* stages/authenticator_duo: initial duo stage

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* stages/authenticator_duo: improve setup

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* stages/authenticator_validate: add Duo support

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* flows: make use of oneOf OpenAPI to annotate all challenge types

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* outpost: update to new api schema

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* outposts/ldap: fix client usage

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* outposts/ldap: return user info when user can't search

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* web: fix linting error

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* stages: fix stage unittests

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* flows: add default challenge response

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* web/flows: update types

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* flows: fix mismatched names

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* website/docs: add duo docs

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* stages/authenticator_duo: add missing duo device

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* web/admin: fix enable buttons missing on stages

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* stages/prompt: annotate PromptChallengeResponse's additionalProperties

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* web/flows: improve logging

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* tests/e2e: fix flow titles not being set

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* tests/e2e: fix invalid flows

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* api: fix error when authorization header has no spaces

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* stages/user_write: handle integrity error

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* outposts: handle disconnects without outpost better

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* flows: allow blank on WithUserInfo

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
This commit is contained in:
Jens L 2021-05-25 13:35:59 +02:00 committed by GitHub
commit 250e23408e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
108 changed files with 3170 additions and 626 deletions

View file

@ -56,7 +56,7 @@ gen-outpost:
-i /local/schema.yml \ -i /local/schema.yml \
-g go \ -g go \
-o /local/outpost/api \ -o /local/outpost/api \
--additional-properties=packageName=api,enumClassPrefix=true --additional-properties=packageName=api,enumClassPrefix=true,useOneOfDiscriminatorLookup=true
rm -f outpost/api/go.mod outpost/api/go.sum rm -f outpost/api/go.mod outpost/api/go.sum
gen: gen-build gen-clean gen-web gen-outpost gen: gen-build gen-clean gen-web gen-outpost

View file

@ -44,6 +44,7 @@ urllib3 = {extras = ["secure"],version = "*"}
uvicorn = {extras = ["standard"],version = "*"} uvicorn = {extras = ["standard"],version = "*"}
webauthn = "*" webauthn = "*"
xmlsec = "*" xmlsec = "*"
duo-client = "*"
[requires] [requires]
python_version = "3.9" python_version = "3.9"

