Latch Drupal 6 english

ElevenPaths, radical and disruptive
innovation in security solutions
ElevenPaths
info@elevenpaths.com
elevenpaths.com
Latch plugin installation
and use guide
for Drupal 6
Version 4.0 – October 2014

Latch plugin installation and use guide
for Drupal 6
V.4.0 – October 2014
Page 2 of 162014 © Telefónica Digital Identity & Privacy, S.L.U. All Rights Reserved.
TABLE OF CONTENT
1 Obtaining the Latch plugin .......................................................................................... 3
1.1 Prerequisites............................................................................................................................. 3
1.2 Obtaining application ID........................................................................................................... 3
1.3 Downloading the plugin............................................................................................................ 6
2 Installing the plugin..................................................................................................... 7
2.1 Configuring the plugin .............................................................................................................. 9
2.1.1 Configuring the installed plugin for other users.........................................................................9
2.2 Uninstalling the plugin............................................................................................................ 10
3 Use of the Latch plugin by end users...........................................................................12
3.1 Pairing a user .......................................................................................................................... 12
3.2 Unpairing a user...................................................................................................................... 14
4 Resources ..................................................................................................................15

for Drupal 6
1 Obtaining the Latch plugin
1.1 Prerequisites
 Drupal version 6.
 Curl extensions active in PHP (uncomment "extension=php_curl.dll" or "extension=curl.so" in
Windows or Linux php.ini respectively.
1.2 Obtaining application ID
To obtain the "Application ID" and the "Secret", which are essential to integrate Latch into a service,
it’s necessary to register a developer account in Latch's website: https://latch.elevenpaths.com. On
the upper right side, click on “Developer area”.
Figure 01: “Developer area” in Latch webpage.
In the next screen, tap the button “Register as a developer” and select “Create a new developer
account”, a form will appear where you can fill up the required data. Mandatory fields are name, e-
mail and password.
Figure 02: Sign in form for developers.

for Drupal 6
Once completed, an email will be sent, with an activation code to activate the brand new account.
Figure 03: Form to fill up with activation code.
When the account is activated, the user will be able to create applications with Latch and access to
developer documentation, including existing SDKs and plugins.
To do so the developer must log on to the Latch website and then access the "Developer area"
section (https://latch.elevenpaths.com/www/developerArea), where you can view your applications
through the "My applications" section on the side menu.
Figure 04: “My applications” section with user's configured applications.

for Drupal 6
From the "Add a new application" button, the developer will create a new application, with the
specified name, which you want to appear in the end users' mobile application.
Figure 05: Creating and application. The name will be shown on the mobile app.
Information about the application is displayed when it is created and part of this data is editable.
The basic data that the developer should use when installing the plugin are the "Application ID" and
"Secret". In addition the following additional parameters are in place, which the developer may
change at any time, that set the characteristics of your application:
 Name: This corresponds to the name of the application that end users see on their devices when
they pair the service. They can customize it themselves on their own device if they so wish.
 Image: This corresponds to the application icon that will appear in the end-user's device; its size
should not exceed 1MB. It is recommended to be in 24-bit png format without alpha channel,
and its proportions are 1: 1.
 2nd OTP factor (One-time password): This is only available to developers with a subscription
model other than "Community". It enables the service to also be protected by a password, which
is sent to the end user at the time he/she wants to access the service. The OTP setup can be:
1. Disabled: The option will not appear on the end user's mobile device.
2. Opt in: The end user may choose to use this option to protect the service.
3. Mandatory: The end user will receive a password every time he/she wants to access the
service.
 Lock latches after request: This is only available to developers with a subscription model other
than "Community". This enables the service to be locked automatically once it has been
accessed. The “Lock latches after request” setup can be:
1. Disabled: The option will not appear on the end user's mobile device.
2. Opt in: The end user may choose to use this option to protect the service.
3. Mandatory: The service will be locked automatically once it has been accessed. In the latter
case, the "Scheduled lock" option would disappear from the service details view.
 Contact email and Contact phone: These details will be displayed in the notifications that users
will receive when there is a fraudulent attempt to access the service or any of its operations.
 Operations: This corresponds to each of the actions included in the service but independent of
each other, and that the developer wants to protect with Latch. The number of operations that
can be included depending on the model of subscription chosen. In each of the operations, a

