Manage authenticators

Before you begin

1. Create an Alibaba Cloud account, pass real-name verification, create a Security Authentication instance, and then create an application for the instance.

2. Obtain an AccessKey pair of the Alibaba Cloud account.

3. Select one or more authentication methods for the application. Authenticator management is applicable to the following authentication methods: Internet Finance Authentication Alliance (IFAA), Web Authentication (WebAuthn), and Time-based One-Time Password (TOTP). For more information, see Manage applications.

4. Download the SDK and demo.

ListAuthenticators

Queries authenticators. The detailed information about authenticators is returned.

Request parameters

Returned Data

Authenticator parsing

Examples

Request method: POST

https://idaas-doraemon.aliyuncs.com/?Action=ListAuthenticators
&Version=2021-05-20
&ApplicationExternalId=A0000001
&UserId=user-test-1
&<Common request parameters>

Sample success responses: Authenticators are queried.

{
  "TotalCount": 1,
  "RequestId": "78514973-F2F7-0B9E-BE46-AC6DFF2E9908",
  "PageSize": 10,
  "PageNumber": 1,
  "Authenticator": [
    {
      "RegisterTime": 1632835006133,
      "Type": "TOTP",
      "AuthenticatorUuid": "06828e19c13fcd1ef641d1d53ae8d4a3yVgFUDgy2SK",
      "CredentialId": "9fc55a5d68835fe8efaef3f73306e47e9FzIMsZpjgj",
      "LastVerifyTime": 1632835006133,
      "AuthenticatorName": "TOTP",
      "ApplicationExternalId": "dc515f66fa5aa0fa2a1aa4c85fd86742ePbf2IsWtSk"
    }
  ]
}

Sample error responses: The ApplicationExternalId parameter is invalid.

{
  "Success": false,
  "Code": "Operation.Failure.Application.ResourceNotExist",
  "Message": "Operation.Failure.Application.ResourceNotExist",
  "RequestId": "1C0EE50A-B3BB-42FD-AB59-E3FE88976982",
  "Data":null
}

Query authenticator details

Queries the information about an authenticator. The detailed information about the authenticator is returned.

Request parameters

Response data

Authenticator parsing

Example request

Request method: POST

https://idaas-doraemon.aliyuncs.com/?Action=GetAuthenticator
&Version=2021-05-20
&ApplicationExternalId=A0000001
&ApplicationUuid=A0000001
&UserId=user-test-1
&<Common request parameters>

Sample success responses: The detailed information about the authenticator is queried.

{
  "RequestId": "E0E92A30-1DB6-0E89-9929-D120DFE11F19",
  "Authenticator": {
    "RegisterTime": 1632835006133,
    "Type": "TOTP",
    "AuthenticatorUuid": "06828e19c13fcd1ef641d1d53ae8d4a3yVgFUDgy2SK",
    "CredentialId": "9fc55a5d68835fe8efaef3f73306e47e9FzIMsZpjgj",
    "LastVerifyTime": 1632835006133,
    "AuthenticatorName": "TOTP"
  }
}

Sample error responses: The ApplicationExternalId parameter is invalid.

{
  "Success": false,
  "Code": "Operation.Failure.Application.ResourceNotExist",
  "Message": "Operation.Failure.Application.ResourceNotExist",
  "RequestId": "1C0EE50A-B3BB-42FD-AB59-E3FE88976982",
  "Data":null
}

Modify authenticator

Modifies an authenticator.

Request parameters

Return values

Examples

Request method: POST

https://idaas-doraemon.aliyuncs.com/?Action=UpdateAuthenticatorAttribute
&Version=2021-05-20
&ApplicationExternalId=A0000001
&ApplicationUuid=A0000001
&UserId=user-test-1
&AuthenticatorName=My authenticator
&<Common request parameters>

Sample success responses: The authenticator is modified.

{
  "RequestId": "E0E92A30-1DB6-0E89-9929-D120DFE11F19"
}

Sample error responses: The ApplicationExternalId parameter is invalid.

{
  "Success": false,
  "Code": "Operation.Failure.Application.ResourceNotExist",
  "Message": "Operation.Failure.Application.ResourceNotExist",
  "RequestId": "1C0EE50A-B3BB-42FD-AB59-E3FE88976982",
  "Data":null
}

Delete authenticator

Deletes an authenticator.

