EASG Challenge-Response Authentication

Last Updated : Oct 31, 2022 |
Prolog information
Metadata
Keywords:

EASG challenge generation

When EASG is enabled, an attempt to access the product via an Avaya Service Login results in providing the following information:
  • Challenge String: The new EASG Challenge String is the legacy ASG challenge format with the Product Certificate ID appended at the front. The Product Certificate ID is the serial number of the Avaya Experience Portal product certificate.
  • Product ID String: The new Product ID string is a globally unique identifier (GUID) that the EASG RPM generates, with the EASG RPM version number appended at the end.
The following is an example of the challenge and Product ID when using the Avaya service account to access the system: 
Challenge: 10001-85132972        

Product ID: 09f2c551f32e4c808b7fd3c544365a8f01

Response:

EASG response generation

The Avaya EASG Web Mobile interface is enhanced to accept all the existing inputs for ASG and EASG challenges. Avaya EASG Web Mobile then provides this information to the Avaya EASG backend server and shows the appropriate responses to the user.
The new EASG response strings can reach up to a maximum of 512 bytes strings. There is a Copy Response to Clipboard button on the Avaya EASG Web Mobile web page, which the user can use to copy the response string and paste it to the Linux login shell.

EASG response validation

If an EASG Response is not submitted to the product within five minutes of the EASG Challenge String being provided, the challenge expires. Any EASG response submitted against an expired challenge fails validation and the login fails.
If the EASG Response validation succeeds, then the Avaya service account user can access the system with the permissions associated with the Avaya Service Login name. The Linux system log /var/log/messages records an authentication through the success message of the product certificate.
If the EASG Response validation fails, the user is denied access to the system, and the challenge is depreciated. Any subsequent login attempt needs a new challenge. The Linux system log /var/log/messages records an authentication failed message.