for Drupal 6
"2nd OTP factor" (OTP) and an "Lock latches after request" (LOR) can be used. It is not
compulsory to create operations and this will depend on the nature of the service to be
protected.
Note: This plugin does not support the use of operations. Tailored implementation through the
SDK of the corresponding language must be carried out to add them.
Once the setup is complete and the changes have been saved, the new application will appear on
the list of the developer's applications. This can be edited whenever you want.
Figure 06: Created application. It may be edited again at any moment.
1.3 Downloading the plugin
From the side menu in developers area, the developer can access the “Documentation & SDKs”
section. Inside it, there is a “Plugins and SDKs” menu. Links to different SDKs in different
programming languages and plugins developed so far, are shown.
Figure 07: Examples of SDKs and plugins available.
The developer must tap the “DOWNLOAD” button for this plugin to access its source code from the
“Standard plugins” section. A manual on the installation and use of the plugin can also be
downloaded.

for Drupal 6
2 Installing the plugin
Once the administrator has downloaded the module, it has to be added as a module in its
administration panel in Drupal 6. Unzip the downloaded module and place the whole content inside
“modules” folder inside Drupal 6 web, as shown in the figure.
Figure 08: Placing unzipped “latch” folder inside modules.
Now the administrator can access its configuration via the control panel in Drupal 6. Go to
“Modules”, following this menu: “Administer”-“Site building”-“Modules”.
At the bottom of the web, the just installed “latch” module will be shown. It has to be enabled,
clicking on it and saving this new configuration so Drupal 6 uses it.
Figure 09: Enabling “latch” module 1/2.

for Drupal 6
Figure 09: Enabling “latch” module 2/2.
Once enabled, the administrator has to introduce “Application ID” and “Secret” data, generated
before (see figure 05). Got to Latch configuration (“Administer”-“Site configuration”-“Latch Config”)
fill the form, and press save.

for Drupal 6
Figure 10: Setting the “Application ID” and “Secret”.
2.1 Configuring the plugin
Once the module is installed, a new “Latch Account” button will be shown under “My Account”. The
token generated by the Latch app will be added there.
Figure 11: Introducing the pairing token for Latch.
2.1.1 Configuring the installed plugin for other users
Latch installation in Drupal 6 is allowed only for the administrator by default. For the other accounts
in Drupal 6 to use it, the administrator has to enable its permissions.
Go to “Permissions” (“Administer”-“User management”-“Permissions”). Latch are all under “latch
module”. At least “pairing enabled” option should be enabled corresponding to “authenticated user”
permissions. No other option is required.

for Drupal 6
Figure 12: Activating Latch permissions for authenticated users.
2.2 Uninstalling the plugin
Uninstalling module is easy. Go to “Modules”. Module “Latch” will appear just as shown in figure 09.
Disable it clicking on “Enabled” and save the configuration.
Go to “Uninstall” above in the web and click on “Uninstall” to go on with the uninstalling process.
Confirmation will be needed.
Uninstalling does not mean Latch disappearing from module list, since the module downloaded is
still there. What we get with this steps is removing the “Application ID” and “Application Secret” so
Administrator is in the same situation he was before activating the module, in figure 09. After
uninstalling, “Latch Config” is not in the site configuration list, as shown in figure 14.

for Drupal 6
Figure 13: Uninstalling Latch module.
Figure 14: Latch is not anymore under the site configuration menu.
After uninstalling, authenticated users will not have access to “Latch Account” section.
Figure 15: The user will not have any Latch section.

for Drupal 6
3 Use of the Latch plugin by end users
Latch does not affect in any case or in any way the usual operations with a service. It just allows or
denies actions over it, acting as an independent extra layer of security that, once removed or
without effect, will have no effect over the service, which will remain with their original state.
3.1 Pairing a user
When the plugin is configured, users may use it. They need the Latch application installed on their
mobile devices, and follow these steps:
Step 1: Within your account of the service that you want to pair, you must go to the site created
by the administrator for pairing with Latch. The way to access this site and its name are
completely dependent on the administrator.
Figure 16: The user should introduce the pairing code generated by Latch here.
Step 2: From the Latch app on the mobile device, the user has to generate the pairing code,
pressing on “Add a new service" at the bottom of the application, and pressing "Generate new
code" will take the user to a new screen where the pairing code will be displayed.
Step 3: Next the same characters displayed on the mobile device must be entered (before they
expire) on the site created by the administrator for pairing with Latch and then tap the button to
confirm the pairing. A notification will be received on the mobile device, announcing that the
service is already paired.

