iupui-soic / dynaswap Goto Github PK

Just like the shell-scripts/dynaswap-useradd , also add a script that does the following:

• 1. add nginx as a reverse proxy
• 2. points all OpenMRS endpoints to 443
• 3. points all 8000 endpoints to 443
• 4. adds a letsencrypt ACME script that will create an SSL for the nginx

• Integrate all the python scripts required for the authentication into the module.

Replace the default password authentication with the "authenticate_page" URL of the Django app.

From openMRS database use:
user_property (for locking accounts)
global_property security.allowedFailedLoginsBeforeLockout (number of tries)

This will lock out users after many unsuccessful (facial authentication) login attempts

Some files in Java properties file contain \ (backslash) to include special characters like #,@,$ within value strings. The Python code in the Django app should be able to identify these escape characters and ignore the
e.g. password is 12#456 - so when reading in Python this should be 12#456

We need to develop a framework, using the Behavior Driven Development (BDD) approach so that all of our security enhancements to JetStream VMs can be evaluated and a CVSS score can be generated.

Once the framework is ready, we need some examples that can generate baseline scores for plain OpenMRS.

Deploy a DNS router in a stable location that will listen to input from newly launched VMs, so that they can have their own domain names.

This is a sub-issue of #7 because a subdomain is required to get an SSL certificate. A skeletal startup script that pings the router is available here - https://github.com/iupui-soic/dynaswap/blob/master/shell-scripts/DAR.sh , but this issue is to track the code and updates to create the router itself. The DNS router should be a simple app that takes the IP and user launching the VM and post it to a DNS server.

the default implementation may use a externalized authentication to a REST service to a DNS server.

Please use the wiki to document the different parts of our project and checkmark the following or add more, as an when you get those done

• Introduction about our project (not too technical)
• The overall project architecture
• Explaining the different parts of the GitHub codebase
• How to deploy the image into a JetStream VM
• How to add users to share a VM
• Release notes for different versions of the openmrs-base images
• Future Roadmap

We need to be able to register faces only by the administrators. Thus, we need to place an iframe in the Manage Users page to the "register_page" django URL.

Currently, the Django BioCapsule application updates the last_authenticated column in the dynaswap_users table. However, the matching probability is verified and response to the "authentication success" page is shown and it takes time to write to the last_authenticated column.

This makes it hard to authenticate OpenMRS with the same user as the BioCapsule user because we are currently having to use session validation. This might be open to a number of attacks, and it might be better to validate the user internally using the database column. Thus, before the "authentication success" page is shown, the database should be updated for the OpenMRS authentication to validate that the user is correctly authenticated.

Change the module Activator in the startup method to execute the:

1. python3 rs_startup.py
2. python3 manage.py runserver 0.0.0.0:8000

When the user tries to register for facial authentication with multiple roles like for example admin user with two roles: system developer and provider, choosing either of the two roles is unable to match the user, gives Unknown Username/Role combination error.