Latch PrestaShop english

ElevenPaths, radical and disruptive innovation in security solutions

ElevenPaths [email protected] elevenpaths.com

Latch plugin installation and user guide for PrestaShop

Version 4.1 – January 2015


V.4.1 – January 2015

Page 2 of 19 2015 © Telefónica Digital Identity & Privacy, S.L.U. All Rights Reserved.

TABLE OF CONTENT

1 Obtaining the Latch plugin .......................................................................................... 3

1.1 Prerequisites ............................................................................................................................. 3

1.2 Obtaining application ID ........................................................................................................... 3

1.3 Downloading the plugin............................................................................................................ 6

2 Installing the plugin..................................................................................................... 7

2.1 PrestaShop version 1.5.6.2 ....................................................................................................... 7

2.1.1 Configuring the plugin ................................................................................................................ 8

2.1.2 Uninstalling the plugin.............................................................................................................. 10

2.2 PrestaShop version 1.6.0.9 ..................................................................................................... 11

2.2.1 Configuring the plugin .............................................................................................................. 13

2.2.2 Uninstalling the plugin.............................................................................................................. 13

3 Use of the Latch plugin by end users........................................................................... 15

3.1 Pairing a user .......................................................................................................................... 15

3.2 Unpairing a user ...................................................................................................................... 17

4 Resources .................................................................................................................. 18




1 Obtaining the Latch plugin

1.1 Prerequisites

PrestaShop version 1.5 or later.

Curl extensions active in PHP (uncomment "extension=php_curl.dll" or "extension=curl.so"

in Windows or Linux php.ini respectively.

1.2 Obtaining application ID

To obtain the "Application ID" and the "Secret", which are essential to integrate Latch into a service,

it’s necessary to register a developer account in Latch's website: https://latch.elevenpaths.com. On

the upper right side, click on “Developer area”.

Figure 01: “Developer area” in Latch webpage.

In the next screen, tap the button “Register as a developer” and select “Create a new developer account”, a form will appear where you can fill up the required data. Mandatory fields are name, e-mail and password.

Figure 02: Sign in form for developers.

https://latch.elevenpaths.com/




Once completed, an email will be sent, with an activation code to activate the brand new account.

Figure 03: Form to fill up with activation code.

When the account is activated, the user will be able to create applications with Latch and access to developer documentation, including existing SDKs and plugins.

To do so the developer must log on to the Latch website and then access the "Developer area" section (https://latch.elevenpaths.com/www/developerArea), where you can view your applications through the "My applications" section on the side menu.

Figure 04: “My applications” section with user's configured applications.

From the "Add a new application" button, the developer will create a new application, with the specified name, which you want to appear in the end users' mobile application.

https://latch.elevenpaths.com/www/developerArea




Figure 05: Creating an application. The name will be shown on the mobile app.

Information about the application is displayed when it is created and part of this data is editable. The basic data that the developer should use when installing the plugin are the "Application ID" and "Secret". In addition the following additional parameters are in place, which the developer may change at any time, that set the characteristics of your application:

Name: This corresponds to the name of the application that end users see on their devices when they pair the service. They can customize it themselves on their own device if they so wish.

Image: This corresponds to the application icon that will appear in the end-user's device; its size should not exceed 1MB. It is recommended to be in 24-bit png format without alpha channel, and its proportions are 1: 1.

2nd OTP factor (One-time password): This is only available to developers with a subscription model other than "Community". It enables the service to also be protected by a password, which is sent to the end user at the time he/she wants to access the service. The OTP setup can be:

1. Disabled: The option will not appear on the end user's mobile device.

2. Opt in: The end user may choose to use this option to protect the service.

3. Mandatory: The end user will receive a password every time he/she wants to access the service.

Lock latches after request: This is only available to developers with a subscription model other than "Community". This enables the service to be locked automatically once it has been accessed. The “Lock latches after request” setup can be:

1. Disabled: The option will not appear on the end user's mobile device.

2. Opt in: The end user may choose to use this option to protect the service.

3. Mandatory: The service will be locked automatically once it has been accessed. In the latter case, the "Scheduled lock" option would disappear from the service details view.

Contact email and Contact phone: These details will be displayed in the notifications that users will receive when there is a fraudulent attempt to access the service or any of its operations.

Operations: This corresponds to each of the actions included in the service but independent of each other, and that the developer wants to protect with Latch. The number of operations that can be included depending on the model of subscription chosen. In each of the operations, a "2nd OTP factor" (OTP) and an "Lock latches after request" (LOR) can be used. It is not compulsory to create operations and this will depend on the nature of the service to be protected.




Note: This plugin does not support the use of operations. Tailored implementation through the SDK of the corresponding language must be carried out to add them.

Once the setup is complete and the changes have been saved, the new application will appear on the list of the developer's applications. This can be edited whenever you want.

Figure 06: Created application. It may be edited again at any moment.

1.3 Downloading the plugin

From the side menu in developers area, the developer can access the “Documentation & SDKs” section. Inside it, there is a “Plugins and SDKs” menu. Links to different SDKs in different programming languages and plugins developed so far, are shown.

