Skip to content

Commit 6cd135d

Browse files
sidolovsidolov
authored
Merge pull request #185 from magento-gl/DUO_AC10982_13DEC2024
[2FA] Integrate with Duo Web SDK to support Universal Prompt
2 parents 6507dfd + d07df94 commit 6cd135d

File tree

33 files changed

+814
-1173
lines changed

33 files changed

+814
-1173
lines changed

‎TwoFactorAuth/Api/Data/DuoDataInterface.php‎

Lines changed: 29 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<?php
22
/**
3-
* Copyright © Magento, Inc. All rights reserved.
4-
* See COPYING.txt for license details.
3+
* Copyright 2020 Adobe
4+
* All Rights Reserved.
55
*/
66
declare(strict_types=1);
77

@@ -12,62 +12,82 @@
1212
/**
1313
* Represents the data needed to use duo
1414
*
15+
* @deprecated This interface is no longer used.
16+
* @see none
1517
* @api
1618
*/
1719
interface DuoDataInterface extends ExtensibleDataInterface
1820
{
1921
/**
2022
* Signature field name
23+
*
24+
* @deprecated
25+
* @see none
2126
*/
2227
public const SIGNATURE = 'signature';
2328

2429
/**
2530
* Api host field name
31+
*
32+
* @deprecated
33+
* @see none
2634
*/
2735
public const API_HOSTNAME = 'api_hostname';
2836

2937
/**
3038
* Get the signature
3139
*
40+
* @deprecated
41+
* @see none
3242
* @return string
3343
*/
3444
public function getSignature(): string;
3545

3646
/**
3747
* Set the signature
3848
*
49+
* @deprecated
50+
* @see none
3951
* @param string $value
4052
* @return void
4153
*/
4254
public function setSignature(string $value): void;
4355

44-
/**
45-
* Get the api hostname
46-
*
47-
* @return string
48-
*/
49-
public function getApiHostname(): string;
50-
5156
/**
5257
* Set the api hostname
5358
*
59+
* @deprecated
60+
* @see none
5461
* @param string $value
5562
* @return void
5663
*/
5764
public function setApiHostname(string $value): void;
5865

66+
/**
67+
* Get the api hostname
68+
*
69+
* @deprecated
70+
* @see none
71+
* @return string
72+
*/
73+
public function getApiHostname(): string;
74+
5975
/**
6076
* Retrieve existing extension attributes object or create a new one
6177
*
6278
* Used fully qualified namespaces in annotations for proper work of extension interface/class code generation
6379
*
80+
* @deprecated
81+
* @see none
6482
* @return \Magento\TwoFactorAuth\Api\Data\DuoDataExtensionInterface|null
6583
*/
6684
public function getExtensionAttributes(): ?DuoDataExtensionInterface;
6785

6886
/**
6987
* Set an extension attributes object
7088
*
89+
* @deprecated
90+
* @see none
7191
* @param \Magento\TwoFactorAuth\Api\Data\DuoDataExtensionInterface $extensionAttributes
7292
* @return void
7393
*/

‎TwoFactorAuth/Api/DuoAuthenticateInterface.php‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<?php
22
/**
3-
* Copyright © Magento, Inc. All rights reserved.
4-
* See COPYING.txt for license details.
3+
* Copyright 2020 Adobe
4+
* All Rights Reserved.
55
*/
66

77
declare(strict_types=1);
@@ -20,6 +20,8 @@ interface DuoAuthenticateInterface
2020
/**
2121
* Get the information required to configure duo
2222
*
23+
* @deprecated this method is deprecated and will be removed in a future release.
24+
* @see none
2325
* @param string $username
2426
* @param string $password
2527
* @return \Magento\TwoFactorAuth\Api\Data\DuoDataInterface
@@ -32,6 +34,9 @@ public function getAuthenticateData(
3234
/**
3335
* Authenticate and get an admin token
3436
*
37+
* @deprecated this method is deprecated and will be removed in a future release.
38+
* @see createAdminAccessTokenWithCredentialsAndPasscode
39+
*
3540
* @param string $username
3641
* @param string $password
3742
* @param string $signatureResponse
@@ -42,4 +47,18 @@ public function createAdminAccessTokenWithCredentials(
4247
string $password,
4348
string $signatureResponse
4449
): string;
50+
51+
/**
52+
* Authenticate and get an admin token with passcode
53+
*
54+
* @param string $username
55+
* @param string $password
56+
* @param string $passcode
57+
* @return string
58+
*/
59+
public function createAdminAccessTokenWithCredentialsAndPasscode(
60+
string $username,
61+
string $password,
62+
string $passcode
63+
): string;
4564
}