100
Pipfile.lock generated
View file

@ -1,7 +1,7 @@
{ {
"_meta": { "_meta": {
"hash": { "hash": {
"sha256": "61354b75aa954ea0a995ee1909b861092a4be5c1af66d3c00c7c7845e056d064" "sha256": "eb043e24ba05d5d78459a973fe0cd7c37dad1cca90431f68b6df773247c58cbb"
}, },
"pipfile-spec": 6, "pipfile-spec": 6,
"requires": { "requires": {
@ -56,6 +56,7 @@
"sha256:f881853d2643a29e643609da57b96d5f9c9b93f62429dcc1cbb413c7d07f0e1a", "sha256:f881853d2643a29e643609da57b96d5f9c9b93f62429dcc1cbb413c7d07f0e1a",
"sha256:fe60131d21b31fd1a14bd43e6bb88256f69dfc3188b3a89d736d6c71ed43ec95" "sha256:fe60131d21b31fd1a14bd43e6bb88256f69dfc3188b3a89d736d6c71ed43ec95"
], ],
"markers": "python_version >= '3.6'",
"version": "==3.7.4.post0" "version": "==3.7.4.post0"
}, },
"aioredis": { "aioredis": {
@ -70,6 +71,7 @@
"sha256:03e16e94f2b34c31f8bf1206d8ddd3ccaa4c315f7f6a1879b7b1210d229568c2", "sha256:03e16e94f2b34c31f8bf1206d8ddd3ccaa4c315f7f6a1879b7b1210d229568c2",
"sha256:493a2ac6788ce270a2f6a765b017299f60c1998f5a8617908ee9be082f7300fb" "sha256:493a2ac6788ce270a2f6a765b017299f60c1998f5a8617908ee9be082f7300fb"
], ],
"markers": "python_version >= '3.6'",
"version": "==5.0.6" "version": "==5.0.6"
}, },
"asgiref": { "asgiref": {
@ -77,6 +79,7 @@
"sha256:92906c611ce6c967347bbfea733f13d6313901d54dcca88195eaeb52b2a8e8ee", "sha256:92906c611ce6c967347bbfea733f13d6313901d54dcca88195eaeb52b2a8e8ee",
"sha256:d1216dfbdfb63826470995d31caed36225dcaf34f182e0fa257a4dd9e86f1b78" "sha256:d1216dfbdfb63826470995d31caed36225dcaf34f182e0fa257a4dd9e86f1b78"
], ],
"markers": "python_version >= '3.6'",
"version": "==3.3.4" "version": "==3.3.4"
}, },
"async-timeout": { "async-timeout": {
@ -84,6 +87,7 @@
"sha256:0c3c816a028d47f659d6ff5c745cb2acf1f966da1fe5c19c77a70282b25f4c5f", "sha256:0c3c816a028d47f659d6ff5c745cb2acf1f966da1fe5c19c77a70282b25f4c5f",
"sha256:4291ca197d287d274d0b6cb5d6f8f8f82d434ed288f962539ff18cc9012f9ea3" "sha256:4291ca197d287d274d0b6cb5d6f8f8f82d434ed288f962539ff18cc9012f9ea3"
], ],
"markers": "python_full_version >= '3.5.3'",
"version": "==3.0.1" "version": "==3.0.1"
}, },
"attrs": { "attrs": {
@ -91,6 +95,7 @@
"sha256:149e90d6d8ac20db7a955ad60cf0e6881a3f20d37096140088356da6c716b0b1", "sha256:149e90d6d8ac20db7a955ad60cf0e6881a3f20d37096140088356da6c716b0b1",
"sha256:ef6aaac3ca6cd92904cdd0d83f629a15f18053ec84e6432106f7a4d04ae4f5fb" "sha256:ef6aaac3ca6cd92904cdd0d83f629a15f18053ec84e6432106f7a4d04ae4f5fb"
], ],
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'",
"version": "==21.2.0" "version": "==21.2.0"
}, },
"autobahn": { "autobahn": {
@ -98,6 +103,7 @@
"sha256:9195df8af03b0ff29ccd4b7f5abbde957ee90273465942205f9a1bad6c3f07ac", "sha256:9195df8af03b0ff29ccd4b7f5abbde957ee90273465942205f9a1bad6c3f07ac",
"sha256:e126c1f583e872fb59e79d36977cfa1f2d0a8a79f90ae31f406faae7664b8e03" "sha256:e126c1f583e872fb59e79d36977cfa1f2d0a8a79f90ae31f406faae7664b8e03"
], ],
"markers": "python_version >= '3.7'",
"version": "==21.3.1" "version": "==21.3.1"
}, },
"automat": { "automat": {
@ -127,6 +133,7 @@
"sha256:7518c3f028123f2c770cf1e568f24877259e0ec03badef657174fa93392a9e6a", "sha256:7518c3f028123f2c770cf1e568f24877259e0ec03badef657174fa93392a9e6a",
"sha256:b69c96f210a79f544c6dea923f708873121c174b8b4d72babd725328bf53e3d2" "sha256:b69c96f210a79f544c6dea923f708873121c174b8b4d72babd725328bf53e3d2"
], ],
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'",
"version": "==1.20.79" "version": "==1.20.79"
}, },
"cachetools": { "cachetools": {
@ -134,6 +141,7 @@
"sha256:2cc0b89715337ab6dbba85b5b50effe2b0c74e035d83ee8ed637cf52f12ae001", "sha256:2cc0b89715337ab6dbba85b5b50effe2b0c74e035d83ee8ed637cf52f12ae001",
"sha256:61b5ed1e22a0924aed1d23b478f37e8d52549ff8a961de2909c69bf950020cff" "sha256:61b5ed1e22a0924aed1d23b478f37e8d52549ff8a961de2909c69bf950020cff"
], ],
"markers": "python_version ~= '3.5'",
"version": "==4.2.2" "version": "==4.2.2"
}, },
"cbor2": { "cbor2": {
@ -152,6 +160,7 @@
"sha256:f0058d33b5eaffb176d6190d175a5391f13362f165881deea2b99e63b66ecf55", "sha256:f0058d33b5eaffb176d6190d175a5391f13362f165881deea2b99e63b66ecf55",
"sha256:f5df0ad8c16f7992bf24e5c9a53f03a11a990fd18253c3c335315bd25a34f832" "sha256:f5df0ad8c16f7992bf24e5c9a53f03a11a990fd18253c3c335315bd25a34f832"
], ],
"markers": "python_version >= '3.6'",
"version": "==5.3.0" "version": "==5.3.0"
}, },
"celery": { "celery": {
@ -244,6 +253,7 @@
"sha256:0d6f53a15db4120f2b08c94f11e7d93d2c911ee118b6b30a04ec3ee8310179fa", "sha256:0d6f53a15db4120f2b08c94f11e7d93d2c911ee118b6b30a04ec3ee8310179fa",
"sha256:f864054d66fd9118f2e67044ac8981a54775ec5b67aed0441892edb553d21da5" "sha256:f864054d66fd9118f2e67044ac8981a54775ec5b67aed0441892edb553d21da5"
], ],
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'",
"version": "==4.0.0" "version": "==4.0.0"
}, },
"click": { "click": {
@ -251,6 +261,7 @@
"sha256:d2b5255c7c6349bc1bd1e59e08cd12acbbd63ce649f2588755783aa94dfb6b1a", "sha256:d2b5255c7c6349bc1bd1e59e08cd12acbbd63ce649f2588755783aa94dfb6b1a",
"sha256:dacca89f4bfadd5de3d7489b7c8a566eee0d3676333fbb50030263894c38c0dc" "sha256:dacca89f4bfadd5de3d7489b7c8a566eee0d3676333fbb50030263894c38c0dc"
], ],
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'",
"version": "==7.1.2" "version": "==7.1.2"
}, },
"click-didyoumean": { "click-didyoumean": {
@ -310,6 +321,7 @@
"sha256:76ffae916ba3aa66b46996c14fa713e46004788167a4873d647544e750e0e99f", "sha256:76ffae916ba3aa66b46996c14fa713e46004788167a4873d647544e750e0e99f",
"sha256:a9af943c79717bc52fe64a3c236ae5d3adccc8b5be19c881b442d2c3db233393" "sha256:a9af943c79717bc52fe64a3c236ae5d3adccc8b5be19c881b442d2c3db233393"
], ],
"markers": "python_version >= '3.6'",
"version": "==3.0.2" "version": "==3.0.2"
}, },
"defusedxml": { "defusedxml": {
@ -420,6 +432,14 @@
"index": "pypi", "index": "pypi",
"version": "==0.16.0" "version": "==0.16.0"
}, },
"duo-client": {
"hashes": [
