We are using PrivacyIDEA 3.13.3 in a banking environment.
Users can enroll Push Tokens and our banking service then can trigger challenges of type push to deliver transaction notifications to our app, containing transaction information like destination, amount, etc. The user has to approve or decline the challenge to complete/abort the transaction.
We send the information regarding the transaction in the challenge property of the validate/triggerchallenge endpoint. After experimenting with different policy configs to set the text for push notification and challenge, I have a question regarding the {challenge} text. I know that I can set the push_text_on_mobile and push_title_on_mobile to tweak the push notification and that I can add the {challenge} tag to the push_text_on_mobile property. But what I would like to have is a config so that the push notification content could be configured separatly from the challenge that is returned from the poll-token-challenges response. Is that currently posible?
Why? Well, push notifications are shown even when the phone is blocked, so if it contains sensitive information everybody can see it on the block screen.
I would preffer sett the custom notification text like “Hey {username} you have a pending transaction to be approved”, the user would tap the notification, the app would open. In the app we would poll pending transactions and in the response we would optionally have the {challenge} content. This could be a optional config and the default would be the same value as he push_text_on_mobile and push_title_on_mobile. Also, it could be helpfull to also show the time when the challenge expires but I didnt find {expires_at} or similar tag, only the {time} tag.
I’ve seen in other enterprise solutions, they send a push notification wich contains a transaction id and a serial id of the token which the challenge was triggered for, and the app has to fetch the pending transaction for the token and returns all the transaction details.
I dont know if this posible or a good Idea but it would be nice to have.