diff --git a/apps/authentication-portal/src/main/resources/org/wso2/carbon/identity/application/authentication/endpoint/i18n/Resources.properties b/apps/authentication-portal/src/main/resources/org/wso2/carbon/identity/application/authentication/endpoint/i18n/Resources.properties index e9685378f25..8270d21a125 100644 --- a/apps/authentication-portal/src/main/resources/org/wso2/carbon/identity/application/authentication/endpoint/i18n/Resources.properties +++ b/apps/authentication-portal/src/main/resources/org/wso2/carbon/identity/application/authentication/endpoint/i18n/Resources.properties @@ -82,8 +82,8 @@ domain=Domain submit=Submit inc=Inc all.rights.reserved=All rights reserved -verification=Verification -touch.your.u2f.device=Touch your FIDO device to Proceed +verification=Authenticate using your Security Key/Biometrics +touch.your.u2f.device=Follow the instructions given by your browser to authenticate yourself using a security key or biometrics in your device. authentication.error=Authentication Error! something.went.wrong.during.authentication=Something went wrong during the authentication process. Please try signing in again. misconfiguration.error=Misconfiguration Error! @@ -231,3 +231,12 @@ authentication.attempt.failed=Authentication attempt failed. authorization.failed=Authorization Failed. provided.username.already.exists=Authentication error! Provided username already exists. error.user.existence=Error while checking the user details. + +fido.failed.instruction=Click on proceed and follow the instructions given by your browser to authenticate yourself using a security key or biometrics in your device. +fido.error=Sign In with security key/biometrics interrupted! +fido.registration.info=Haven’t registered your security key? Register in +fido.learn.more.part.one=Need help? Contact +fido.retry=Retry +fido.proceed=Proceed +fido.cancel=Cancel +fido.authenticator=Security Key diff --git a/apps/authentication-portal/src/main/resources/org/wso2/carbon/identity/application/authentication/endpoint/i18n/Resources_fr_FR.properties b/apps/authentication-portal/src/main/resources/org/wso2/carbon/identity/application/authentication/endpoint/i18n/Resources_fr_FR.properties index 7c4acba9410..8937d256f0d 100644 --- a/apps/authentication-portal/src/main/resources/org/wso2/carbon/identity/application/authentication/endpoint/i18n/Resources_fr_FR.properties +++ b/apps/authentication-portal/src/main/resources/org/wso2/carbon/identity/application/authentication/endpoint/i18n/Resources_fr_FR.properties @@ -82,8 +82,8 @@ domain=Domaine submit=Soumettre inc=Inc all.rights.reserved=Tous droits réservés -verification=Vérification -touch.your.u2f.device=Touchez votre appareil FIDO pour continuer +verification=Authentifiez-vous à l'aide de votre clé de sécurité/données biométriques +touch.your.u2f.device=Suivez les instructions données par votre navigateur pour vous authentifier à l'aide d'une clé de sécurité FIDO2 ou de la biométrie de votre appareil. authentication.error=Erreur d'authentification ! something.went.wrong.during.authentication=Quelque chose s'est mal passé pendant le processus d'authentification. Veuillez essayer de vous connecter à nouveau. misconfiguration.error=Erreur de configuration ! @@ -224,5 +224,17 @@ callback.not.match=Le rappel enregistré ne correspond pas à l'URL fournie. invalid.redirect.uri=L'URI de redirection n'est pas présent dans la demande d'autorisation. authentication.attempt.failed=La tentative d'authentification a échoué. authorization.failed=L'autorisation à échouée. -provided.username.already.exists=Erreur d'authentification ! Le nom