Sezame PHP SDK
, (*1)
Passwordless multi-factor authentication., (*2)
Unlike password-based solutions that require you to remember just another PIN or password, sezame is a secure and simple multi-factor authentication solution. You only need the username and your fingerprint on your smartphone to log into any sezame-enabled site. Magic – Sezame – ENTER SIMPLICITY!., (*3)
Installation
Use Composer to install the library., (*4)
``` bash
$ composer require finpin/sezame-sdk, (*5)
## Steps
To be able to use Sezame within your application you have to fullfill these steps:
1. download and install the Sezame app from an app store
2. follow the registration process in the app
3. register your application/client
4. obtain a SSL client certificate
5. let your users pair their devices with your application
6. issue authentication requests
If you don not have a supported device with fingerprint reader, you must obtain the ssl certificate by
using the support channels of Sezame.
## Usage
### register
To be able to connect to the Sezame HQ server, you have to register your client/application, this is
done by sending the register call using your recovery e-mail entered during the app installation
process.
You'll get an authentication request on your Sezame app, which must be authorized.
```php
$client = new \SezameLib\Client();
$registerRequest = $client->register()->setEmail('example@example.com')->setName('my new client');
$registerResponse = $registerRequest->send();
$clientcode = $registerResponse->getClientCode();
$sharedsecret = $registerResponse->getSharedSecret();
sign
After you have authorized the registration on your mobile device you can request the certificate., (*6)
$client = new \SezameLib\Client();
$privateKeyPassword = 'somethingsecret';
$csrKey = $client->makeCsr($clientcode, 'example@example.com', $privateKeyPassword,
Array(
'countryName' => 'AT',
'stateOrProvinceName' => 'Vienna',
'localityName' => 'Vienna',
'organizationName' => 'my company name',
'organizationalUnitName' => 'IT division'
));
$signRequest = $client->sign()->setCSR($csrKey->csr)->setSharedSecret($sharedsecret);
$signResponse = $signRequest->send();
$cert = $signResponse->getCertificate();
printf("CSR:\n%s\n\n", $csrKey->csr);
printf("Certificate:\n%s\n\n", $cert);
printf("Private Key:\n%s\n\n", $csrKey->key);
Store the certificate and the private key within your system, it is recommended to protect your
private key with a secure passphrase.
The certificate and the private key is needed for subsequent calls to the Sezame servers, sign
and register are the only two calls which can be used without the client certificate., (*7)
pair
Once you have successfully obtained the client certificate, let your customers pair their devices
with your application, this is done by displaying a QR code which is read by the Sezame app., (*8)
use Endroid\QrCode\Writer;
$client = new \SezameLib\Client($certfile, $keyfile);
$username = 'foo-client-user';
// check pairing status of a certain user
$statusRequest = $client->linkStatus();
$statusResponse = $statusRequest->setUsername($username)->send();
if ($statusResponse->isLinked()) {
print "user already has been linked\n";
die;
}
$linkRequest = $client->link();
$linkResponse = $linkRequest->setUsername($username)->send();
if ($linkResponse->isDuplicate()) {
print "user already has been linked\n";
die;
}
$qrCode = $linkResponse->getQrCode($username);
$qrCode->setSize(300)->setLabelMargin([
't' => 10,
'r' => 10,
'b' => 10,
'l' => 10,
]); // optionally adjust qrcode dimensions
printf('<img src="%s"/>', $qrCode->writeString(Writer\PngDataUriWriter::class));
file_put_contents('qrcode.html', sprintf('<img src="%s"/>', $qrCode->writeString(Writer\PngDataUriWriter::class)));
auth
To authenticate users with Sezame, use the auth call., (*9)
$client = new \SezameLib\Client($certfile, $keyfile, $keyPassword);
$username = 'foo-client-user';
$timeout = 10;
$authRequest = $client->authorize();
$authRequest->setUsername($username);
$authResponse = $authRequest->send();
if ($authResponse->isNotfound()) {
// user not paired
}
if ($authResponse->isOk())
{
$statusRequest = $client->status();
$statusRequest->setAuthId($authResponse->getId());
for ($i = 0; $i < $timeout; $i++)
{
$statusResponse = $statusRequest->send();
if ($statusResponse->isAuthorized())
{
// request has been authorized
}
if ($statusResponse->isDenied())
{
// request has been denied
}
sleep(1);
}
printf("user did not respond within %d seconds\n", $timeout);
}
fraud
It is possible to inform users about fraud attempts, this request could be send, if the user logs in
using the password., (*10)
$client = new \SezameLib\Client($certfile, $keyfile, $keyPassword);
$username = 'foo-client-user';
$authRequest = $client->authorize();
$authRequest->setType('fraud');
$authRequest->setUsername($username);
$authResponse = $authRequest->send();
if ($authResponse->isNotfound()) {
// user not paired
}
if ($authResponse->isOk())
{
printf("user notified about possible fraud attempt\n");
}
cancel
To disable the service use the cancel call, no further requests will be accepted by the Sezame
servers:, (*11)
$client = new \SezameLib\Client($certfile, $keyfile, $keyPassword);
$client->cancel()->send();
error handling
The Sezame Lib throws exceptions in the case of an error., (*12)
$client = new \SezameLib\Client($certfile, $keyfile);
try {
$client->cancel()->send();
printf("Client canceled\n");
} catch (\SezameLib\Exception\Connection $e) {
printf("Connection failure: %s %d\n",
$e->getMessage(), $e->getCode());
} catch (\SezameLib\Exception\Parameter $e) {
print_r($e->getErrorInfo());
} catch (\SezameLib\Exception\Response $e) {
printf("%s %d\n", $e->getMessage(), $e->getCode());
}
License
This bundle is under the BSD license. For the full copyright and license
information please view the LICENSE file that was distributed with this source code., (*13)
Wallogit.com
