Use Cases
HomeIntegrityControlManagement CenterSolutions
  • Get Started
  • Integrity | Access
    • Auth. methods
      • LDAP (Username/Password)
      • LDAP (Username/Password) + OTP (SMTP)
      • LDAP (Username/Password) + OTP (SMS)
      • Swedish BankID
      • Microsoft Entra ID (SAMLSPBroker)
      • Foregin eID (SAMLSPBroker)
    • Auth. methods (SAML)
      • One-Time Password (OATH)
      • Inera IdP (SITHS) (SAMLSPBroker)
      • ID-porten (Norway) (SAML IdP with OIDC RP)
      • Multiple SAML IdP's configured
        • Multiple JSON files
    • Auth. methods (OIDC)
      • Static values (OIDC) - Test only
      • Swedish BankID (OIDC)
      • UID/PWD (OIDC)
    • Auth. methods (MISC)
      • Selector filtering
      • AuthZ control
      • External links and Cancel location
    • Add a Federation or SAML SP
  • Integrity | Portal
    • Portal
  • Integrity | Enrollment
    • Software token (OATH)
    • Best practice configuration
  • Integrity | Radius
    • UID/OATH token
    • UID/Password/OATH token
    • UID/Password/SMTP
  • Integrity | API
    • Swedish Siths eID
    • Oath Token
  • Control | Applications
    • Password Reset
    • Password Reset for Entra ID
    • Password Reset for Google Workspace
  • OPERATION
    • Rolling upgrade - cluster
  • TROUBLESHOOTING
    • Wrong relaystate
  • Misc
    • Address configuration externally
    • ADFS
      • Protect Fortified ID apps
      • Install and configure Fortified ID ADFS adapter for Siths eID
      • Install and configure Fortified ID ADFS adapter for Oath
    • AWS
      • Protect AWS Cognito with eID MFA
      • Protect AWS IAM Identity Center with eID MFA
    • Customization
      • Overlay - WEB
      • Overlay - Portal
      • Overlay - Password Reset
      • Overlay - Enrollment
      • Logout page
    • Dependency-Track - protect with eID MFA and SSO
    • Digitala Nationella Prov (DNP) / Skolfederation
      • Active Directory Federation Services (ADFS) with BankID as step-up-method
      • Active Directory / LDAP with BankID as step-up-method
      • Entra ID (Azure AD) with BankID as step-up-method
      • Google with BankID as step-up-method
      • Generate eduPersonPrincipalName (eppn) and store in Google
      • Generate eduPersonPrincipalName (eppn) and store in Entra ID
      • Common configuration
    • Encrypt configuration secrets
    • Microsoft Entra
      • Protect Entra ID (Azure AD) with eID MFA
      • Entra External - Support for eID (SAML)
      • Entra External - Support for eID (OIDC)
    • Expressions
    • Google
      • Common configuration for Google Workspace - Directory API
      • Common configuration for Google Workspace - authentication for Fortified ID products
      • Delegated administration for Google Workspace - teacher updates student guardians
      • Delegated administration for Google Workspace - teacher updates student password
      • Protect Google Workspace with eID MFA
    • HTTPS
    • Protect sensitive data, such as social security numbers, through obfuscation
    • Reverse proxy
      • Install Apache Web Server on Windows
      • Add SSL certificate and enable https
      • Add a Fortified ID virtual host
    • Set AuthnContextClassRef
    • Wiki.js - OpenID Connect (OIDC)
Powered by GitBook
On this page
  • Scenario
  • Prerequisite
  • Add ZIP content to you installation
  • Update the configuration to map your environment
  • Start Fortified ID enrollment service
  • Test the overlay for OATH software
  • Example config.json
  1. Misc
  2. Customization

Overlay - Enrollment

Change look and feel for Fortified ID Enrollment OATH Software. Add new and/or update existing languages.

PreviousOverlay - Password ResetNextLogout page

Last updated 1 year ago

Scenario

In this use case we are going to change the look and feel for the Fortified ID application Enrollment. We will also add a language (Norwegian) and add information to the Swedish language file. Note, this use case focus on activating different strong authentication methods for OATH Software, OATH Hardware, Passkey (FIDO2) and FortifiedID Mobile backend. Each method must be configured accordingly.

Prerequisite

There are some prerequisite for this use case.

  • Fortified ID Enrollment installed.

  • Microsoft SQL Server

    • Microsoft SQL Server Express

    • Microsoft SQL Server Management Studio (SSMS)

    • Create manually a database called Enrollment. If Enrollment database exist the Enrollment service will create all the tables when service start.