d'utilisateur fourni existe dj. -error.user.existence=Erreur lors de la vrification des dtails de l'utilisateur. +provided.username.already.exists=Erreur d'authentification ! Le nom d'utilisateur fourni existe d�j�. +error.user.existence=Erreur lors de la v�rification des d�tails de l'utilisateur. + +fido.failed.instruction=Cliquez sur continuer et suivez les instructions données par votre navigateur pour vous authentifier à l'aide d'une clé de sécurité ou de données biométriques dans votre appareil. +fido.error=Échec de l'authentification à l'aide de votre clé de sécurité/données biométriques +fido.registration.info=Vous devez avoir une clé de sécurité ou des données biométriques enregistrées pour vous connecter. Si ce n'est pas le cas, enregistrez vos clés de sécurité/données biométriques dans l'application Mon compte. +fido.learn.more.part.one=Apprenez-en plus à ce sujet dans notre +fido.learn.more.documentation=documentation +fido.learn.more.part.two=ou contactez votre administrateur +fido.learn.more.part.two.email=ou contactez-nous au +fido.retry=Retenter +fido.proceed=Procéder +fido.cancel=Annuler +fido.authenticator=Connectez-vous avec la clé de sécurité diff --git a/apps/authentication-portal/src/main/webapp/extensions/branding-preferences.jsp b/apps/authentication-portal/src/main/webapp/extensions/branding-preferences.jsp new file mode 100644 index 00000000000..0feac4874f5 --- /dev/null +++ b/apps/authentication-portal/src/main/webapp/extensions/branding-preferences.jsp @@ -0,0 +1,21 @@ +<%-- + ~ Copyright (c) 2022, WSO2 Inc. (http://www.wso2.com) All Rights Reserved. + ~ + ~ WSO2 Inc. licenses this file to you under the Apache License, + ~ Version 2.0 (the "License"); you may not use this file except + ~ in compliance with the License. + ~ You may obtain a copy of the License at + ~ + ~ http://www.apache.org/licenses/LICENSE-2.0 + ~ + ~ Unless required by applicable law or agreed to in writing, + ~ software distributed under the License is distributed on an + ~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + ~ KIND, either express or implied. See the License for the + ~ specific language governing permissions and limitations + ~ under the License. +--%> + +<% + String supportEmail = ""; +%> diff --git a/apps/authentication-portal/src/main/webapp/fido2-auth.jsp b/apps/authentication-portal/src/main/webapp/fido2-auth.jsp index 4d2bf3598ee..3c4bbc32eaf 100644 --- a/apps/authentication-portal/src/main/webapp/fido2-auth.jsp +++ b/apps/authentication-portal/src/main/webapp/fido2-auth.jsp @@ -18,6 +18,8 @@ <%@ page import="org.owasp.encoder.Encode" %> <%@ page import="java.io.File" %> +<%@ page import="org.apache.commons.text.StringEscapeUtils" %> + <%@ page contentType="text/html; charset=UTF-8" pageEncoding="UTF-8" %> <%@include file="includes/localize.jsp" %> @@ -27,6 +29,9 @@ String authRequest = request.getParameter("data"); %> + + + @@ -40,7 +45,7 @@ <% } %> - + <% if (new File(getServletContext().getRealPath("extensions/timeout.jsp")).exists()) { %> @@ -49,8 +54,7 @@ <% } %>
-
- +
<% File productTitleFile = new File(getServletContext().getRealPath("extensions/product-title.jsp")); @@ -61,16 +65,66 @@ <% } %> -
+
+
+

- <%=AuthenticationEndpointUtil.i18n(resourceBundle, "verification")%> + + <%=AuthenticationEndpointUtil.i18n(resourceBundle, "verification" )%> + +

+
+
+
+ +
+
+

+ <%=AuthenticationEndpointUtil.i18n(resourceBundle, "touch.your.u2f.device" )%> +

+ +
+
+ +
- <%=AuthenticationEndpointUtil.i18n(resourceBundle, "touch.your.u2f.device")%> - - - -
+
+