Figure 07: Examples of SDKs and plugins available.

The developer must tap the “DOWNLOAD” button for this plugin to access its source code from the

“Standard plugins” section. A manual on the installation and use of the plugin can also be

downloaded.




2 Installing the plugin

2.1 PrestaShop version 1.5.6.2

Once the administrator has downloaded the plugin, it has to be added as a module in its administration panel in PrestaShop. Click on “Modules”, where the Latch module will be uploaded.

Figure 08: Accessing "Modules" section from PrestaShop administration panel.

In the upper right of the screen, “Add a new module” will be available. A form to upload “latch.zip” (previously downloaded from GitHub) will be shown.

Figure 09: Uploading .ZIP file.

If everything is ok, a notification bar will appear: “Module downloaded successfully”. The module is now uploaded but not installed. To install it, the administrator has to search for it, going to the search menu in the down left part of the screen.

Figure 10: Searching for the uploaded module.




When the Latch module is found, a "Not installed" label will be shown. Just click on "Install" on the right to install it.

Figure 11: Installing the module.

2.1.1 Configuring the plugin After installation, a new webpage to configure it, is opened. The previously generated “Application ID” and “Secret” values have to be introduced (see figure 05). Press “Save” to store the values and start using Latch.

Latch is ready to be used by users. By default it’s shown in last position in the “modules” list.

To modify its position up or down in the screen, use “Configures hooks”. The higher the module is placed, the more accessible for users.

Figure 12: Configuring hooks.

“LiveEdit” feature may be used to place the module by dragging and dropping it directly in place. To run it, click on “Run LiveEdit” in the right side of the screen where hooks are configured. A new tab with the shop main site will be shown.




Figure 13: Running “LiveEdit” to customize “hooks”.

Before configuring where the modules will be placed, it’s necessary to login in the shop with a “Front Office” user, since it will be placed in this accounts panel. Clicking on the user name, in the upper right part of the screen, you will get directly to this panel. Being the last module installed, it will be found at the bottom of the right hand column. Just drag and drop it where you want using the arrows.

Figure 14: Moving the installed module inside administration panel.

When finished, save the changes by clicking the "Save" button in the upper right side of the screen. A confirmation message will be shown.

Figure 15: Confirmation message when modifying module positions.




2.1.2 Uninstalling the plugin Uninstalling is simple. Go to “Modules” and search for Latch module on the left side text box.

When the module is located, press on “Uninstall”, on the right side of the module, and accept confirmation message.

Figure 16: Uninstalling the module.

Figure 17: Module was uninstalled successfully.




After confirmation, users will not have the module anymore available on their administration panel.

Figure 18: No more Latch information in user's section.

2.2 PrestaShop version 1.6.0.9

Once the administrator has downloaded the plugin, it has to be added as a module in its administration panel in PrestaShop. Click on “Modules”, where the Latch module will be uploaded.

Figure 19: Accessing "Modules" section from PrestaShop administration panel.




In the upper right of the screen, “Add a new module” will be available. A form to upload “latch.zip” (previously downloaded from GitHub) will be shown.

Figure 20: Uploading .ZIP file.

If everything is ok, a notification bar will appear: “The module was successfully downloaded”. The module is now uploaded but not installed. To install it, the administrator has to search for it, going to the search menu in the down part of the screen.

When the Latch module is found, a "Not installed" label will be shown. Just click on "Install" on the right to install it. A warning indicating that the module is not trusted will appear; the reason is that the module has not been downloaded from the official PrestaShop website. After clicking the "Proceed with the installation" button the installation will begin.

Figure 21: Installing the module.




2.2.1 Configuring the plugin After installation, a new webpage to configure it, is opened. The previously generated “Application ID” and “Secret” values have to be introduced (see figure 05). Press “Save” to store the values and start using Latch.

Figure 22: Application ID and Application secret.

It’s necessary to login in the shop with a “Front Office” user, since it will be placed in this accounts panel. Clicking on the user name, in the upper right part of the screen, you will get directly to this panel.

Figure 23: Latch location access.

2.2.2 Uninstalling the plugin Uninstalling is simple. Go to “Modules” and search for Latch module.

When the module is located, press on “Uninstall the selection”, on the under side of the module, and accept confirmation message.




Figure 24: Uninstalling the module.

After confirmation, users will not have the module anymore available on their administration panel.

Figure 25: No more Latch information in user's section.




3 Use of the Latch plugin by end users

Latch does not affect in any case or in any way the usual operations with a service. It just allows or denies actions over it, acting as an independent extra layer of security that, once removed or without effect, will have no effect over the service, which will remain with their original state.

3.1 Pairing a user

When the plugin is configured, users may use it. They need the Latch application installed on their mobile devices, and follow these steps:

Step 1: Within your account of the service that you want to pair, you must go to the site created

by the administrator for pairing with Latch. The way to access this site and its name are

completely dependent on the administrator.