"sha256:790de9573e2a0a85cc10cdb671b37759ee5f6c8557fe9972a8837bb07d71f69b",
"sha256:a5c9282cba3a02ae2ffbb16552e66379c19272664561baec86ad3a661f26ebf2"
],
"index": "pypi",
"version": "==4.3.1"
},
"facebook-sdk": { "facebook-sdk": {
"hashes": [ "hashes": [
"sha256:2e987b3e0f466a6f4ee77b935eb023dba1384134f004a2af21f1cfff7fe0806e", "sha256:2e987b3e0f466a6f4ee77b935eb023dba1384134f004a2af21f1cfff7fe0806e",
@ -432,6 +452,7 @@
"hashes": [ "hashes": [
"sha256:b1bead90b70cf6ec3f0710ae53a525360fa360d306a86583adc6bf83a4db537d" "sha256:b1bead90b70cf6ec3f0710ae53a525360fa360d306a86583adc6bf83a4db537d"
], ],
"markers": "python_version >= '2.6' and python_version not in '3.0, 3.1, 3.2, 3.3'",
"version": "==0.18.2" "version": "==0.18.2"
}, },
"geoip2": { "geoip2": {
@ -447,6 +468,7 @@
"sha256:044d81b1e58012f8ebc71cc134e191c1fa312f543f1fbc99973afe28c25e3228", "sha256:044d81b1e58012f8ebc71cc134e191c1fa312f543f1fbc99973afe28c25e3228",
"sha256:b3ca7a8ff9ab3bdefee3ad5aefb11fc6485423767eee016f5942d8e606ca23fb" "sha256:b3ca7a8ff9ab3bdefee3ad5aefb11fc6485423767eee016f5942d8e606ca23fb"
], ],
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'",
"version": "==1.30.1" "version": "==1.30.1"
}, },
"gunicorn": { "gunicorn": {
@ -462,6 +484,7 @@
"sha256:36a3cb8c0a032f56e2da7084577878a035d3b61d104230d4bd49c0c6b555a9c6", "sha256:36a3cb8c0a032f56e2da7084577878a035d3b61d104230d4bd49c0c6b555a9c6",
"sha256:47222cb6067e4a307d535814917cd98fd0a57b6788ce715755fa2b6c28b56042" "sha256:47222cb6067e4a307d535814917cd98fd0a57b6788ce715755fa2b6c28b56042"
], ],
"markers": "python_version >= '3.6'",
"version": "==0.12.0" "version": "==0.12.0"
}, },
"hiredis": { "hiredis": {
@ -508,6 +531,7 @@
"sha256:f52010e0a44e3d8530437e7da38d11fb822acfb0d5b12e9cd5ba655509937ca0", "sha256:f52010e0a44e3d8530437e7da38d11fb822acfb0d5b12e9cd5ba655509937ca0",
"sha256:f8196f739092a78e4f6b1b2172679ed3343c39c61a3e9d722ce6fcf1dac2824a" "sha256:f8196f739092a78e4f6b1b2172679ed3343c39c61a3e9d722ce6fcf1dac2824a"
], ],
"markers": "python_version >= '3.6'",
"version": "==2.0.0" "version": "==2.0.0"
}, },
"httptools": { "httptools": {
@ -556,6 +580,7 @@
"sha256:1a29730d366e996aaacffb2f1f1cb9593dc38e2ddd30c91250c6dde09ea9b417", "sha256:1a29730d366e996aaacffb2f1f1cb9593dc38e2ddd30c91250c6dde09ea9b417",
"sha256:f38b2b640938a4f35ade69ac3d053042959b62a0f1076a5bbaa1b9526605a8a2" "sha256:f38b2b640938a4f35ade69ac3d053042959b62a0f1076a5bbaa1b9526605a8a2"
], ],
"markers": "python_version >= '3.5'",
"version": "==0.5.1" "version": "==0.5.1"
}, },
"jmespath": { "jmespath": {
@ -563,6 +588,7 @@
"sha256:b85d0567b8666149a93172712e68920734333c0ce7e89b78b3e987f71e5ed4f9", "sha256:b85d0567b8666149a93172712e68920734333c0ce7e89b78b3e987f71e5ed4f9",
"sha256:cdf6525904cc597730141d61b36f2e4b8ecc257c420fa2f4549bac2c2d0cb72f" "sha256:cdf6525904cc597730141d61b36f2e4b8ecc257c420fa2f4549bac2c2d0cb72f"
], ],
"markers": "python_version >= '2.6' and python_version not in '3.0, 3.1, 3.2, 3.3'",
"version": "==0.10.0" "version": "==0.10.0"
}, },
"jsonschema": { "jsonschema": {
@ -577,6 +603,7 @@
"sha256:01481d99f4606f6939cdc9b637264ed353ee9e3e4f62cfb582324142c41a572d", "sha256:01481d99f4606f6939cdc9b637264ed353ee9e3e4f62cfb582324142c41a572d",
"sha256:e2dedd8a86c9077c350555153825a31e456a0dc20c15d5751f00137ec9c75f0a" "sha256:e2dedd8a86c9077c350555153825a31e456a0dc20c15d5751f00137ec9c75f0a"
], ],
"markers": "python_version >= '3.6'",
"version": "==5.1.0" "version": "==5.1.0"
}, },
"kubernetes": { "kubernetes": {
@ -590,7 +617,10 @@
"ldap3": { "ldap3": {
"hashes": [ "hashes": [
"sha256:18c3ee656a6775b9b0d60f7c6c5b094d878d1d90fc03d56731039f0a4b546a91", "sha256:18c3ee656a6775b9b0d60f7c6c5b094d878d1d90fc03d56731039f0a4b546a91",
"sha256:c1df41d89459be6f304e0ceec4b00fdea533dbbcd83c802b1272dcdb94620b57" "sha256:4139c91f0eef9782df7b77c8cbc6243086affcb6a8a249b768a9658438e5da59",
"sha256:8c949edbad2be8a03e719ba48bd6779f327ec156929562814b3e84ab56889c8c",
"sha256:c1df41d89459be6f304e0ceec4b00fdea533dbbcd83c802b1272dcdb94620b57",
"sha256:afc6fc0d01f02af82cd7bfabd3bbfd5dc96a6ae91e97db0a2dab8a0f1b436056"
], ],
"index": "pypi", "index": "pypi",
"version": "==2.9" "version": "==2.9"
@ -651,6 +681,7 @@
"hashes": [ "hashes": [
"sha256:47e86a084dd814fac88c99ea34ba3278a74bc9de5a25f4b815b608798747c7dc" "sha256:47e86a084dd814fac88c99ea34ba3278a74bc9de5a25f4b815b608798747c7dc"
], ],
"markers": "python_version >= '3.6'",
"version": "==2.0.3" "version": "==2.0.3"
}, },
"msgpack": { "msgpack": {
@ -726,6 +757,7 @@
"sha256:f21756997ad8ef815d8ef3d34edd98804ab5ea337feedcd62fb52d22bf531281", "sha256:f21756997ad8ef815d8ef3d34edd98804ab5ea337feedcd62fb52d22bf531281",
"sha256:fc13a9524bc18b6fb6e0dbec3533ba0496bbed167c56d0aabefd965584557d80" "sha256:fc13a9524bc18b6fb6e0dbec3533ba0496bbed167c56d0aabefd965584557d80"
], ],
"markers": "python_version >= '3.6'",
"version": "==5.1.0" "version": "==5.1.0"
}, },
"oauthlib": { "oauthlib": {
@ -733,6 +765,7 @@
"sha256:bee41cc35fcca6e988463cacc3bcb8a96224f470ca547e697b604cc697b2f889", "sha256:bee41cc35fcca6e988463cacc3bcb8a96224f470ca547e697b604cc697b2f889",
"sha256:df884cd6cbe20e32633f1db1072e9356f53638e4361bef4e8b03c9127c9328ea" "sha256:df884cd6cbe20e32633f1db1072e9356f53638e4361bef4e8b03c9127c9328ea"
], ],
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
"version": "==3.1.0" "version": "==3.1.0"
}, },
"packaging": { "packaging": {
@ -748,6 +781,7 @@
"sha256:030e4f9df5f53db2292eec37c6255957eb76168c6f974e4176c711cf91ed34aa", "sha256:030e4f9df5f53db2292eec37c6255957eb76168c6f974e4176c711cf91ed34aa",
"sha256:b6c5a9643e3545bcbfd9451766cbaa5d9c67e7303c7bc32c750b6fa70ecb107d" "sha256:b6c5a9643e3545bcbfd9451766cbaa5d9c67e7303c7bc32c750b6fa70ecb107d"
], ],
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
"version": "==0.10.1" "version": "==0.10.1"
}, },
"prompt-toolkit": { "prompt-toolkit": {
@ -755,6 +789,7 @@
