Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP - Modify gauth OTP support to require valid token at registration #4590

Open
wants to merge 106 commits into
base: master
from

Conversation

@hsartoris-bard
Copy link
Contributor

hsartoris-bard commented Jan 3, 2020

Goal
Require users to successfully enter an OTP token before registration is considered completed, preventing users from accidentally locking themselves out. This currently works but is not thoroughly tested.

As is, this is a bit of a hack and involves putting the OTP account object into the authentication event attributes, where it probably shouldn't be. This is because it's necessary during the authentication handler phase. Both issues could be remedied by somehow flagging the entry within the repository, or similar.

In general, this functionality seems pretty necessary to avoid a lot of calls from people who didn't understand the directions during registration. I'm open to, nay, actively interested in ways to refactor this to make a little more sense.

Changes applied

  • updated OTP registration check action to store new account details in more places
  • updated OTP registration view to include collecting a token
  • modified gauth mfa webflow to route token from registration view to authentication handler, and back to registration if authentication fails
  • updated authentication handler to check for new registration in progress and save account details to repository if such an event is detected

Known TODOs

  • fix the tabs
  • at the moment, the save registration action is useless. might factor out.
hsartoris-bard and others added 30 commits Dec 16, 2019
… in my bashrc, and requires that relevant configuration be placed within /etc/cas on the host
… to allow trusted device registration to work when using JSON/in-memory
…e @ConditionalOnClass instead
…e of registration, sending the user back if they fail to register
@stale

This comment has been minimized.

Copy link

stale bot commented Jan 31, 2020

This patch has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

@stale

This comment has been minimized.

Copy link

stale bot commented Feb 7, 2020

This patch has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

@stale

This comment has been minimized.

Copy link

stale bot commented Feb 14, 2020

This patch has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

@stale

This comment has been minimized.

Copy link

stale bot commented Feb 27, 2020

This patch has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

3 participants
You can’t perform that action at this time.