    • For this use case we use the sa account. Make sure the sa account has administrative rights to the database.

Add ZIP content to you installation

  1. First, make a backup of your existing customer folder.

    1. Open folder C:\Program Files\FortifiedID\enrollment

    2. Rename customer folder to customer_ORG

  2. From the downloaded ZIP-file, add the example customer folder to: C:\Program Files\FortifiedID\enrollment\

  3. The result should look like:

Update the configuration to map your environment

The downloaded folders contains all information needed. For example, a test certificate and metadata files are included and configured to work with the example applications. However, some data needs to be changed to map your environment. You need to update the SQL data to match your environment. Since this example was done on a Windows server you might need to update file paths if you run something else. Also the http ports might need to be changed if they are not available in your environment.

To make it easy to change settings to your local environment. Go to the config folder and edit the file globals.json, that contains the information you need to change. Config.json uses the variables in globals.json.

  1. Open globals.json in \..\fortifiedid\enrollment\customer\config and update:

    1. SQL data to map your environment

    2. File paths if needed

    3. HTTP if needed

Start Fortified ID enrollment service

Note. Since we use the NoOp authenticator there will be no login and use of Fortified ID Web/IdP.

  1. Start the Fortified ID Enrollment service. Verify the service is running.

Test the overlay for OATH software

If you have added the folder structure and example config.json file used in this use case.

  1. Open a browser

    1. New language option (Norwegian)

      1. Verify that Norwegian exists as language option

      2. Change to Norwegian

      3. Change back to English

    2. favicon.ico is different from default

    3. Logo should be Litho Acme logo in top left corner

    4. Top bar should be Litho colors

    5. Below screenshot should be the result you should see

  2. Try the other enrollment apps

    1. https:/localhost:8444/enrollment/oathhw/

    2. https:/localhost:8444/enrollment/webauthn/

    3. https:/localhost:8444/enrollment/mobileid/

Example config.json

Below is an example config.json file with focus only on this use case. We use the NoOp authenticator so no need for an IdP (e.g. Fortified ID Web). This example config.json also maps to the overlay folder created for this use case.