"sha256:bf00f22079f5fadc949f42ae8ff7f05702826a97059ffcc6281036ad40ac6f04", "sha256:bf00f22079f5fadc949f42ae8ff7f05702826a97059ffcc6281036ad40ac6f04",
"sha256:e1b4f11b9336a28fa11810bc623c357420f69dfdb6d2dac41ca2c21a55c033bc" "sha256:e1b4f11b9336a28fa11810bc623c357420f69dfdb6d2dac41ca2c21a55c033bc"
], ],
"markers": "python_full_version >= '3.6.1'",
"version": "==3.0.18" "version": "==3.0.18"
}, },
"psycopg2-binary": { "psycopg2-binary": {
@ -800,15 +835,37 @@
}, },
"pyasn1": { "pyasn1": {
"hashes": [ "hashes": [
"sha256:99fcc3c8d804d1bc6d9a099921e39d827026409a58f2a720dcdb89374ea0c776",
"sha256:03840c999ba71680a131cfaee6fab142e1ed9bbd9c693e285cc6aca0d555e576",
"sha256:6e7545f1a61025a4e58bb336952c5061697da694db1cae97b116e9c46abcf7c8",
"sha256:014c0e9976956a08139dc0712ae195324a75e142284d5f87f1a87ee1b068a359",
"sha256:7ab8a544af125fb704feadb008c99a88805126fb525280b2270bb25cc1d78a12",
"sha256:aef77c9fb94a3ac588e87841208bdec464471d9871bd5050a287cc9a475cd0ba",
"sha256:78fa6da68ed2727915c4767bb386ab32cdba863caa7dbe473eaae45f9959da86",
"sha256:e89bf84b5437b532b0803ba5c9a5e054d21fec423a89952a74f87fa2c9b7bce2",
"sha256:0458773cfe65b153891ac249bcf1b5f8f320b7c2ce462151f8fa74de8934becf",
"sha256:5c9414dcfede6e441f7e8f81b43b34e834731003427e5b09e4e00e3172a10f00",
"sha256:fec3e9d8e36808a28efb59b489e4528c10ad0f480e57dcc32b4de5c9d8c9fdf3",
"sha256:39c7e2ec30515947ff4e87fb6f456dfc6e84857d34be479c9d4a4ba4bf46aa5d", "sha256:39c7e2ec30515947ff4e87fb6f456dfc6e84857d34be479c9d4a4ba4bf46aa5d",
"sha256:aef77c9fb94a3ac588e87841208bdec464471d9871bd5050a287cc9a475cd0ba" "sha256:08c3c53b75eaa48d71cf8c710312316392ed40899cb34710d092e96745a358b7"
], ],
"version": "==0.4.8" "version": "==0.4.8"
}, },
"pyasn1-modules": { "pyasn1-modules": {
"hashes": [ "hashes": [
"sha256:cbac4bc38d117f2a49aeedec4407d23e8866ea4ac27ff2cf7fb3e5b570df19e0",
"sha256:f39edd8c4ecaa4556e989147ebf219227e2cd2e8a43c7e7fcb1f1c18c5fd6a3d",
"sha256:a50b808ffeb97cb3601dd25981f6b016cbb3d31fbf57a8b8a87428e6158d0c74",
"sha256:426edb7a5e8879f1ec54a1864f16b882c2837bfd06eee62f2c982315ee2473ed",
"sha256:0fe1b68d1e486a1ed5473f1302bd991c1611d319bba158e98b106ff86e1d7199",
"sha256:a99324196732f53093a84c4369c996713eb8c89d360a496b599fb1a9c47fc3eb",
"sha256:c29a5e5cc7a3f05926aff34e097e84f8589cd790ce0ed41b67aed6857b26aafd",
"sha256:15b7c67fabc7fc240d87fb9aabf999cf82311a6d6fb2c70d00d3d0604878c811",
"sha256:0845a5582f6a02bb3e1bde9ecfc4bfcae6ec3210dd270522fee602365430c3f8",
"sha256:905f84c712230b2c592c19470d3ca8d552de726050d1d1716282a1f6146be65e", "sha256:905f84c712230b2c592c19470d3ca8d552de726050d1d1716282a1f6146be65e",
"sha256:a50b808ffeb97cb3601dd25981f6b016cbb3d31fbf57a8b8a87428e6158d0c74" "sha256:65cebbaffc913f4fe9e4808735c95ea22d7a7775646ab690518c056784bc21b4",
"sha256:b80486a6c77252ea3a3e9b1e360bc9cf28eaac41263d173c032581ad2f20fe45",
"sha256:fe0644d9ab041506b62782e92b06b8c68cca799e1a9636ec398675459e031405"
], ],
"version": "==0.2.8" "version": "==0.2.8"
}, },
@ -817,6 +874,7 @@
"sha256:2d475327684562c3a96cc71adf7dc8c4f0565175cf86b6d7a404ff4c771f15f0", "sha256:2d475327684562c3a96cc71adf7dc8c4f0565175cf86b6d7a404ff4c771f15f0",
"sha256:7582ad22678f0fcd81102833f60ef8d0e57288b6b5fb00323d101be910e35705" "sha256:7582ad22678f0fcd81102833f60ef8d0e57288b6b5fb00323d101be910e35705"
], ],
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
"version": "==2.20" "version": "==2.20"
}, },
"pycryptodome": { "pycryptodome": {
@ -860,6 +918,7 @@
"sha256:412e00137858f04bde0729913874a48485665f2d36fe9ee449f26be864af9316", "sha256:412e00137858f04bde0729913874a48485665f2d36fe9ee449f26be864af9316",
"sha256:7ead136e03655af85069b6f47b23eb7c3e5c221aa9f022a4fbb499f5b7308f29" "sha256:7ead136e03655af85069b6f47b23eb7c3e5c221aa9f022a4fbb499f5b7308f29"
], ],
"markers": "python_version >= '3.5'",
"version": "==2.0.2" "version": "==2.0.2"
}, },
"pyjwt": { "pyjwt": {
@ -882,12 +941,14 @@
"sha256:c203ec8783bf771a155b207279b9bccb8dea02d8f0c9e5f8ead507bc3246ecc1", "sha256:c203ec8783bf771a155b207279b9bccb8dea02d8f0c9e5f8ead507bc3246ecc1",
"sha256:ef9d7589ef3c200abe66653d3f1ab1033c3c419ae9b9bdb1240a85b024efc88b" "sha256:ef9d7589ef3c200abe66653d3f1ab1033c3c419ae9b9bdb1240a85b024efc88b"
], ],
"markers": "python_version >= '2.6' and python_version not in '3.0, 3.1, 3.2, 3.3'",
"version": "==2.4.7" "version": "==2.4.7"
}, },
"pyrsistent": { "pyrsistent": {
"hashes": [ "hashes": [
"sha256:2e636185d9eb976a18a8a8e96efce62f2905fea90041958d8cc2a189756ebf3e" "sha256:2e636185d9eb976a18a8a8e96efce62f2905fea90041958d8cc2a189756ebf3e"
], ],
"markers": "python_version >= '3.5'",
"version": "==0.17.3" "version": "==0.17.3"
}, },
"python-dateutil": { "python-dateutil": {
@ -895,6 +956,7 @@
"sha256:73ebfe9dbf22e832286dafa60473e4cd239f8592f699aa5adaf10050e6e1823c", "sha256:73ebfe9dbf22e832286dafa60473e4cd239f8592f699aa5adaf10050e6e1823c",
"sha256:75bb3f31ea686f1197762692a9ee6a7550b59fc6ca3a1f4b5d7e32fb98e2da2a" "sha256:75bb3f31ea686f1197762692a9ee6a7550b59fc6ca3a1f4b5d7e32fb98e2da2a"
], ],
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
"version": "==2.8.1" "version": "==2.8.1"
}, },
"python-dotenv": { "python-dotenv": {
@ -951,6 +1013,7 @@
"sha256:0e7e0cfca8660dea8b7d5cd8c4f6c5e29e11f31158c0b0ae91a397f00e5a05a2", "sha256:0e7e0cfca8660dea8b7d5cd8c4f6c5e29e11f31158c0b0ae91a397f00e5a05a2",
"sha256:432b788c4530cfe16d8d943a09d40ca6c16149727e4afe8c2c9d5580c59d9f24" "sha256:432b788c4530cfe16d8d943a09d40ca6c16149727e4afe8c2c9d5580c59d9f24"
], ],
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'",
"version": "==3.5.3" "version": "==3.5.3"
}, },
"requests": { "requests": {
@ -958,12 +1021,14 @@
"sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804", "sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
"sha256:c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e" "sha256:c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e"
], ],
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'",
