Not able to "Add a Super Gluu device" to authentication, the supergluu app on Android looks for htps://hostname/.well-known/fido-u2f-configuration which isn't available on server

[amarveeramalli]

Hi,

I have installed Janssen community edition on Ubuntu 22.04 as per instructions at: https://docs.jans.io/v1.0.20/admin/install/vm-install/ubuntu/.

When I try to "Add a Super Gluu device" using jans-casa application, after scanning the QR code from the Android app, the app fails with error: "java.io.FileNotFoundException: https://hostname/.well-known/fido-u2f-configuration". I get a 404 when I navigate to this url. However, https://hostname/.well-known/openid-configuration is showing up fine.

Am I missing something. I searched in the dos about fido-u2f-configuration but didn't find anything.

Thanks,
Amar Nath V.

[amarveeramalli]

Attaching the screenshot of the error that we are getting in the Android app.

[nynymike]

Have you checked the latest docs? We migrated Super Gluu to use the FIDO2 endpoints.

[amarveeramalli]

Looked at the docs at that location. I am little confused. At one point, the doc says "Super Gluu app can be used to achieve 2FA for web and mobile applications with Janssen Server, Gluu Flex, and Gluu Server working as authentication servers." and at other place is is asking to follow the Gluu Flex installation guide which I understand is the commercial version.

Is supergluu supported in Opensource version or is it only for the commercial version?

[nynymike]

Super Gluu is supported in Janssen FIDO server. The only delta with Gluu Flex is the AdminUI component. Super Gluu is a handy app if you want to use push notifications, which people seem to like better then entering an SMS OTP code. Of course it's not phishing resistent, which is the biggest attack surface area... but it is a better authenticator then OTP codes! Why is Super Gluu in the FIDO server itself? Historically we just used U2F for Super Gluu, but with some of the added complexity of FIDO2, its evolved into a special authenticator.

BTW, even though the Super Gluu App is free on the App/Play Store, there is a fee to call Gluu's Super Gluu API to send the push notification (currently $.01 per request). For testing purposes, you can get 500 credits for free to trial. You need to register for "Scan" in the Agama Lab Market.

[amarveeramalli]

Thanks @nynymike. However, the registration is not working with the our deployment. We have installed Janssen community edition (version 1.0.20) on Ubuntu 22.04 as per instructions at: https://docs.jans.io/v1.0.20/admin/install/vm-install/ubuntu/. After we scan the QR on the mobile app (from Android Playstore), it is looking for fido-u2f-configuration, which is not present in our jansseb server deployment.

[nynymike]

@Milton-Ch will comment. I think we need to update the app, which we are planning to do soon.

[Milton-Ch]

Dear @amarveeramalli, we are sorry to hear that you had a problem with super gluu.
As our systems are constantly growing, there are some cases like this that usually have some kind of update delay, thank you for your cooperation in this regard.
Please note that we have an estimated date for January 10, 2024, the new version of super gluu.

[mission-leben]

Since we are facing the same problem (with 5.0.22) and there has been no update of the app since December, I suspect that it is still due to the app. Correct so far? If so, I would like to know when to expect the new version, as we are planning to use this productively in the short term and already have the appropriate licenses. Thank you very much!

[Milton-Ch]

@mission-leben

The new version of super gluu is now available for both iOS and Android, you can update and try again.