{
    "globals": "@include:globals.json",
    "modules": [
        {
            "name": "CefEventModule",
            "config": {}
        },
        {
            "name": "HttpClient",
            "config": {
                "name": "default",
                "ssl_trust_all": true,
                "idle_timeout_ms": 5000,
                "connect_timeout_ms": 5000
            }
        },
        {
            "name": "TokensDb",
            "config": {
                "namespace": "default",
                "db_driver": "${globals.tokensdb.db_driver}",
                "encryption_key": "ABC123",
                "jdbc": {
                    "url": "${globals.tokensdb.url}",
                    "username": "${globals.tokensdb.username}",
                    "password": "${globals.tokensdb.password}"
                },
                "inactive_token_duration": "PT5M",
                "maintenance_batch_size": 100,
                "secret_key_directory": "${globals.file_paths.base_dir}/config/resources_internal/dbsecrets",
                "otp_cache_max_age_seconds": 3600,
                "oathsw": {
                    "token_issuer": "FortifiedID",
                    "active_token_duration": "P180D",
                    "totp_max_drift": 10,
                    "hotp_max_lookahead": 10,
					"max_active_tokens": 5
                },
                "oathhw": {
                    "totp_max_drift": 10,
                    "hotp_max_lookahead": 10,
					"max_active_tokens": 5
                },
                "webauthn": {
                    "enabled": true,
                    "origin": "https://dev.fortifiedid.se",
                    "user_verification_required": true,
                    "user_presence_required": true,
                    "credential_creation_options": {
                        "rp": {
                            "id": "dev.fortifiedid.se",
                            "name": "FortifiedID"
                        },
                        "pubKeyCredParams": [
                            {
                                "type": "public-key",
                                "alg": -7
                            },
                            {
                                "type": "public-key",
                                "alg": -35
                            },
                            {
                                "type": "public-key",
                                "alg": -36
                            },
                            {
                                "type": "public-key",
                                "alg": -257
                            },
                            {
                                "type": "public-key",
                                "alg": -258
                            },
                            {
                                "type": "public-key",
                                "alg": -259
                            }
                        ],
                        "timeout": 60000,
                        "excludeCredentials": [],
                        "authenticatorSelection": {
                            "requireResidentKey": false,
                            "residentKey": "preferred",
                            "userVerification": "preferred"
                        }
                    }
                }
            }
        },
        {
            "name": "MobileServerEnrollment",
            "config": {
                "namespace": "default",
                "http_port": "${globals.http.port}",
                "http_use_ssl": true,
                "http_keystore_ref": {
                    "type": "${globals.keystore.https.ref.type}",
                    "path": "${globals.keystore.https.ref.path}",
                    "password": "${globals.keystore.https.ref.password}"
                },
                "http_keystore_type": "${globals.keystore.https.type}",
                "http_key_alias": "${globals.keystore.https.http_key_alias}",
                "http_key_password": "${globals.keystore.https.http_key_password}",
                "webroot_dir": "resources/web/enrollment",
                "http_context": "/enrollment",
                "context_path": "/mobileid",
                "overlay_dirs": [
                    "${globals.file_paths.base_dir}/config/resources_external/overlays/0_look_and_feel",
                    "${globals.file_paths.base_dir}/config/resources_external/overlays/4_mobile",
                    "${globals.file_paths.base_dir}/config/resources_external/overlays/"
				],
                "http_auth_redirect_url": "/enrollment/mobileid/authn/login",
                "server_api_url": "http://127.0.0.1:9097/mos"
            }
        },
        {
            "name": "WebAuthnEnrollment",
            "config": {
                "namespace": "default",
                "http_port": "${globals.http.port}",
                "http_use_ssl": true,
                "http_keystore_ref": {
                    "type": "${globals.keystore.https.ref.type}",
                    "path": "${globals.keystore.https.ref.path}",
                    "password": "${globals.keystore.https.ref.password}"
                },
                "http_keystore_type": "${globals.keystore.https.type}",
                "http_key_alias": "${globals.keystore.https.http_key_alias}",
                "http_key_password": "${globals.keystore.https.http_key_password}",
                "webroot_dir": "resources/web/webauthn",
                "http_context": "/enrollment",
                "context_path": "/webauthn",
                "overlay_dirs": [
                    "${globals.file_paths.base_dir}/config/resources_external/overlays/0_look_and_feel",
                    "${globals.file_paths.base_dir}/config/resources_external/overlays/3_passkeys",
                    "${globals.file_paths.base_dir}/config/resources_external/overlays/"
				],
                "http_auth_redirect_url": "/enrollment/webauthn/authn/login"
            }
        },
        {
            "name": "OathSwEnrollment",
            "config": {
                "namespace": "default",
                "http_port": "${globals.http.port}",
                "http_use_ssl": true,
                "http_keystore_ref": {
                    "type": "${globals.keystore.https.ref.type}",
                    "path": "${globals.keystore.https.ref.path}",
                    "password": "${globals.keystore.https.ref.password}"
                },
                "http_keystore_type": "${globals.keystore.https.type}",
                "http_key_alias": "${globals.keystore.https.http_key_alias}",
                "http_key_password": "${globals.keystore.https.http_key_password}",
                "webroot_dir": "resources/web/oath-sw",
                "http_context": "/enrollment",
                "context_path": "/oathsw",
                "http_auth_redirect_url": "/enrollment/oathsw/authn/login",
                "overlay_dirs": [
                    "${globals.file_paths.base_dir}/config/resources_external/overlays/0_look_and_feel",
                    "${globals.file_paths.base_dir}/config/resources_external/overlays/1_oath_sw",
