Validate an Operation with Push

The sample to validate an operation via a push notification integrates the ActivID Appliance OAuth/OpenID Connect API and ActivID Appliance SCIM API to:

Authenticate to the ActivID Appliance using the spl-api user.
Generate an operation approval message.
Request that ActivID Appliance send a message to the HID Approve application on the registered device.
ActivID Appliance pushes the message to the HID Approve application through the Microsoft Windows Push Notification Service.

You can then approve or decline the validation request using the HID Approve application.
ActivID Appliance notifies the result of the validation (approve or decline the request) on the JMS topic.

Prerequisites:

Download and install the HID Approve application
Register a Device for Validation with Push

Configure the Sample

Create the truststore file in the config subfolder using the Java keytool located on your client machine in <JAVA_HOME>\bin.

For example, download the ActivID Appliance SSL certificate from the ActivID Console Key Stores menu and copy it to a local folder.

Then, run the following keytool command to import the certificate:

Copy

keytool -import -file <file path>/RootCA.cer -alias <serverName> -keystore <request-device-registration-sample_path>/config/truststore.jks -storepass <mypassword> -noprompt

Where <mypassword> is the password you set to protect the certificate.

Edit the <SAMPLES Path>\config\deliverChallenge.properties configuration file by updating the properties with information from your deployment.

Property	Description
server.url	The URL of your ActivID Appliance in the format https://<ActivID Appliance hostname>:443
server.domain	The name (ID) of the domain
direct.user.code	The ID of the OpenID client
direct.user.password	The OpenID client password (secret)

Edit the <SAMPLES Path>\scripts\ script for your operating system by updating the parameters with the path and password of the truststore:
- RequestOperationValidation.bat for Microsoft Windows
- RequestOperationValidation.sh for Linux

Run the Sample

Prerequisites: You have successfully registered a device for your sample user.

Retrieve the device ID value (did) of the registered device.

For example, from the output of the provisioning request for the device registration sample (or using the ActivID Management Console) this value is 14780:

Note: The provisioning message is available in the <SAMPLES Path>\scripts\request.txt file.

Open the HID Approve Application.
Open a terminal on the <SAMPLES Path>\scripts folder.

Run the following command to trigger the request to send a push notification to the device:

Copy

On Microsoft Windows systems

RequestOperationValidation.bat -u myuser -did <did value> -ci correlationID1234 -t testLogonMessage

Copy

On Linux systems

RequestOperationValidation.sh -u myuser -did <did value> -ci correlationID1234 -t testLogonMessage

Where:

Parameter	Description
<did value>	The device ID value for the registered device
correlationID1234	A sample value for the ID of this operation
testLogonMessage	A sample value for the message that will be displayed on the HID Approve application for approval

The script outputs the processing information and the specified device receives a notification.

Click Approve to validate the request.

The sample then outputs the Status of the Request, and specifies if it is APPROVED or DENIED.

REST API Request Samples for Operation Validation

Search the user myTestUser1 to get its userid (13274):

Copy

POST https://myServer:8445/scim/ONLINEBANK/v2/Users/.search
Headers:
	Authorization: Bearer RTp7HwAAAWAMlL+hho0qmFlEndOxkGDGKhMOCPjA
	Content-Type: application/scim+json
	Accept: application/scim+json
Body:
	{"schemas":["urn:ietf:params:scim:api:messages:2.0:SearchRequest"],"filter":"username eq myTestUser1"}
 