@@ -105,6 +159,42 @@ diff --git a/apps/authentication-portal/src/main/webapp/images/U2F.png b/apps/authentication-portal/src/main/webapp/images/U2F.png index c9d8f3a2706..b7dc797b39c 100644 Binary files a/apps/authentication-portal/src/main/webapp/images/U2F.png and b/apps/authentication-portal/src/main/webapp/images/U2F.png differ diff --git a/apps/authentication-portal/src/main/webapp/login.jsp b/apps/authentication-portal/src/main/webapp/login.jsp index 3f195a9a640..858955dd53f 100644 --- a/apps/authentication-portal/src/main/webapp/login.jsp +++ b/apps/authentication-portal/src/main/webapp/login.jsp @@ -88,7 +88,7 @@ localAuthenticatorNames = Arrays.asList(authList.split(",")); } } - + String multiOptionURIParam = ""; if (localAuthenticatorNames.size() > 1 || idpAuthenticatorMapping != null && idpAuthenticatorMapping.size() > 1) { String baseURL; @@ -100,7 +100,7 @@ request.getRequestDispatcher("error.do").forward(request, response); return; } - + String queryParamString = request.getQueryString() != null ? ("?" + request.getQueryString()) : ""; multiOptionURIParam = "&multiOptionURI=" + Encode.forUriComponent(baseURL + queryParamString); } @@ -156,7 +156,7 @@ // We need to send the tenant domain as a query param only in non tenant qualified URL mode. loginContextRequestUrl += "&tenantDomain=" + Encode.forUriComponent(tenantDomain); } - + String t = request.getParameter("t"); String ut = request.getParameter("ut"); if (StringUtils.isNotBlank(t)) { @@ -372,14 +372,19 @@ if (localAuthenticatorNames.contains(FIDO_AUTHENTICATOR)) { %>
-
<% diff --git a/apps/console/src/extensions/configs/application.tsx b/apps/console/src/extensions/configs/application.tsx index bbedf5353cb..2bc1a0c7400 100644 --- a/apps/console/src/extensions/configs/application.tsx +++ b/apps/console/src/extensions/configs/application.tsx @@ -27,8 +27,8 @@ import { export const applicationConfig: ApplicationConfig = { advancedConfigurations: { showEnableAuthorization: true, - showSaaS: true, - showReturnAuthenticatedIdPs: true + showReturnAuthenticatedIdPs: true, + showSaaS: true }, attributeSettings: { advancedAttributeSettings: { @@ -37,8 +37,8 @@ export const applicationConfig: ApplicationConfig = { showIncludeUserstoreDomainSubject: true, showRoleAttribute: true, showRoleMapping: true, - showUseMappedLocalSubject: true, - showSubjectAttribute: false + showSubjectAttribute: false, + showUseMappedLocalSubject: true }, attributeSelection: { getClaims: (claims: ExtendedClaimInterface[]): ExtendedClaimInterface[] => { @@ -64,26 +64,29 @@ export const applicationConfig: ApplicationConfig = { showProvisioningSettings: true }, inboundOIDCForm: { + disabledGrantTypes: [], shouldValidateCertificate: true, + showBackChannelLogout: true, + showCertificates: true, showClientSecretMessage: true, showFrontChannelLogout: true, - showNativeClientSecretMessage: true, - showScopeValidators: true, showIdTokenEncryption: true, - showBackChannelLogout: true, + showNativeClientSecretMessage: true, showRequestObjectSignatureValidation: true, - showCertificates: true, showReturnAuthenticatedIdPList: true, - disabledGrantTypes: [] + showScopeValidators: true }, inboundSAMLForm: { + artifactBindingAllowed: true, showApplicationQualifier: true, showAttributeConsumingServiceIndex: true, - showQueryRequestProfile: true, - artifactBindingAllowed:true + showQueryRequestProfile: true }, signInMethod: { authenticatorSelection: { + customAuthenticatorAdditionValidation: (): boolean => { + return true; + }, messages: { secondFactorDisabled: null, secondFactorDisabledInFirstStep: null diff --git a/apps/console/src/extensions/configs/identity-provider.tsx b/apps/console/src/extensions/configs/identity-provider.tsx index 