Figure 26: The user should introduce the pairing code generated by Latch here. Version 1.5.6.2.

Figure 27: The user should introduce the pairing code generated by Latch here. Version 1.6.0.9.

Step 2: From the Latch app on the mobile device, the user has to generate the pairing code,

pressing on “Add a new service" at the bottom of the application, and pressing "Generate new

code" will take the user to a new screen where the pairing code will be displayed.

Step 3: Next the same characters displayed on the mobile device must be entered (before they

expire) on the site created by the administrator for pairing with Latch and then tap the button to

confirm the pairing. A notification will be received on the mobile device, announcing that the

service is already paired.




Figure 28: Button that generates the pairing code.

Figure 29: Generated pairing code. Figure 30: Notification after successful pairing.

Step 4: After pairing, the user will be able to access the accounts list paired with Latch. Users can

check that the pairing was recently added. From this point users can lock and unlock access to

these services simply by tapping the button beside each service name.

Figure 31: Unlocked service. Figure 32: Locked service.

To test Latch, the user needs to lock the service from Latch app , and try to access again introducing the right credentials.

If the configuration is correct, the user will not be able to access in even if the correct credentials were introduced. Additionally, a notification on the mobile device will be received, warning about somebody trying to access the service. The notification includes the email and the phone that the developer stated at when created (Figure 5).




Figure 33: A user accessing. Version 1.5.6.2. Figure 34: Notification of an unauthorized access attempt.

After unlocking the service from Latch app and introducing the right credentials again, the user will be able to access.

3.2 Unpairing a user

Simply access the section where the pairing initially took place and unpair throught the corresponding element. Finally, an alert indicating that the service has been unpaired will be displayed

Figure 35: Unpairing Latch. Version 1.5.6.2. Figure 36: Alert displaying the service has been unpaired.




4 Resources

For more information about how to use Latch and testing more free features, please refer to the user guide in Spanish and English:

1. Guía del usuario de Latch con Nevele Bank. 2. Latch user´s guide for Nevele Bank.

You can also access the following constantly expanded documentation:

Manuals in Spanish and English for integrating and using Latch with the available plugins, at the Latch website and via the ElevenPaths Slideshare channel.

Videos with subtitles in Spanish and English for integrating and using Latch with the available plugins on ElevenPaths' YouTube and Vimeo channels.

Manuals for integrating and using Latch in the organizations that have already implemented it (Movistar, Tuenti, UNIR, USAL, etc.), at the Latch website and via the ElevenPaths Slideshare channel.

Information about Latch API at the Latch website.

https://latch.elevenpaths.com/www/public/documents/howToUseLatchNevele_ES.pdf

https://latch.elevenpaths.com/www/public/documents/howToUseLatchNevele_EN.pdf

https://latch.elevenpaths.com/www/developers/resources

http://es.slideshare.net/elevenpaths

https://www.youtube.com/playlist?list=PLwRVFywsfVOClvH-W5jvgOuRu9WXHlBmf

http://vimeo.com/channels/830801

https://latch.elevenpaths.com/www/where.html

http://es.slideshare.net/elevenpaths

https://latch.elevenpaths.com/www/developers/doc_api




The information disclosed in this document is the property of Telefónica Digital Identity & Privacy, S.L.U. (“TDI&P”) and/or any other entity within Telefónica Group and/or its licensors. TDI&P and/or any Telefonica Group entity or TDI&P’S licensors reserve all patent, copyright and other proprietary rights to this document, including all design, manufacturing, reproduction, use and sales rights thereto, except to the extent said rights are expressly granted to others. The information is this document is subject to change at any time, without notice.

Neither the whole nor any part of the information contained herein may be copied, distributed, adapted or reproduced in any material form except with the prior written consent of TDI&P.

This document is intended only to assist the reader in the use of the product or service described in the document. In consideration of receipt of this document, the recipient agrees to use such information for its own use and not for other use.

TDI&P shall not be liable for any loss or damage arising out from the use of the any information in this document or any error or omission in such information or any incorrect use of the product or service. The use of the product or service described in this document are regulated in accordance with the terms and conditions accepted by the reader.

TDI&P and its trademarks (or any other trademarks owned by Telefonica Group) are registered service marks. All rights reserved.

PUBLICATION:

January 2015

elevenpaths.com Blog.elevenpaths.com @ElevenPaths Facebook.com/ElevenPaths YouTube.com/ElevenPaths

At ElevenPaths we have our own way of thinking when we talk about security. Led by Chema Alonso, we are a team of experts who are passionate about their work, who are eager to redefine the industry and have great experience and knowledge about the security sector.

Security threats in technology evolve at an increasingly quicker and relentless pace. Thus, since June 2013, we have become a startup company within Telefónica aimed at working in an agile and dynamic way, transforming the concept of security and, consequently, staying a step ahead of our attackers.

Our head office is in Spain, but we can also be found in the UK, the USA, Brazil, Argentina and Colombia.

If you wish to know more about us, please contact us at:

Latch PrestaShop english

Technology

Latch PrestaShop english