"version": "==2.25.1" "version": "==2.25.1"
}, },
"requests-oauthlib": { "requests-oauthlib": {
"hashes": [ "hashes": [
"sha256:b4261601a71fd721a8bd6d7aa1cc1d6a8a93b4a9f5e96626f8e4d91e8beeaa6a",
"sha256:7f71572defaecd16372f9006f33c2ec8c077c3cfa6f5911a9a90202beb513f3d", "sha256:7f71572defaecd16372f9006f33c2ec8c077c3cfa6f5911a9a90202beb513f3d",
"sha256:b4261601a71fd721a8bd6d7aa1cc1d6a8a93b4a9f5e96626f8e4d91e8beeaa6a" "sha256:fa6c47b933f01060936d87ae9327fead68768b69c6c9ea2109c48be30f2d4dbc"
], ],
"index": "pypi", "index": "pypi",
"version": "==1.3.0" "version": "==1.3.0"
@ -1004,6 +1069,7 @@
"sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926", "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926",
"sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254" "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
], ],
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
"version": "==1.16.0" "version": "==1.16.0"
}, },
"sqlparse": { "sqlparse": {
@ -1011,6 +1077,7 @@
"sha256:017cde379adbd6a1f15a61873f43e8274179378e95ef3fede90b5aa64d304ed0", "sha256:017cde379adbd6a1f15a61873f43e8274179378e95ef3fede90b5aa64d304ed0",
"sha256:0f91fd2e829c44362cbcfab3e9ae12e22badaa8a29ad5ff599f9ec109f0454e8" "sha256:0f91fd2e829c44362cbcfab3e9ae12e22badaa8a29ad5ff599f9ec109f0454e8"
], ],
"markers": "python_version >= '3.5'",
"version": "==0.4.1" "version": "==0.4.1"
}, },
"structlog": { "structlog": {
@ -1066,6 +1133,7 @@
"sha256:7d6f89745680233f1c4db9ddb748df5e88d2a7a37962be174c0fd04c8dba1dc8", "sha256:7d6f89745680233f1c4db9ddb748df5e88d2a7a37962be174c0fd04c8dba1dc8",
"sha256:c16b55f9a67b2419cfdf8846576e2ec9ba94fe6978a83080c352a80db31c93fb" "sha256:c16b55f9a67b2419cfdf8846576e2ec9ba94fe6978a83080c352a80db31c93fb"
], ],
"markers": "python_version >= '3.6'",
"version": "==21.2.1" "version": "==21.2.1"
}, },
"typing-extensions": { "typing-extensions": {
@ -1081,6 +1149,7 @@
"sha256:07620c3f3f8eed1f12600845892b0e036a2420acf513c53f7de0abd911a5894f", "sha256:07620c3f3f8eed1f12600845892b0e036a2420acf513c53f7de0abd911a5894f",
"sha256:5af8ad10cec94f215e3f48112de2022e1d5a37ed427fbd88652fa908f2ab7cae" "sha256:5af8ad10cec94f215e3f48112de2022e1d5a37ed427fbd88652fa908f2ab7cae"
], ],
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
"version": "==3.0.1" "version": "==3.0.1"
}, },
"urllib3": { "urllib3": {
@ -1125,6 +1194,7 @@
"sha256:4c9dceab6f76ed92105027c49c823800dd33cacce13bdedc5b914e3514b7fb30", "sha256:4c9dceab6f76ed92105027c49c823800dd33cacce13bdedc5b914e3514b7fb30",
"sha256:7d3b1624a953da82ef63462013bbd271d3eb75751489f9807598e8f340bd637e" "sha256:7d3b1624a953da82ef63462013bbd271d3eb75751489f9807598e8f340bd637e"
], ],
"markers": "python_version >= '3.6'",
"version": "==5.0.0" "version": "==5.0.0"
}, },
"watchgod": { "watchgod": {
@ -1154,6 +1224,7 @@
"sha256:3e2bf58191d4619b161389a95bdce84ce9e0b24eb8107e7e590db682c2d0ca81", "sha256:3e2bf58191d4619b161389a95bdce84ce9e0b24eb8107e7e590db682c2d0ca81",
"sha256:abf306dc6351dcef07f4d40453037e51cc5d9da2ef60d0fc5d0fe3bcda255372" "sha256:abf306dc6351dcef07f4d40453037e51cc5d9da2ef60d0fc5d0fe3bcda255372"
], ],
"markers": "python_version >= '3.6'",
"version": "==1.0.1" "version": "==1.0.1"
}, },
"websockets": { "websockets": {
@ -1240,6 +1311,7 @@
"sha256:f0b059678fd549c66b89bed03efcabb009075bd131c248ecdf087bdb6faba24a", "sha256:f0b059678fd549c66b89bed03efcabb009075bd131c248ecdf087bdb6faba24a",
"sha256:fcbb48a93e8699eae920f8d92f7160c03567b421bc17362a9ffbbd706a816f71" "sha256:fcbb48a93e8699eae920f8d92f7160c03567b421bc17362a9ffbbd706a816f71"
], ],
"markers": "python_version >= '3.6'",
"version": "==1.6.3" "version": "==1.6.3"
}, },
"zope.interface": { "zope.interface": {
@ -1296,6 +1368,7 @@
"sha256:f44e517131a98f7a76696a7b21b164bcb85291cee106a23beccce454e1f433a4", "sha256:f44e517131a98f7a76696a7b21b164bcb85291cee106a23beccce454e1f433a4",
"sha256:f7ee479e96f7ee350db1cf24afa5685a5899e2b34992fb99e1f7c1b0b758d263" "sha256:f7ee479e96f7ee350db1cf24afa5685a5899e2b34992fb99e1f7c1b0b758d263"
], ],
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'",
"version": "==5.4.0" "version": "==5.4.0"
} }
}, },
@ -1312,6 +1385,7 @@
"sha256:4db03ab5fc3340cf619dbc25e42c2cc3755154ce6009469766d7143d1fc2ee4e", "sha256:4db03ab5fc3340cf619dbc25e42c2cc3755154ce6009469766d7143d1fc2ee4e",
"sha256:8a398dfce302c13f14bab13e2b14fe385d32b73f4e4853b9bdfb64598baa1975" "sha256:8a398dfce302c13f14bab13e2b14fe385d32b73f4e4853b9bdfb64598baa1975"
], ],
"markers": "python_version ~= '3.6'",
"version": "==2.5.6" "version": "==2.5.6"
}, },
"attrs": { "attrs": {
@ -1319,6 +1393,7 @@
"sha256:149e90d6d8ac20db7a955ad60cf0e6881a3f20d37096140088356da6c716b0b1", "sha256:149e90d6d8ac20db7a955ad60cf0e6881a3f20d37096140088356da6c716b0b1",
"sha256:ef6aaac3ca6cd92904cdd0d83f629a15f18053ec84e6432106f7a4d04ae4f5fb" "sha256:ef6aaac3ca6cd92904cdd0d83f629a15f18053ec84e6432106f7a4d04ae4f5fb"
], ],
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'",
"version": "==21.2.0" "version": "==21.2.0"
}, },
"bandit": { "bandit": {
@ -1357,6 +1432,7 @@
"sha256:0d6f53a15db4120f2b08c94f11e7d93d2c911ee118b6b30a04ec3ee8310179fa", "sha256:0d6f53a15db4120f2b08c94f11e7d93d2c911ee118b6b30a04ec3ee8310179fa",
"sha256:f864054d66fd9118f2e67044ac8981a54775ec5b67aed0441892edb553d21da5" "sha256:f864054d66fd9118f2e67044ac8981a54775ec5b67aed0441892edb553d21da5"
], ],
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'",
"version": "==4.0.0" "version": "==4.0.0"
}, },
"click": { "click": {
@ -1364,6 +1440,7 @@
"sha256:d2b5255c7c6349bc1bd1e59e08cd12acbbd63ce649f2588755783aa94dfb6b1a", "sha256:d2b5255c7c6349bc1bd1e59e08cd12acbbd63ce649f2588755783aa94dfb6b1a",
"sha256:dacca89f4bfadd5de3d7489b7c8a566eee0d3676333fbb50030263894c38c0dc" "sha256:dacca89f4bfadd5de3d7489b7c8a566eee0d3676333fbb50030263894c38c0dc"
], ],
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'",
