Assess and implement reauthorization for sensitive areas of the application

[asmecher]

Currently, OJS/OMP/OPS do not distinguish authentication levels for content vs. administration areas of the system -- once logged in, a user with administration access may wander between editorial and administrative areas.

The European Commission requires differentiated access in its Web Application Security Standard:

10. Administration pages of an application containing sensitive non-classified information shall have stricter security requirements which may justify the need for a re-authentication and/or for a stronger authentication.

(This is tracked in our IT Security Plan as WASS.10.)

Recommended: implement re-authorization when entering Administration if this has not been done within a short time window (similar to Github's challenge for settings areas); consider the same for context settings.

How to test changes:
Note: This feature is currently only applied to admins

1. This feature is disabled by default. Enable the feature by specifying how long (in minutes) admins can access the administration area after initial re-authentication before being required to re-authenticate again. This is done by setting a value greater than zero for password_timeout under the [security] section of your app's config file.
2. Log in as an admin
3. Click Administration
4. You will be presented with a screen requiring password confirmation to re-authenticate
5. Enter your password
6. The user will now have access to the administration area
7. Observe that the user can perform admin actions
8. Allow the number of minutes specified in step 1 to elapse
9. Attempt to perform an action in the admin area, e.g. by clicking the Hosted Journals link; or perform a page refresh
10. The user will be redirected to a screen requesting re-authentication

Pull Requests
pkp-lib: #12505
ui-library: pkp/ui-library#858
ojs: pkp/ojs#5449
omp: pkp/omp#2287
ops: pkp/ops#1250

[taslangraham]

Implementing an approach similar to Github's Sudo Mode.

[taslangraham]

@asmecher Would we want to consider making this feature configurable at the Context level? Therefore allowing individual Contexts to decide whether or not reauthorization should be required when accessing Context settings?

To require reauthorization for Administration, we can configure that via and entry in config.inc.php

[asmecher]

@taslangraham, I think we can consider this only relevant to the Administration area, which is only available to the Site Admin and is not context-dependent. Therefore, it would only need to be configured in config.inc.php if anywhere -- a single setting for the amount of time a reauthentication action is valid, with a 0 to make it forever (as before).