The REST client has been authenticated in the above steps.
Authenticating using username + password + device token - as shown in the following steps - makes sense after logout (or on a different session).
To logout via the REST API call
DELETE /auth-login/rest/public/authentication
The start of the authentication process is the same as above: send username and password.
HTTP Request: Check Username and Password
HTTP Response: Check Username and Password
Since there is at least one valid device token for the user, the REST API server gives the client a choice of several second factors (in this example: MTAN or Device Token).
To get the list of options, the REST client can send the following request.
If the REST client already knows what to select, the next step can be omited (not recommended).
HTTP Request: Get Selection Options
Http Response: 2nd-factor options that can be selected
If the option "MTAN" is selected, the authentication process continues as above using MTAN.
To continue with the device token, select "DEVICE_TOKEN".
HTTP Request: Select DEVICE_TOKEN as 2nd step
Http Response from selecting DEVICE_TOKEN: a device token response is required
The REST API asks for a "device token response", i.e. a signed challenge in the form of a JWT.
To do so, get a challenge first - using the device token ID that has been stored in the HTTP client when registering the public key.
HTTP Request: Get a device token challenge
Http Response: Device token challenge with expiration date
The challenge is only valid for a certain amount of time as reported by the validTo attribute (e.g. 10 minutes after getting the challenge) and can only be used once.
To respond to the challenge (see next call), create a JWT as follows:
- Send back the challenge as "challenge" claim
- Sign using the ES512 algorithm using the private key stored in the REST client
The "payload" of the JWT in this example would look like:
{ "challenge": "fF46SgSBRyZM3P83ctRYIddpR29Ow26nK5thY7lq7y-KaTI0Pc5RD7ls8jAhx2Yx9qtYdX9iNQ0wWqgEHAK1Og" }
The resulting JWT including the signature can be seen in the next example REST call.
HTTP Request: Send JWT for verification
Http Response: Authentication succesful