AC-10982::[2FA] Integrate with Duo Web SDK to support Universal Prompt-fixes for SVC and static

Author: glo05363

TwoFactorAuth/Block/Adminhtml/System/Config/Providers.php

@@ -53,7 +53,6 @@ protected function _getElementHtml(AbstractElement $element)
                         'twofactorauth_duo_client_id',
                         'twofactorauth_duo_client_secret',
                         'twofactorauth_duo_api_hostname',
-                        'twofactorauth_duo_failmode',
                         'twofactorauth_duo_integration_key',
                         'twofactorauth_duo_secret_key',
                     ]

TwoFactorAuth/Block/Provider/Duo/Auth.php

@@ -11,12 +11,18 @@
 use Magento\Backend\Block\Template;
 use Magento\Backend\Model\Auth\Session;
 use Magento\Framework\Exception\LocalizedException;
+use Magento\TwoFactorAuth\Model\Provider\Engine\DuoSecurity;
 
 /**
  * @api
  */
 class Auth extends Template
 {
+    /**
+     * @var DuoSecurity
+     */
+    private $duoSecurity;
+
     /**
      * @var Session
      */
@@ -25,14 +31,17 @@ class Auth extends Template
     /**
      * @param Template\Context $context
      * @param Session $session
+     * @param DuoSecurity $duoSecurity
      * @param array $data
      */
     public function __construct(
         Template\Context $context,
         Session $session,
+        DuoSecurity $duoSecurity,
         array $data = []
     ) {
         parent::__construct($context, $data);
+        $this->duoSecurity = $duoSecurity;
         $this->session = $session;
     }
 

TwoFactorAuth/Controller/Adminhtml/Duo/Auth.php

@@ -1,8 +1,9 @@
 <?php
 /**
- * Copyright © Magento, Inc. All rights reserved.
- * See COPYING.txt for license details.
+ * Copyright 2020 Adobe
+ * All Rights Reserved.
  */
+
 declare(strict_types=1);
 
 namespace Magento\TwoFactorAuth\Controller\Adminhtml\Duo;
@@ -117,12 +118,8 @@ public function execute()
         $state = $this->duoSecurity->generateDuoState();
         $this->session->setDuoState($state);
         $response = $this->duoSecurity->initiateAuth($username, $state);
-        if ($response['status'] === 'open') {
-            // If fail mode is "open", skip the Duo prompt.
-            $this->messageManager->addErrorMessage($response['message']);
-        }
-        if ($response['status'] === 'closed') {
-            // If fail mode is "closed", show an error message.
+        if ($response['status'] === 'failure') {
+            // if health check fails, skip the Duo prompt and choose different 2FA.
             $this->messageManager->addErrorMessage($response['message']);
         }
 

TwoFactorAuth/Model/Config/Source/DuoFailmode.php

@@ -57,11 +57,6 @@ class DuoSecurity implements EngineInterface
      */
     public const XML_PATH_SKEY = 'twofactorauth/duo/secret_key';
 
-    /**
-     * Configuration path for Duo Mode
-     */
-    public const DUO_FAILMODE = 'twofactorauth/duo/duo_failmode';
-
     /**
      * @var ScopeConfigInterface
      */
@@ -142,16 +137,6 @@ private function getClientId(): string
         return $this->scopeConfig->getValue(static::XML_PATH_CLIENT_ID);
     }
 
-    /**
-     * Get Duo Mode
-     *
-     * @return string
-     */
-    public function getDuoFailmode(): string
-    {
-        return strtoupper($this->scopeConfig->getValue(static::DUO_FAILMODE));
-    }
-
     /**
      * Get callback URL
      *
@@ -241,27 +226,14 @@ public function isEnabled(): bool
      */
     public function initiateAuth($username, string $state): array
     {
-        $duoFailMode = $this->getDuoFailmode();
         try {
             $this->healthCheck();
         } catch (DuoException $e) {
-            if ($duoFailMode === "OPEN") {
-                return [
-                    'status' => 'open',
-                    'redirect_url' => '',
-                    'message' => __(
-                        "Login 'applicable',
-                    but 2FA Not Performed. Switch to other 2FA Provider.
-                    Confirm Duo client/secret/host values are correct"
-                    )
-                ];
-            } else {
                 return [
-                    'status' => 'closed',
+                    'status' => 'failure',
                     'redirect_url' => '',
                     'message' => __("2FA Unavailable. Confirm Duo client/secret/host values are correct")
                 ];
-            }
         }
 
         return [

TwoFactorAuth/Model/Provider/Engine/DuoSecurity.php

@@ -52,7 +52,6 @@ public function testTokenAccess(): void
      * @magentoConfigFixture default/twofactorauth/duo/integration_key abc123
      * @magentoConfigFixture default/twofactorauth/duo/api_hostname test.duosecurity.com
      * @magentoConfigFixture default/twofactorauth/duo/secret_key abc123
-     * @magentoConfigFixture default/twofactorauth/duo/duo_failmode open
      * phpcs:disable Generic.CodeAnalysis.UselessOverridingMethod
      */
     public function testAclHasAccess()
@@ -68,7 +67,6 @@ public function testAclHasAccess()
      * @magentoConfigFixture default/twofactorauth/duo/integration_key abc123
      * @magentoConfigFixture default/twofactorauth/duo/api_hostname test.duosecurity.com
      * @magentoConfigFixture default/twofactorauth/duo/secret_key abc123
-     * @magentoConfigFixture default/twofactorauth/duo/duo_failmode open
      * phpcs:disable Generic.CodeAnalysis.UselessOverridingMethod
      */
     public function testAclNoAccess()

TwoFactorAuth/Test/Integration/Controller/Adminhtml/Duo/AuthTest.php

@@ -78,11 +78,6 @@
                     <label>API hostname</label>
                     <backend_model>Magento\TwoFactorAuth\Model\Config\Backend\Duo\ApiHostname</backend_model>
                 </field>
-                <field id="duo_failmode" translate="label comment" type="select" sortOrder="50" showInDefault="1"
-                       showInWebsite="0" showInStore="0">
-                    <label>Duo Failmode</label>
-                    <source_model>Magento\TwoFactorAuth\Model\Config\Source\DuoFailmode</source_model>
-                </field>
                 <field id="integration_key" translate="label comment" type="text" sortOrder="60" showInDefault="1"
                        showInWebsite="0" showInStore="0">
                     <label>Integration Key</label>