Feature/passwordless auth#1
Merged
Merged
Conversation
* from 5.6.x to 5.7.x * from 5.7.x to 5.8.x * from 5.8.x to 6.x * from 6.x to 7.x * from 7.x to 8.x * updated to work with php7.4 and mysql 8.x Change-Id: I5fa8af21e13ce383d6648a660b1aac7e5ce55fa5 Signed-off-by: smarcet <smarcet@gmail.com>
* Added 3rd party identity providers: * Facebook * Google * Linkedin * Apple * UI changes ( 2 steps login) * ReactJS integration * Webpack Update * Meta Document update (oauth2/.well-known/openid-configuration) * Added provider param on oauth2 flow Depends-On: https://review.opendev.org/c/osf/openstackid/+/772531 Change-Id: I86cef9379fcd6ca5320f080e062fc2abaa36203c
* API endpoints for embedded login flow * unit tests * UI Tweaks * Universal login implementation Signed-off-by: smarcet@gmail.com <smarcet@gmail.com> Change-Id: Ib09f1486f5d9419ee1df64a9d1c41dc7c9a4a65c Depends-on: https://review.opendev.org/c/osf/openstackid/+/791306
Signed-off-by: smarcet@gmail.com <smarcet@gmail.com> Change-Id: I944c822d5295f7f4db767cc14fbab3e76c70b427
Signed-off-by: smarcet@gmail.com <smarcet@gmail.com> Change-Id: Ic20cd65d04526ca88bd17a43348f7f8094a1a663
If user does not have a password, dont askk for current one on set password. Signed-off-by: smarcet@gmail.com <smarcet@gmail.com> Change-Id: Ife77ec609faedee01451b7dbb4c7532834fb5c40
Signed-off-by: smarcet@gmail.com <smarcet@gmail.com> Change-Id: Icf041a470e104a672a5baac72128c0459e7f386a
* added info disclaimer Signed-off-by: smarcet@gmail.com <smarcet@gmail.com> Change-Id: I9fb49841a471e986fdef0ed16d195336bbc0c4af
* updated logo position Signed-off-by: smarcet@gmail.com <smarcet@gmail.com> Change-Id: Ie9a093266e4a442fedea3141271655d27ec32805
Signed-off-by: smarcet@gmail.com <smarcet@gmail.com> Change-Id: Ic58ddea1e18adefd77cf8da529d03feb68adf0dd
Signed-off-by: smarcet@gmail.com <smarcet@gmail.com> Change-Id: I50d95322360b22698dec254f4636ee9dd16af520
Signed-off-by: smarcet@gmail.com <smarcet@gmail.com> Change-Id: I5e0132d612856d4778ce55d73b72ff3db39f3c88
Signed-off-by: smarcet@gmail.com <smarcet@gmail.com> Change-Id: Ifd6b0a96cb07746e4468ab91b9b4857cf46343e6
Signed-off-by: smarcet@gmail.com <smarcet@gmail.com> Change-Id: Id95964cf50bddc72f48dc71e4bccf49f51d207a9
smarcet
added a commit
that referenced
this pull request
Jul 23, 2026
…creen Root cause was two-layered: 1. resetToPasswordFlow() reset authFlow to FLOW.PASSWORD but also cleared user_name/user_pic/user_fullname/user_verified in the same setState call. isPasswordFlow's render condition requires user_verified === true, so wiping it forced the render logic to showDefaultFlow (the email screen) regardless of authFlow being correct. 2. That alone wasn't sufficient: since the password step now submits as a native form POST (see the earlier native-submit fix), the mfa_required transition is a full page reload, not a client-side setState - the React app remounts from scratch and only recovers state the backend flashed to session. issueChallenge() (EmailOTPMFAChallengeStrategy/AbstractMFA ChallengeStrategy) only returns otp_length/otp_lifetime, so challengeRequired()'s session flash never carried username/user_fullname/ user_pic/user_verified in the first place - user_verified was already false the moment the 2FA screen first rendered, before Cancel was ever clicked. Fix #1 alone had nothing to preserve. Fix: postLogin()'s mfa_required branch now merges the same identity fields into the challengeRequired() payload that the AuthenticationException errorLogin() branch already flashes (same fields, same getters: username, user_fullname, user_pic, user_verified, user_is_active) - restoring the identity chip on the 2FA screen and giving resetToPasswordFlow() correct state to preserve. resetToPasswordFlow() no longer clears user_name/user_pic/ user_fullname/user_verified. Verified live: 2FA screen now shows the identity chip from first render: Cancel from the 2FA screen now returns directly to the password screen with the same user still identified, instead of resetting to the email-entry screen. tests/TwoFactorLoginFlowTest.php passes in full (31 tests, 120 assertions) - unaffected, since no test asserted the previously-missing identity fields.
smarcet
added a commit
that referenced
this pull request
Jul 23, 2026
handleDelete() (the login page's identity chip "x") reset client-side state but never called cancelLogin(), unlike the explicit "Cancel" link (resetToPasswordFlow()). During the 2fa/recovery screens this left the pending 2fa_pending_user_id session state and the issued OTP alive server-side until the session TTL, instead of being invalidated immediately like Cancel does. PR #142 review finding #1.
smarcet
added a commit
that referenced
this pull request
Jul 23, 2026
…resh The session stored otp_lifetime as a static duration, so any mid-challenge GET /login re-seeded the countdown with the FULL TTL - a user refreshing 4 minutes into a 5-minute challenge saw a fresh 5:00 countdown for a code the server would reject much sooner, letting them burn the 2fa.rate:verify attempt window (3 failures / 15 min lockout) on a code the UI claimed was still valid. issueChallenge() now also returns otp_issued_at taken from the OTP entity's created_at - the same source isAlive()/getRemainingLifetime() use server-side, so the countdown can never drift from the actual expiry check (a controller-side time() stamp would land after issuance and overstate the remaining window). The timestamp rides the same challengeRequired()/session mechanism as otp_length/otp_lifetime, is kept in sync on resend, cleared with the rest of the MFA UI state, and the blade seeds config.otpLifetime with max(0, lifetime - elapsed). RED verified before the fix: the new reproducer rendered the full TTL (600) instead of the remaining ~500. Full TwoFactorLoginFlowTest suite green: 32 tests, 140 assertions. PR #142 review finding LOW #1.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.