Response: HTTP/1.1 200 OK
Headers:
	Cache-Control: no-cache
	X-Powered-By: Undertow/1
	Server: JBoss-EAP/7
	Pragma: no-cache
	Date: Thu, 30 Nov 2017 10:59:23 GMT
	Connection: keep-alive
	Strict-Transport-Security: max-age=16070400; includeSubDomains
	X-Content-Type-Options: nosniff
	Transfer-Encoding: chunked
	Content-Type: application/scim+json;charset=utf-8
	{"schemas":["urn:ietf:params:scim:api:messages:2.0:ListResponse"],"totalResults":1,"resources":[{"schemas":["urn:ietf:params:scim:schemas:core:2.0:User","urn:hid:scim:api:idp:2.0:UserDevice","urn:hid:scim:api:idp:2.0:UserAttribute","urn:hid:scim:api:idp:2.0:UserAuthenticator"],"id":"13274","externalId":"myTestUser1","meta":{"resourceType":"User","created":"2017-11-29T23:00:00Z","location":"https://myServer:8445/scim/ONLINEBANK/v2/Users/13274","version":"1"},"userName":"myTestUser1","active":true,"groups":[{"type":"Group","display":"Consumer Online Banking","value":"USG_CUST1","$ref":"https://myServer:8445/scim/ONLINEBANK/v2/Groups/USG_CUST1"}],"roles":[],"urn:hid:scim:api:idp:2.0:UserAttribute":{"attributes":[]},"urn:hid:scim:api:idp:2.0:UserAuthenticator":{"authenticators":[{"display":"AT_TDS","value":"13274.AT_TDS","$ref":"https://myServer:8445/scim/ONLINEBANK/v2/Authenticator/13274.AT_TDS"},{"display":"AT_PASA","value":"13274.AT_PASA","$ref":"https://myServer:8445/scim/ONLINEBANK/v2/Authenticator/13274.AT_PASA"},{"display":"AT_SMK","value":"13274.AT_SMK","$ref":"https://myServer:8445/scim/ONLINEBANK/v2/Authenticator/13274.AT_SMK"},{"display":"AT_CUSTOTP","value":"13274.AT_CUSTOTP","$ref":"https://myServer:8445/scim/ONLINEBANK/v2/Authenticator/13274.AT_CUSTOTP"}]},"urn:hid:scim:api:idp:2.0:UserDevice":{"devices":[{"display":"SN_1019003681","value":"13275","$ref":"https://myServer:8445/scim/ONLINEBANK/v2/Device/13275"}]}}]}

Creation of the logon validation request (value myTransactionContent for user 13274 on authenticator of type AT_PASA for device 13275):

Copy

POST https://myServer:8445/scim/ONLINEBANK/v2/Authenticator/13274.AT_PASA
Headers:
	Authorization: Bearer RTp7HwAAAWAMlL+hho0qmFlEndOxkGDGKhMOCPjA
	Content-Type: application/scim+json
	Accept: application/scim+json
Body:
	{"schemas":["urn:hid:scim:api:idp:2.0:Authenticator","urn:hid:scim:api:idp:2.0:Action"],"id":"13274.AT_PASA","urn:hid:scim:api:idp:2.0:Action":{"schemas":["urn:hid:scim:api:idp:2.0:Action"],"attributes":[{"name":"tds","type":"string","value":"myTransactionContent","readOnly":false},{"name":"createSession","type":"string","value":"0","readOnly":false},{"name":"correlationid","type":"string","value":"123456789","readOnly":false},{"name":"DEVICE.ID","type":"string","value":"13275","readOnly":false}],"action":"DELIVER-CHALLENGE"}}
 
Response: HTTP/1.1 200 OK
Headers:
	Cache-Control: no-cache
	X-Powered-By: Undertow/1
	Server: JBoss-EAP/7
	Pragma: no-cache
	Date: Thu, 30 Nov 2017 10:59:24 GMT
	Connection: keep-alive
	Strict-Transport-Security: max-age=16070400; includeSubDomains
	X-Content-Type-Options: nosniff
	Transfer-Encoding: chunked
	Content-Type: application/scim+json;charset=utf-8
	{"schemas":["urn:hid:scim:api:idp:2.0:Action"],"attributes":[{"name":"CHALLENGE","type":"string","value":"eyJ6aXAiOiJERUYiLCJraWQiOiJLRVkxIiwiY3R5IjoidGV4dFwvcGxhaW4iLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiY29udGFpbmVyaWQiOiIyIiwidmVyc2lvbiI6InY2IiwiYWxnIjoiZGlyIiwiY2lkIjoxMzI4OX0..5uY-eQRZyzGMhWR5G-I9uQ.urP9G2mbHYyLnDIJaM7s2HLsh97SwHAwmsr9qKkkm6YVZOSS-X3s2yE_o2CzHg4hF3seXG0jTI7UD0kS7c6fovaY0azaYHrJyeWLg22ghWk.wGetw2zz-0jiA8VsIMzvi8rQ7zsbnCEYfGNH8loAe0g","readOnly":false},{"name":"CHALLENGE.ID","type":"string","value":"13289","readOnly":false},{"name":"REQUEST.STATUS","type":"string","value":"1","readOnly":false},{"name":"REQUEST.REASON","type":"string","value":"-1","readOnly":false},{"name":"REQUEST.ERROR_MESSAGE","type":"string","readOnly":false}]}