Integration with GuardianKey

[pauloangelo]

Hi all,

We are trying to integrate eGroupware with GuardianKey. However, we have doubts related to the best way to do this and the best point in the code for this integration.

GuardianKey is a solution to protect systems against authentication attacks. It uses Machine Learning and analyses the user’s behavior, threat intelligence and psychometrics (or behavioral biometrics). The protected system (in the concrete case, eGroupware) must send an event via REST for the GuardianKey on each login attempt. More info at https://guardiankey.io .

The best way to integrate would be on having a hook in the procedure that process the user credentials submission in eGroupware (the script that receives the POST), something such as:

if(POST IN AUTH FORM) {
boolean loginFailed = checkLogin();
GuardianKeyEvent event = createEventForGuardianKey(username,loginFailed);
boolean GuardianKeyValidation = checkGuardianKeyViaREST(event);
if(GuardianKeyValidation){
// Allow access
} else {
// Deny access
}
}

Where is the best place to create this integration? Is there a way to create a hook for this purpose? Should we create an extension?

Any help is welcome.

Thank you in advance.

Best regards,

Paulo Angelo

[RalfBecker]

Hi Paulo,

easy to do, create a new application and implement the hook “session_creation”. It is called after EGroupware authenticated the user while creating the session. If the hook returns a non-empty string it is displayed to the user trying to login and the login is denied:

EGroupware/egroupware/blob/master/api/src/Session.php#L574

Here’s some example from an app we use in our EGroupware hosting to track the login-attempts / sessions:

	/**
	 * Hook called by eGW after a successful creation of a new session
	 *
	 * The session can be terminated by return an error-message
	 *
	 * @param array $data values see session::create
	 * @return boolean|string false to not intercept the session creation, or string with error-message to terminate the session
	 */
	static function session_creation($data)
	{
		try {
			self::send_mserver('session_creation',$data);
		}
		catch(Exception $e) {
			return $e->getMessage();
		}
		//return 'Session stoped by MServer!';

		return false;
	}

Ralf

[gbernardes]

Hi @RalfBecker,

I’m developer the GuardianKey plugin for eGroupware, which will be a implementation of GuardianKey Auth Security Lite (https://guardiankey.io/services/guardiankey-auth-security-lite/).

I think to follow the path that you indicated. However, where do I get more details to develop the application? I have found in this link the files that I need to have, however in the documentation it does not describe the function of each file. Can you give me a direction to go?

Thank you very much in advance

[RalfBecker]

That link is ancient, all current information is in the Github wiki, thought it’s not much on writing EGroupware apps

You need a stub app, which does not show up in the navigation, setting enabled=2 see eg.:

• https://github.com/EGroupware/collabora/blob/master/setup/setup.inc.php#L13

Let’s assume your app is called guardiankey, you need to add the following files in egroupware

• guardiankey/setup/setup.inc.php to be installable via setup and define the “session_creation” hook
• guardiankey/src/Hooks.php to implement eg. Guardiankey\Hooks::session_creation
• guardiankey/templates/default/images/navbar.png for an app-icon
• guardiankey/templates/default/config.xet # template to define which configuration your apps need

These files exist in every EGroupware app and you can find plenty examples in our repositories on Github.

Ralf