[GUACAMOLE-1056] Add support for tracking the time drift between guacamole and TOTP-tokens

• Type: Improvement
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Component/s: guacamole-auth-totp
• Assignee: Unassigned
• Reporter: Stefan
• Created: 29/Apr/20 11:10
• Updated: 14/Jul/20 12:24

Description

Tokens/Display cards which generate codes directly on the device have an internal clock. According our investigates it seams to be normal that a time drift of 2 second per week seems to be in a common range. At some point the time drift of these token is to high so the TOTP- extensions rejects the generated codes. Because it is not possible to correct the on an easy way, we will add a tracking of this time drift.

We added a new attribute for storing the value of the time drift next to the TOTP-Key. The module will accept 3 codes, one previous, one on time and one in the future. Depending on the accepted code the value will be decremented (previous) or incremented (future) or unchanged (on time). The new value will be used to compensate the timedrift on the next login.

The changed code will follow the next days.