                    "${globals.file_paths.base_dir}/config/resources_external/overlays/"
				],
                "token_issuer": "Fortified ID Test",
                "flow_layout": "STANDARD"
            }
        },
        {
            "name": "OathHwEnrollment",
            "config": {
                "namespace": "default",
                "http_port": "${globals.http.port}",
                "http_use_ssl": true,
                "http_keystore_ref": {
                    "type": "${globals.keystore.https.ref.type}",
                    "path": "${globals.keystore.https.ref.path}",
                    "password": "${globals.keystore.https.ref.password}"
                },
                "http_keystore_type": "${globals.keystore.https.type}",
                "http_key_alias": "${globals.keystore.https.http_key_alias}",
                "http_key_password": "${globals.keystore.https.http_key_password}",
                "webroot_dir": "resources/web/oath-hw",
                "http_context": "/enrollment",
                "context_path": "/oathhw",
                "http_auth_redirect_url": "/enrollment/oathhw/authn/login",
                "overlay_dirs": [
                    "${globals.file_paths.base_dir}/config/resources_external/overlays/0_look_and_feel",
                    "${globals.file_paths.base_dir}/config/resources_external/overlays/2_oath_hw",
                    "${globals.file_paths.base_dir}/config/resources_external/overlays/"
				],
                "token_issuer": "Fortified ID Test",
                "flow_layout": "STANDARD"
            }
        },
        {
            "name": "AuthN",
            "config": {
                "http_context": "/authn",
                "http_port": "${globals.http.port}",
                "http_use_ssl": true,
                "http_keystore_ref": {
                    "type": "${globals.keystore.https.ref.type}",
                    "path": "${globals.keystore.https.ref.path}",
                    "password": "${globals.keystore.https.ref.password}"
                },
                "http_keystore_type": "${globals.keystore.https.type}",
                "http_key_alias": "${globals.keystore.https.http_key_alias}",
                "http_key_password": "${globals.keystore.https.http_key_password}",
                "authenticators": [
                    {
                        "id": "test_auth_oathsw",
                        "type": "NoOp",
                        "config": {
                            "http_context": "/enrollment/oathsw/authn",
                            "context_path": "/login",
                            "success_location": "/enrollment/oathsw/login",
                            "logout_location": "https://www.fortifiedid.se",
                            "properties": {
                                "display_name": "John Doe"
                            }
                        }
                    }
                ]
            }
        },
        {
            "name": "AuthN",
            "config": {
                "http_context": "/authn",
                "http_port": "${globals.http.port}",
                "http_use_ssl": true,
                "http_keystore_ref": {
                    "type": "${globals.keystore.https.ref.type}",
                    "path": "${globals.keystore.https.ref.path}",
                    "password": "${globals.keystore.https.ref.password}"
                },
                "http_keystore_type": "${globals.keystore.https.type}",
                "http_key_alias": "${globals.keystore.https.http_key_alias}",
                "http_key_password": "${globals.keystore.https.http_key_password}",
                "authenticators": [
                    {
                        "id": "test_auth_oathhw",
                        "type": "NoOp",
                        "config": {
                            "http_context": "/enrollment/oathhw/authn",
                            "context_path": "/login",
                            "success_location": "/enrollment/oathhw/login",
                            "logout_location": "https://www.fortifiedid.se",
                            "properties": {
                                "display_name": "John Doe"
                            }
                        }
                    }
                ]
            }
        },
        {
            "name": "AuthN",
            "config": {
                "http_context": "/authn",
                "http_port": "${globals.http.port}",
                "http_use_ssl": true,
                "http_keystore_ref": {
                    "type": "${globals.keystore.https.ref.type}",
                    "path": "${globals.keystore.https.ref.path}",
                    "password": "${globals.keystore.https.ref.password}"
                },
                "http_keystore_type": "${globals.keystore.https.type}",
                "http_key_alias": "${globals.keystore.https.http_key_alias}",
                "http_key_password": "${globals.keystore.https.http_key_password}",
                "authenticators": [
                    {
                        "id": "test_auth_passkey",
                        "type": "NoOp",
                        "config": {
                            "http_context": "/enrollment/webauthn/authn",
                            "context_path": "/login",
                            "success_location": "/enrollment/webauthn/login",
                            "logout_location": "https://www.fortifiedid.se",
                            "properties": {
                                "display_name": "John Doe"
                            }
                        }
                    }
                ]
            }
        },
        {
            "name": "AuthN",
            "config": {
                "http_context": "/authn",
                "http_port": "${globals.http.port}",
                "http_use_ssl": true,
                "http_keystore_ref": {
                    "type": "${globals.keystore.https.ref.type}",
                    "path": "${globals.keystore.https.ref.path}",
                    "password": "${globals.keystore.https.ref.password}"
                },
                "http_keystore_type": "${globals.keystore.https.type}",
                "http_key_alias": "${globals.keystore.https.http_key_alias}",
                "http_key_password": "${globals.keystore.https.http_key_password}",
                "authenticators": [
                    {
                        "id": "test_auth_mobileid",
                        "type": "NoOp",
                        "config": {
                            "http_context": "/enrollment/mobileid/authn",
                            "context_path": "/login",
                            "success_location": "/enrollment/mobileid/login",
                            "logout_location": "https://www.fortifiedid.se",
                            "properties": {
                                "display_name": "John Doe"
                            }
                        }
                    }
                ]
            }
        }
    ]
}

Download with example customer folder for Enrollment.

Browse to

ZIP-file
https://localhost:8444/enrollment/oathsw/