"version": "==7.1.2" "version": "==7.1.2"
}, },
"colorama": { "colorama": {
@ -1437,6 +1514,7 @@
"sha256:6c4cc71933456991da20917998acbe6cf4fb41eeaab7d6d67fbc05ecd4c865b0", "sha256:6c4cc71933456991da20917998acbe6cf4fb41eeaab7d6d67fbc05ecd4c865b0",
"sha256:96bf5c08b157a666fec41129e6d327235284cca4c81e92109260f353ba138005" "sha256:96bf5c08b157a666fec41129e6d327235284cca4c81e92109260f353ba138005"
], ],
"markers": "python_version >= '3.4'",
"version": "==4.0.7" "version": "==4.0.7"
}, },
"gitpython": { "gitpython": {
@ -1444,6 +1522,7 @@
"sha256:29fe82050709760081f588dd50ce83504feddbebdc4da6956d02351552b1c135", "sha256:29fe82050709760081f588dd50ce83504feddbebdc4da6956d02351552b1c135",
"sha256:ee24bdc93dce357630764db659edaf6b8d664d4ff5447ccfeedd2dc5c253f41e" "sha256:ee24bdc93dce357630764db659edaf6b8d664d4ff5447ccfeedd2dc5c253f41e"
], ],
"markers": "python_version >= '3.5'",
"version": "==3.1.17" "version": "==3.1.17"
}, },
"idna": { "idna": {
@ -1465,6 +1544,7 @@
"sha256:0a943902919f65c5684ac4e0154b1ad4fac6dcaa5d9f3426b732f1c8b5419be6", "sha256:0a943902919f65c5684ac4e0154b1ad4fac6dcaa5d9f3426b732f1c8b5419be6",
"sha256:2bb1680aad211e3c9944dbce1d4ba09a989f04e238296c87fe2139faa26d655d" "sha256:2bb1680aad211e3c9944dbce1d4ba09a989f04e238296c87fe2139faa26d655d"
], ],
"markers": "python_version >= '3.6' and python_version < '4.0'",
"version": "==5.8.0" "version": "==5.8.0"
}, },
"lazy-object-proxy": { "lazy-object-proxy": {
@ -1492,6 +1572,7 @@
"sha256:ed361bb83436f117f9917d282a456f9e5009ea12fd6de8742d1a4752c3017e93", "sha256:ed361bb83436f117f9917d282a456f9e5009ea12fd6de8742d1a4752c3017e93",
"sha256:f5144c75445ae3ca2057faac03fda5a902eff196702b0a24daf1d6ce0650514b" "sha256:f5144c75445ae3ca2057faac03fda5a902eff196702b0a24daf1d6ce0650514b"
], ],
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'",
"version": "==1.6.0" "version": "==1.6.0"
}, },
"mccabe": { "mccabe": {
@ -1528,6 +1609,7 @@
"sha256:42df03e7797b796625b1029c0400279c7c34fd7df24a7d7818a1abb5b38710dd", "sha256:42df03e7797b796625b1029c0400279c7c34fd7df24a7d7818a1abb5b38710dd",
"sha256:c68c661ac5cc81058ac94247278eeda6d2e6aecb3e227b0387c30d277e7ef8d4" "sha256:c68c661ac5cc81058ac94247278eeda6d2e6aecb3e227b0387c30d277e7ef8d4"
], ],
"markers": "python_version >= '2.6'",
"version": "==5.6.0" "version": "==5.6.0"
}, },
"pluggy": { "pluggy": {
@ -1535,6 +1617,7 @@
"sha256:15b2acde666561e1298d71b523007ed7364de07029219b604cf808bfa1c765b0", "sha256:15b2acde666561e1298d71b523007ed7364de07029219b604cf808bfa1c765b0",
"sha256:966c145cd83c96502c3c3868f50408687b38434af77734af1e9ca461a4081d2d" "sha256:966c145cd83c96502c3c3868f50408687b38434af77734af1e9ca461a4081d2d"
], ],
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
"version": "==0.13.1" "version": "==0.13.1"
}, },
"py": { "py": {
@ -1542,6 +1625,7 @@
"sha256:21b81bda15b66ef5e1a777a21c4dcd9c20ad3efd0b3f817e7a809035269e1bd3", "sha256:21b81bda15b66ef5e1a777a21c4dcd9c20ad3efd0b3f817e7a809035269e1bd3",
"sha256:3b80836aa6d1feeaa108e046da6423ab8f6ceda6468545ae8d02d9d58d18818a" "sha256:3b80836aa6d1feeaa108e046da6423ab8f6ceda6468545ae8d02d9d58d18818a"
], ],
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
"version": "==1.10.0" "version": "==1.10.0"
}, },
"pylint": { "pylint": {
@ -1572,6 +1656,7 @@
"sha256:c203ec8783bf771a155b207279b9bccb8dea02d8f0c9e5f8ead507bc3246ecc1", "sha256:c203ec8783bf771a155b207279b9bccb8dea02d8f0c9e5f8ead507bc3246ecc1",
"sha256:ef9d7589ef3c200abe66653d3f1ab1033c3c419ae9b9bdb1240a85b024efc88b" "sha256:ef9d7589ef3c200abe66653d3f1ab1033c3c419ae9b9bdb1240a85b024efc88b"
], ],
"markers": "python_version >= '2.6' and python_version not in '3.0, 3.1, 3.2, 3.3'",
"version": "==2.4.7" "version": "==2.4.7"
}, },
"pytest": { "pytest": {
@ -1676,6 +1761,7 @@
"sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804", "sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
"sha256:c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e" "sha256:c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e"
], ],
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'",
"version": "==2.25.1" "version": "==2.25.1"
}, },
"requests-mock": { "requests-mock": {
@ -1699,6 +1785,7 @@
"sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926", "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926",
"sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254" "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
], ],
"markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
"version": "==1.16.0" "version": "==1.16.0"
}, },
"smmap": { "smmap": {
@ -1706,6 +1793,7 @@
"sha256:7e65386bd122d45405ddf795637b7f7d2b532e7e401d46bbe3fb49b9986d5182", "sha256:7e65386bd122d45405ddf795637b7f7d2b532e7e401d46bbe3fb49b9986d5182",
"sha256:a9a7479e4c572e2e775c404dcd3080c8dc49f39918c2cf74913d30c4c478e3c2" "sha256:a9a7479e4c572e2e775c404dcd3080c8dc49f39918c2cf74913d30c4c478e3c2"
], ],
"markers": "python_version >= '3.5'",
"version": "==4.0.0" "version": "==4.0.0"
}, },
"stevedore": { "stevedore": {
@ -1713,6 +1801,7 @@
"sha256:3a5bbd0652bf552748871eaa73a4a8dc2899786bc497a2aa1fcb4dcdb0debeee", "sha256:3a5bbd0652bf552748871eaa73a4a8dc2899786bc497a2aa1fcb4dcdb0debeee",
"sha256:50d7b78fbaf0d04cd62411188fa7eedcb03eb7f4c4b37005615ceebe582aa82a" "sha256:50d7b78fbaf0d04cd62411188fa7eedcb03eb7f4c4b37005615ceebe582aa82a"
], ],
"markers": "python_version >= '3.6'",
"version": "==3.3.0" "version": "==3.3.0"
}, },
"toml": { "toml": {
@ -1720,6 +1809,7 @@
"sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b", "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b",
"sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f" "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
], ],
"markers": "python_version >= '2.6' and python_version not in '3.0, 3.1, 3.2, 3.3'",
"version": "==0.10.2" "version": "==0.10.2"
}, },
"urllib3": { "urllib3": {

