Projects:EnhanceTerminalAuthentication

Contents 1 Introduction 2 Requirements 3 Solution 4 Documentation 5 Improvements (3.0RR15Q1)

Introduction

The main goal of this project is to improve the security of Web POS operation by enforcing device (terminal) access privileges to the system so only authorized terminal devices can connect to the system as POS terminals.

Secondary objectives for this project are:

• To ensure that the mapping of Physical Terminals (devices) with Logical Terminals (as defined in Openbravo for Retail configuration) is 1 to 1, to avoid messing up data coming from different physical POS terminals
• To strengthen and simplify the assignment of a physical POS terminal to a Logical POS terminal (currently a parameter in the url set in the browser)

Requirements

• Only authorized physical terminals are allowed to access the system and behave as POS terminals
• Each terminal configuration in the backend has to have only one physical device linked.
• Avoid selecting the terminal configuration with a parameter in the URL.
• Ability to unlink the physical device from the terminal configuration (Backoffice).

Solution

• Add a Terminal Key Identifier as a code for each terminal. It will be visible in the Terminal configuration screen and the user will enter a unique code for each terminal configuration.
• The terminal parameter is removed from the URL and will be persisted in the local storage of the device (using the terminal key identifier code)
• First time a physical terminal access to the system it will realize there is no Teminal associated to that terminal and will request the terminal key identifier (operation will not be possible till it is provided). After linking the backend will mark that terminal as linked so it won't be possible to link it again.

Add two new fields in POS Terminal window:

• Terminal Key Identifier (Unique).
• Is linked to a physical device (checkbox)

First time accessing to Web POS:

• We introduce a Web POS URL without terminal parameter, a general URL for all terminals.
• Check in localStorage if the physical device is linked to a terminal and in the Backoffice if this terminal is linked to a physical device and if the code of both match(localStorage code and Backoffice code).
• If we are linked, go to this terminal login window. If not linked, show a popup to enter user, password and code of the terminal to be linked. Notice that we have to enter user and password because only authorized roles and users who have access to the terminal can do the link.
• Check the code introduced and if it match with a terminal, check if it is not already linked to another physical device('Is linked to a physical device' checked). We get an error if password is wrong or if the terminal is already linked, if all is ok we go to terminal window login.
  • Save in localStorage the terminal linked.
  • Save in localStorage the terminal code.
  • Save in the backend "Is linked to a physical device" = true

In case we want to revoke the access of a physical device, it is enough unchecking "Is linked to a physical device" on the terminal configuration and entering a new code. If we try to access with the linked physical device, Web POS will ask the code of the terminal. This way it will be possible to address scenarios of changing one physical device by another (eg. because of device is broken).

This project should provide a smooth migration process from the current way of operation (in which terminal is defined at the url of each terminal) to the new secure way (old way is fully discontinued but transition should be smooth). Using a preference (Use terminal/device security) we can keep getting the terminal from the URL or work with this new functionality

Documentation

• Feature request in mantis: https://issues.openbravo.com/view.php?id=26021

Improvements (3.0RR15Q1)

The concept of cache session ID will be added to this feature. Cache session ID will be a unique ID which will represent a cache session. This Id will change whenever the cache is removed. For sure ii eill be different among the diferent devices which are using the POS.

This Id will help to control strange situations which are not being managed properly right know. Therefore, this ID will be included as a part of client side logging providing important information about wrong usage of the Web POS.

This issue has been created in mantis to track every changes related to this feature

• Issue in mantis: https://issues.openbravo.com/view.php?id=30869