Authorizer, except for auto-type keyboard layouts.
Special Thanks
Authorizer is based on
- PasswdSafe a Password Safe port for Android
- FreeOTP
- WioKey
- and many further
Privacy Policy
Authorizer does not collect any data from your mobile device.
- Camera access is used only for scanning OTP QR codes.
- Location access only used for Bluetooth device scanning and it is optional.
If you believe this policy has been violated in any way, please file an issue.
Introducing Authorizer 1.0
We’re excited to announce the stable version of https://authorizer.dev with the most significant updates ��. The most complex part of your application, i.e. auth has never been this simple in the open-source space before. Bring your database and have auth layer ready for the application within minutes ��.
You can get started in 3 easy steps
Let’s have a look at the amazing set of features ��
Secure Session Management
Authorizer follows the best practices in the auth space and gives you secure session management using
- HTTP only cookies (Recommended for web) (Recommended for mobile applications)
- OAuth2 with Open ID compatible APIs
Multiple Auth Recipes
Authorizer comes with an amazing set of auth recipes out of the box, which includes major social media logins, magic link login, and basic authentication. You can easily configure this recipe using the dashboard that is shipped with every instance of Authorizer.
Myriad Database Support
Authorizer now supports 11+ databases including major SQL, NoSQL, and GraphDB with the motive Your Data Your Control. Bring your database and it will just add a few tables/collections in your database to generate auth layer for you.
Role Base Access Control
Secure your APIs and UI depending on various roles for your application. You can easily configure the user roles in your dashboard and have them validated in the JWT tokens.
Integrate / Implement
Every instance of Authorizer comes with a universal login page which you can integrate in your application with a few lines of code. This page is rendered based on the configuration you have in the dashboard. Still, if you need to build the custom UI then we have React SDK and JS SDK which you can leverage.
Custom Emails
Now you can send emails for various Authorizer events with your own design and messaging. You can also give personal touch to this emails with the help of dynamic variables that will be replaced before sending emails
Multi-factor Authentication
Now you can add one more layer of security by enabling multi-factor authentication which will send one time passwords (OTP) via emails to users and after entering that password only user will be able to access your application. This feature is enabled for basic authentication at the moment.
Listen to events
Most advanced feature of Authorizer. You can now listen to various Authorizer events in your APIs with the help of webhooks and take further actions if required
With all this amazing set of features, you can deploy Authorizer instances on your infrastructure using Docker, Kubernetes, or Binaries. Also, you can use the one-click deployment options that we offer to get started quickly ��
I hope you like it and give it a try. You can support our work by contributing to the project, sending Github sponsorship, buying us coffee, or giving us a star on Github. For more information check out the links below.
Loved By Users
Join our community on Discord. You can also share your experience here and help us build more trust.
“ First time I found Authorizer at Product Hunt I fall in love with this. Then I realize this is a perfect fit solution for me. So, I want to say thank you for building an amazing product. Especially as you made it Open Source. ”
“ Authorizer simplifies the implementation of a login system and is fast and light on resources. The React.js library also vastly simplifies the implementation of state management in a project. The author, Lakhan Samani, is also extremely helpful and easy to work with. Overall, Authorizer saves numerous hours of headaches and provides a great experience for developers. ”
“ I have been working on an edutainment product for the past few months. The authentication, authorization flow was one of the tasks that I had to take care of. I used the Authorizer for the same and it did not take me much time, from integration with the product to setting it up on the cloud. It was a great experience as a developer to be able to use an open-source solution to a fairly complex problem with such ease. Thanks to the authorizer team. ”
“ Authorization/Authentication has been always big pain but I found Authorizer is the simplest and fastest way of building auth service for our app. I also was able to partially adopt our own customized authentication flow with Authorizer because they provide flexible enough libs and APIs. I would not be able to fine other product that can handle this easily. Truly, all in one solution ever. ”