View file

@ -18,7 +18,7 @@ LOGGER = get_logger()
def token_from_header(raw_header: bytes) -> Optional[Token]: def token_from_header(raw_header: bytes) -> Optional[Token]:
"""raw_header in the Format of `Bearer dGVzdDp0ZXN0`""" """raw_header in the Format of `Bearer dGVzdDp0ZXN0`"""
auth_credentials = raw_header.decode() auth_credentials = raw_header.decode()
if auth_credentials == "": if auth_credentials == "" or " " not in auth_credentials:
return None return None
auth_type, auth_credentials = auth_credentials.split() auth_type, auth_credentials = auth_credentials.split()
if auth_type.lower() not in ["basic", "bearer"]: if auth_type.lower() not in ["basic", "bearer"]:

View file

@ -67,4 +67,11 @@ def postprocess_schema_responses(result, generator, **kwargs): # noqa: W0613
spectacular_settings.APPEND_COMPONENTS spectacular_settings.APPEND_COMPONENTS
) )
# This is a workaround for authentik/stages/prompt/stage.py
# since the serializer PromptChallengeResponse
# accepts dynamic keys
for component in result["components"]["schemas"]:
if component == "PromptChallengeResponseRequest":
comp = result["components"]["schemas"][component]
comp["additionalProperties"] = {}
return result return result

