Page Comparison

Purpose and Benefits

2FA is additional security mechanism to protect the user from fraudulent act. Bahmni using uses basic authentication (username, password) from OpenMRS so far. We . However, it is optimal to have additional security mechanisms to protect users from fraudulent acts. Thus we are introducing 2FA in Bahmni to enhance the security. This feature only covers login through the Bahmni application. It doesn't apply to direct login through OpenMRS or OpenELIS or OpenERP. This feature is optional for an implementation. When this feature is enabled then the user will be authenticated with username and password first and on success, the user will get an SMS with OTP (One Time Password) in with an OTP to his/her registered mobile. The user has to authenticate with the OTP before proceed proceeding to use the system.

The generated OTPs use Java's SecureRandom. They are random enough that the user can't guess. If you are curious, you can see  (see details of the implementation here). OTPs are stored in memory. All The OTPs and all operations like generation, validation, expiry are handled in memory only. There is no database involved.

Steps

1.

Enable/disable 2FA

To enable/disable 2FA, add the following snippet in the /etc/bahmni-installer/setup.yml file before Bahmni installation.

Code Block
two_factor_auth: enabled/disabled

2.

Add SMS gateway service

Bahmni gives flexibility add SMS gateway service to the implementer.

Info
Please refer bahmni-sms-plugins for more info.

3.

Add user's mobile number

Add the user's mobile number currently. So, please use the below SQL query to add into the systemOpenMRS database.

The contact table is present in the openmrs OpenMRS database. It has 3 columns.

• user_name must be exactly the same as the username in OpenMRS. 

• country_code can be found here. 

  Warning
  Country_code mustn't should not contain the preceeding preceding "+."

• mobile_number is the mobile number of that user.

Code Block
language sql title Sample SQL to add add user's mobile number linenumbers true
insert into contact(user_name, country_code, mobile_number) values('Leo','91','9955273623');

Note
If reports module is installed, then for reports-user  'bypass2fa' role should be added to OpenMRS.

4. Check Audit Logs

Every event is captured in the audit log. The log file will be created for every day and only recent , but only recent files from the past 90 days files are  are kept.

Sample log entries

:

• OTP 623704 generated for doctor1
• Failed attempt #1 using OTP 123131 by doctor1
• OTP 623704 validation successful for doctor1

There are many more events captured than those mentioned above.

5. Override OTP configurations

These settings can be overridden by configuring in applicationadding configuration to the application.properties file.

Prerequisites:

1. If reports module is installed, then for reports-user  'bypass2fa' role should be added in openmrs.