8185180a45b..bbc4a6c0f2f 100644 --- a/apps/console/src/extensions/configs/identity-provider.tsx +++ b/apps/console/src/extensions/configs/identity-provider.tsx @@ -17,7 +17,7 @@ */ import { IdentityProviderConfig } from "./models"; -import { IdentityProviderManagementConstants } from "../../features/identity-providers"; +import { AuthenticatorLabels, IdentityProviderManagementConstants } from "../../features/identity-providers"; export const identityProviderConfig: IdentityProviderConfig = { authenticatorResponseExtension: [], @@ -54,6 +54,14 @@ export const identityProviderConfig: IdentityProviderConfig = { oidc: true, saml: true }, + fidoTags: [ + AuthenticatorLabels.SECOND_FACTOR, + AuthenticatorLabels.PASSWORDLESS, + AuthenticatorLabels.MULTI_FACTOR + ], + filterFidoTags:(tags: string[]): string[] => { + return tags; + }, // Handles backward compatibility with the legacy IDP view & new connections view. // TODO: Remove this usage once https://github.com/wso2/product-is/issues/12052 is addressed. useNewConnectionsView: false, diff --git a/apps/console/src/extensions/configs/models/application.ts b/apps/console/src/extensions/configs/models/application.ts index 5dae0b9fa2c..226c010ce7f 100644 --- a/apps/console/src/extensions/configs/models/application.ts +++ b/apps/console/src/extensions/configs/models/application.ts @@ -17,6 +17,7 @@ */ import { ReactNode } from "react"; +import { Dispatch } from "redux"; import { ExtendedClaimInterface, ExtendedExternalClaimInterface, @@ -78,6 +79,11 @@ export interface ApplicationConfig { secondFactorDisabled: ReactNode; secondFactorDisabledInFirstStep: ReactNode; }; + customAuthenticatorAdditionValidation( + authenticatorID: string, + stepIndex: number, + dispatch: Dispatch + ): boolean; }; }; templates: { @@ -90,6 +96,5 @@ export interface ApplicationConfig { }; customApplication: { allowedProtocolTypes: string[]; - } - + }; } diff --git a/apps/console/src/extensions/configs/models/identity-providers.ts b/apps/console/src/extensions/configs/models/identity-providers.ts index 2a0737d2893..8e47a0e2122 100644 --- a/apps/console/src/extensions/configs/models/identity-providers.ts +++ b/apps/console/src/extensions/configs/models/identity-providers.ts @@ -97,6 +97,8 @@ export interface IdentityProviderConfig { saml: boolean; oidc: boolean; } + fidoTags: string[]; + filterFidoTags: (tags: string[]) => string[]; } /** diff --git a/apps/console/src/features/applications/components/settings/sign-on-methods/sign-in-method-customization.tsx b/apps/console/src/features/applications/components/settings/sign-on-methods/sign-in-method-customization.tsx index ada3bfc41db..b483f03878d 100644 --- a/apps/console/src/features/applications/components/settings/sign-on-methods/sign-in-method-customization.tsx +++ b/apps/console/src/features/applications/components/settings/sign-on-methods/sign-in-method-customization.tsx @@ -38,7 +38,7 @@ import { ScriptBasedFlow } from "./script-based-flow"; import { StepBasedFlow } from "./step-based-flow"; import DefaultFlowConfigurationSequenceTemplate from "./templates/default-sequence.json"; import { AppState, ConfigReducerStateInterface, EventPublisher, FeatureConfigInterface } from "../../../../core"; -import { GenericAuthenticatorInterface } from "../../../../identity-providers"; +import { GenericAuthenticatorInterface, IdentityProviderManagementConstants } from "../../../../identity-providers"; import { getRequestPathAuthenticators, updateAuthenticationSequence } from "../../../api"; import { AdaptiveAuthTemplateInterface, @@ -592,6 +592,32 @@ export const SignInMethodCustomization: FunctionComponent