‎TwoFactorAuth/Api/DuoConfigureInterface.php‎

Lines changed: 25 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<?php
22
/**
3-
* Copyright © Magento, Inc. All rights reserved.
4-
* See COPYING.txt for license details.
3+
* Copyright 2020 Adobe
4+
* All Rights Reserved.
55
*/
66

77
declare(strict_types=1);
@@ -20,6 +20,9 @@ interface DuoConfigureInterface
2020
/**
2121
* Get the information required to configure duo
2222
*
23+
* @deprecated this method is deprecated and will be removed in a future release.
24+
* @see getDuoConfigurationData
25+
*
2326
* @param string $tfaToken
2427
* @return \Magento\TwoFactorAuth\Api\Data\DuoDataInterface
2528
*/
@@ -30,9 +33,29 @@ public function getConfigurationData(
3033
/**
3134
* Activate the provider and get an admin token
3235
*
36+
* @deprecated this method is deprecated and will be removed in a future release.
37+
* @see duoActivate
3338
* @param string $tfaToken
3439
* @param string $signatureResponse
3540
* @return void
3641
*/
3742
public function activate(string $tfaToken, string $signatureResponse): void;
43+
44+
/**
45+
* Configure duo for first time user
46+
*
47+
* @param string $tfaToken
48+
* @return void
49+
*/
50+
public function getDuoConfigurationData(
51+
string $tfaToken
52+
);
53+
54+
/**
55+
* Activate the provider and get an admin token
56+
*
57+
* @param string $tfaToken
58+
* @return void
59+
*/
60+
public function duoActivate(string $tfaToken): void;
3861
}

‎TwoFactorAuth/Block/Adminhtml/System/Config/Providers.php‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
<?php
22
/**
3-
* Copyright © Magento, Inc. All rights reserved.
4-
* See COPYING.txt for license details.
3+
* Copyright 2020 Adobe
4+
* All Rights Reserved.
55
*/
6+
67
declare(strict_types=1);
78
namespace Magento\TwoFactorAuth\Block\Adminhtml\System\Config;
89

@@ -46,7 +47,15 @@ protected function _getElementHtml(AbstractElement $element)
4647
'#twofactorauth_general_force_providers' => [
4748
'Magento_TwoFactorAuth/js/system/config/providers' => [
4849
'modalTitleText' => $this->getModalTitleText(),
49-
'modalContentBody' => $this->getModalContentBody()
50+
'modalContentBody' => $this->getModalContentBody(),
51+
'duoProviderValue' => 'duo_security',
52+
'duoFields' => [
53+
'twofactorauth_duo_client_id',
54+
'twofactorauth_duo_client_secret',
55+
'twofactorauth_duo_api_hostname',
56+
'twofactorauth_duo_integration_key',
57+
'twofactorauth_duo_secret_key',
58+
]
5059
]
5160
]
5261
];

‎TwoFactorAuth/Block/Provider/Duo/Auth.php‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,16 @@
11
<?php
22
/**
3-
* Copyright © Magento, Inc. All rights reserved.
4-
* See COPYING.txt for license details.
3+
* Copyright 2020 Adobe
4+
* All Rights Reserved.
55
*/
6+
67
declare(strict_types=1);
78

89
namespace Magento\TwoFactorAuth\Block\Provider\Duo;
910

1011
use Magento\Backend\Block\Template;
1112
use Magento\Backend\Model\Auth\Session;
13+
use Magento\Framework\Exception\LocalizedException;
1214
use Magento\TwoFactorAuth\Model\Provider\Engine\DuoSecurity;
1315

1416
/**
@@ -48,15 +50,14 @@ public function __construct(
4850
*/
4951
public function getJsLayout()
5052
{
51-
$this->jsLayout['components']['tfa-auth']['postUrl'] =
52-
$this->getUrl('*/*/authpost', ['form_key' => $this->getFormKey()]);
53-
54-
$this->jsLayout['components']['tfa-auth']['signature'] =
55-
$this->duoSecurity->getRequestSignature($this->session->getUser());
56-
57-
$this->jsLayout['components']['tfa-auth']['apiHost'] =
58-
$this->duoSecurity->getApiHostname();
59-
53+
$user = $this->session->getUser();
54+
if (!$user) {
55+
throw new LocalizedException(__('User session not found.'));
56+
}
57+
$authUrl = $this->getData('auth_url');
58+
if ($authUrl) {
59+
$this->jsLayout['components']['tfa-auth']['authUrl'] = $authUrl;
60+
}
6061
return parent::getJsLayout();
6162
}
6263
}