for Drupal 6
Figure 17: Button that generates
the pairing code.
Figure 18: Generated pairing code. Figure 19: Notification after
successful pairing.
Step 4: After pairing, the user will be able to access the accounts list paired with Latch. Users can
check that the pairing was recently added. From this point users can lock and unlock access to
these services simply by tapping the button beside each service name.
Figure 20: Unlocked service. Figure 21: Locked service.
To test Latch, the user needs to lock the service from Latch app , and try to access again introducing
the right credentials.
If the configuration is correct, the user will not be able to access in even if the correct credentials
were introduced. Additionally, a notification on the mobile device will be received, warning about
somebody trying to access the service. The notification includes the email and the phone that the
developer stated at when created (Figure 5).

for Drupal 6
Figure 22: A user accessing. Figure 23: Notification of an
unauthorized access attempt.
After unlocking the service from Latch app and introducing the right credentials again, the user will
be able to access.
3.2 Unpairing a user
Simply access the section where the pairing initially took place and unpair throught the
corresponding element. Finally, an alert indicating that the service has been unpaired will be
displayed
Figure 24: Unpairing Latch. Figure 25: Alert displaying the
service has been unpaired.

for Drupal 6
4 Resources
For more information about how to use Latch and testing more free features, please refer to the
user guide in Spanish and English:
1. Guía del usuario de Latch con Nevele Bank.
2. Latch user´s guide for Nevele Bank.
You can access Latch´s use and installation manuals, together with a list of all available plugins here:
https://latch.elevenpaths.com/www/developers/resources
Further information on de Latch´s API can be found here:
https://latch.elevenpaths.com/www/developers/doc_api

for Drupal 6
The information disclosed in this document is the property of Telefónica Digital Identity & Privacy, S.L.U. (“TDI&P”) and/or any other entity
within Telefónica Group and/or its licensors. TDI&P and/or any Telefonica Group entity or TDI&P’S licensors reserve all patent, copyright
and other proprietary rights to this document, including all design, manufacturing, reproduction, use and sales rights thereto, except to
the extent said rights are expressly granted to others. The information is this document is subject to change at any time, without notice.
Neither the whole nor any part of the information contained herein may be copied, distributed, adapted or reproduced in any material
form except with the prior written consent of TDI&P.
This document is intended only to assist the reader in the use of the product or service described in the document. In consideration of
receipt of this document, the recipient agrees to use such information for its own use and not for other use.
TDI&P shall not be liable for any loss or damage arising out from the use of the any information in this document or any error or omission
in such information or any incorrect use of the product or service. The use of the product or service described in this document are
regulated in accordance with the terms and conditions accepted by the reader.
TDI&P and its trademarks (or any other trademarks owned by Telefonica Group) are registered service marks. All rights reserved.
elevenpaths.com
Twitter.com/ElevenPaths | Blog.elevenpaths.com
Vimeo.com/ElevenPaths | Facebook.com/ElevenPaths
PUBLICATION:
October 2014
At ElevenPaths we have our own way of thinking when we talk
about security. Led by Chema Alonso, we are a team of experts
who are passionate about their work, who are eager to redefine
the industry and have great experience and knowledge about the
security sector.
Since June 2013, we have become a startup company within
Telefónica aimed at working in an agile and dynamic way,
transforming the concept of security and, consequently, staying a
step ahead of our attackers.
Our head office is in Spain, but we can also be found in the UK,
the USA, Brazil, Argentina and Colombia.
If you wish to know more about us, please contact us at:

Latch Drupal 6 english

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (15)

Similar to Latch Drupal 6 english

Similar to Latch Drupal 6 english (10)

Recently uploaded

Recently uploaded (20)

Latch Drupal 6 english