Request parameters

Return values

Examples

Request method: POST

https://idaas-doraemon.aliyuncs.com/?Action=DeregisterAuthenticator
&Version=2021-05-20
&ApplicationExternalId=A0000001
&ApplicationUuid=A0000001
&UserId=user-test-1
&AuthenticatorName=My authenticator
&<Common request parameters>

Sample success responses: The authenticator is deleted.

{
  "RequestId": "E0E92A30-1DB6-0E89-9929-D120DFE11F19"
}

Example error response: Invalid application ID in request parameters

{
  "Success": false,
  "Code": "Operation.Failure.Application.ResourceNotExist",
  "Message": "Operation.Failure.Application.ResourceNotExist",
  "RequestId": "1C0EE50A-B3BB-42FD-AB59-E3FE88976982",
  "Data":null
}

Sample code in Java

To import the server-side SDK package into a Java Maven project, add the following coordinates.

import com.alibaba.fastjson.JSONObject;
import com.aliyuncs.DefaultAcsClient;
import com.aliyuncs.IAcsClient;
import com.aliyuncs.idaas_doraemon.model.v20210520.ServiceInvokeRequest;
import com.aliyuncs.idaas_doraemon.model.v20210520.ServiceInvokeResponse;
import com.aliyuncs.profile.DefaultProfile;

import java.nio.charset.StandardCharsets;
import java.util.Base64;

public class IDaaSAuthSample {
    /**
     * Use your AccessKey ID and AccessKey secret to initialize your client.
     *
     * @param accessKeyId
     * @param accessKeySecret
     * @return Client
     * @throws Exception
     */
    public static IAcsClient createClient(String accessKeyId, String accessKeySecret) throws Exception {
      	// Security risks may arise if you use the AccessKey pair of an Alibaba Cloud account because the account has permissions on all API operations. We recommend that you call API operations or perform routine O&M as a Resource Access Management (RAM) user. To create a RAM user, log on to the RAM console. 
        // In this example, the AccessKey ID and AccessKey secret are configured as environment variables. You can also save your AccessKey ID and AcessKey secret to a configuration file as needed. 
        // We recommend that you do not directly use the AccessKey ID and AccessKey secret in the code. This may cause a leakage of the AccessKey pair.
      	String accessKeyId = System.getenv("ACCESS_KEY_ID");
        String accessKeySecret = System.getenv("ACCESS_KEY_SECRET");
        DefaultProfile profile = DefaultProfile.getProfile(
                "cn-hangzhou",
                accessKeyId,
                accessKeySecret);
        // addEndpoint
        DefaultProfile.addEndpoint("cn-hangzhou",
                "idaas-doraemon",
                "idaas-doraemon.aliyuncs.com");
        // The endpoint that you want to access.
        return new DefaultAcsClient(profile);
    }

    public static void main(String[] args_) throws Exception {
        // Query the detailed information about an authenticator.
        getAuthenticator();
    }
    public void getAuthenticator() throws Exception {
        IAcsClient client = IDaaSAuthSample.createClient("Your AccessKey", "Your AccessSecret");
        // The detailed information about the authenticator.
        GetAuthenticatorRequest request = new GetAuthenticatorRequest();
                request.setApplicationExternalId("The application ID");
                request.setUserId("The user ID");
                request.setAuthenticatorUuid("The UUID of the authenticator");
        // After the sample code is run, use the following object to display the response data of the request:
        try {
            GetAuthenticatorResponse response = client.getAcsResponse(request);
            System.out.println(JSONObject.toJSON(response.getAuthenticator()).toString());
        } catch (Exception e) {
            // Determine the cause of an exception based on the error code.
            System.out.println(e);
        }
    }
}

Maven dependencies of the sample code

  <dependency>
   <groupId>com.aliyun</groupId>
   <artifactId>aliyun-java-sdk-idaas-doraemon</artifactId>
   <version>1.2.4</version>
  </dependency>
  <dependency>
   <groupId>com.aliyun</groupId>
   <artifactId>aliyun-java-sdk-core</artifactId>
   <optional>true</optional>
   <version>[4.4.9,5.0.0)</version>
  </dependency>