‎TwoFactorAuth/Controller/Adminhtml/Duo/Auth.php‎

Lines changed: 44 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,18 @@
11
<?php
22
/**
3-
* Copyright © Magento, Inc. All rights reserved.
4-
* See COPYING.txt for license details.
3+
* Copyright 2020 Adobe
4+
* All Rights Reserved.
55
*/
6+
67
declare(strict_types=1);
78

89
namespace Magento\TwoFactorAuth\Controller\Adminhtml\Duo;
910

1011
use Magento\Backend\Model\Auth\Session;
1112
use Magento\Backend\App\Action;
1213
use Magento\Framework\App\Action\HttpGetActionInterface;
14+
use Magento\Framework\Controller\Result\RedirectFactory;
15+
use Magento\Framework\Message\ManagerInterface;
1316
use Magento\Framework\View\Result\PageFactory;
1417
use Magento\TwoFactorAuth\Api\TfaInterface;
1518
use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
@@ -48,28 +51,46 @@ class Auth extends AbstractAction implements HttpGetActionInterface
4851
*/
4952
private $tokenVerifier;
5053

54+
/**
55+
* @var DuoSecurity
56+
*/
57+
private $duoSecurity;
58+
/**
59+
* @var ManagerInterface
60+
*/
61+
protected $messageManager;
62+
/**
63+
* @var RedirectFactory
64+
*/
65+
protected $resultRedirectFactory;
66+
5167
/**
5268
* @param Action\Context $context
5369
* @param Session $session
5470
* @param PageFactory $pageFactory
5571
* @param UserConfigManagerInterface $userConfigManager
5672
* @param TfaInterface $tfa
5773
* @param HtmlAreaTokenVerifier $tokenVerifier
74+
* @param DuoSecurity $duoSecurity
5875
*/
5976
public function __construct(
6077
Action\Context $context,
6178
Session $session,
6279
PageFactory $pageFactory,
6380
UserConfigManagerInterface $userConfigManager,
6481
TfaInterface $tfa,
65-
HtmlAreaTokenVerifier $tokenVerifier
82+
HtmlAreaTokenVerifier $tokenVerifier,
83+
DuoSecurity $duoSecurity
6684
) {
6785
parent::__construct($context);
6886
$this->tfa = $tfa;
6987
$this->session = $session;
7088
$this->pageFactory = $pageFactory;
7189
$this->userConfigManager = $userConfigManager;
7290
$this->tokenVerifier = $tokenVerifier;
91+
$this->duoSecurity = $duoSecurity;
92+
$this->messageManager = $context->getMessageManager();
93+
$this->resultRedirectFactory = $context->getResultRedirectFactory();
7394
}
7495

7596
/**
@@ -87,8 +108,27 @@ private function getUser()
87108
*/
88109
public function execute()
89110
{
111+
$user = $this->getUser();
112+
if (!$user) {
113+
$this->messageManager->addErrorMessage(__('User session not found.'));
114+
}
90115
$this->userConfigManager->setDefaultProvider((int)$this->getUser()->getId(), DuoSecurity::CODE);
91-
return $this->pageFactory->create();
116+
117+
$username = $this->getUser()->getUserName();
118+
$state = $this->duoSecurity->generateDuoState();
119+
$this->session->setDuoState($state);
120+
$response = $this->duoSecurity->initiateAuth($username, $state);
121+
if ($response['status'] === 'failure') {
122+
// if health check fails, skip the Duo prompt and choose different 2FA.
123+
$this->messageManager->addErrorMessage($response['message']);
124+
}
125+
126+
$resultPage = $this->pageFactory->create();
127+
$block = $resultPage->getLayout()->getBlock('content');
128+
if ($block) {
129+
$block->setData('auth_url', $response['redirect_url']);
130+
}
131+
return $resultPage;
92132
}
93133

94134
/**

0 commit comments

Comments
 (0)