View file

@ -64,6 +64,11 @@ from authentik.sources.oauth.api.source_connection import (
) )
from authentik.sources.plex.api import PlexSourceViewSet from authentik.sources.plex.api import PlexSourceViewSet
from authentik.sources.saml.api import SAMLSourceViewSet from authentik.sources.saml.api import SAMLSourceViewSet
from authentik.stages.authenticator_duo.api import (
AuthenticatorDuoStageViewSet,
DuoAdminDeviceViewSet,
DuoDeviceViewSet,
)
from authentik.stages.authenticator_static.api import ( from authentik.stages.authenticator_static.api import (
AuthenticatorStaticStageViewSet, AuthenticatorStaticStageViewSet,
StaticAdminDeviceViewSet, StaticAdminDeviceViewSet,
@ -158,9 +163,15 @@ router.register("propertymappings/ldap", LDAPPropertyMappingViewSet)
router.register("propertymappings/saml", SAMLPropertyMappingViewSet) router.register("propertymappings/saml", SAMLPropertyMappingViewSet)
router.register("propertymappings/scope", ScopeMappingViewSet) router.register("propertymappings/scope", ScopeMappingViewSet)
router.register("authenticators/duo", DuoDeviceViewSet)
router.register("authenticators/static", StaticDeviceViewSet) router.register("authenticators/static", StaticDeviceViewSet)
router.register("authenticators/totp", TOTPDeviceViewSet) router.register("authenticators/totp", TOTPDeviceViewSet)
router.register("authenticators/webauthn", WebAuthnDeviceViewSet) router.register("authenticators/webauthn", WebAuthnDeviceViewSet)
router.register(
"authenticators/admin/duo",
DuoAdminDeviceViewSet,
basename="admin-duodevice",
)
router.register( router.register(
"authenticators/admin/static", "authenticators/admin/static",
StaticAdminDeviceViewSet, StaticAdminDeviceViewSet,
@ -176,6 +187,7 @@ router.register(
) )
router.register("stages/all", StageViewSet) router.register("stages/all", StageViewSet)
router.register("stages/authenticator/duo", AuthenticatorDuoStageViewSet)
router.register("stages/authenticator/static", AuthenticatorStaticStageViewSet) router.register("stages/authenticator/static", AuthenticatorStaticStageViewSet)
router.register("stages/authenticator/totp", AuthenticatorTOTPStageViewSet) router.register("stages/authenticator/totp", AuthenticatorTOTPStageViewSet)
router.register("stages/authenticator/validate", AuthenticatorValidateStageViewSet) router.register("stages/authenticator/validate", AuthenticatorValidateStageViewSet)

View file

@ -4,7 +4,7 @@ from importlib import import_module
from django.apps import AppConfig from django.apps import AppConfig
from django.db import ProgrammingError from django.db import ProgrammingError
from django.utils.timezone import datetime from django.utils.timezone import now
class AuthentikEventsConfig(AppConfig): class AuthentikEventsConfig(AppConfig):
@ -19,7 +19,7 @@ class AuthentikEventsConfig(AppConfig):
try: try:
from authentik.events.models import Event from authentik.events.models import Event
date_from = datetime.now() - timedelta(days=1) date_from = now() - timedelta(days=1)
for event in Event.objects.filter(created__gte=date_from): for event in Event.objects.filter(created__gte=date_from):
event._set_prom_metrics() event._set_prom_metrics()

View file

@ -88,7 +88,10 @@ class TaskInfo:
start = default_timer() start = default_timer()
if hasattr(self, "start_timestamp"): if hasattr(self, "start_timestamp"):
start = self.start_timestamp start = self.start_timestamp
try:
duration = max(self.finish_timestamp - start, 0) duration = max(self.finish_timestamp - start, 0)
except TypeError:
duration = 0
GAUGE_TASKS.labels( GAUGE_TASKS.labels(
task_name=self.task_name, task_name=self.task_name,
task_uid=self.result.uid or "", task_uid=self.result.uid or "",

View file

@ -174,8 +174,8 @@ class FlowViewSet(ModelViewSet):
return HttpResponseBadRequest() return HttpResponseBadRequest()
successful = importer.apply() successful = importer.apply()
if not successful: if not successful:
return Response(status=204)
return HttpResponseBadRequest() return HttpResponseBadRequest()
return Response(status=204)
@permission_required( @permission_required(
"authentik_flows.export_flow", "authentik_flows.export_flow",

View file

@ -2,6 +2,9 @@
from importlib import import_module from importlib import import_module
from django.apps import AppConfig from django.apps import AppConfig
from django.db.utils import ProgrammingError
from authentik.lib.utils.reflection import all_subclasses
class AuthentikFlowsConfig(AppConfig): class AuthentikFlowsConfig(AppConfig):
@ -14,3 +17,10 @@ class AuthentikFlowsConfig(AppConfig):
def ready(self): def ready(self):
import_module("authentik.flows.signals") import_module("authentik.flows.signals")
try:
from authentik.flows.models import Stage
for stage in all_subclasses(Stage):
_ = stage().type
except ProgrammingError:
pass

View file

@ -35,9 +35,9 @@ class Challenge(PassiveSerializer):
type = ChoiceField( type = ChoiceField(
choices=[(x.value, x.name) for x in ChallengeTypes], choices=[(x.value, x.name) for x in ChallengeTypes],
) )
component = CharField(required=False) title = CharField(required=False, allow_blank=True)
title = CharField(required=False)
background = CharField(required=False) background = CharField(required=False)
component = CharField(default="")
response_errors = DictField( response_errors = DictField(
child=ErrorDetailSerializer(many=True), allow_empty=True, required=False child=ErrorDetailSerializer(many=True), allow_empty=True, required=False
@ -48,18 +48,20 @@ class RedirectChallenge(Challenge):
"""Challenge type to redirect the client""" """Challenge type to redirect the client"""
to = CharField() to = CharField()
component = CharField(default="xak-flow-redirect")
class ShellChallenge(Challenge): class ShellChallenge(Challenge):
"""Legacy challenge type to render HTML as-is""" """challenge type to render HTML as-is"""
body = CharField() body = CharField()
component = CharField(default="xak-flow-shell")
class WithUserInfoChallenge(Challenge): class WithUserInfoChallenge(Challenge):
"""Challenge base which shows some user info""" """Challenge base which shows some user info"""
pending_user = CharField() pending_user = CharField(allow_blank=True)
pending_user_avatar = CharField() pending_user_avatar = CharField()
@ -67,6 +69,7 @@ class AccessDeniedChallenge(Challenge):
"""Challenge when a flow's active stage calls `stage_invalid()`.""" """Challenge when a flow's active stage calls `stage_invalid()`."""
error_message = CharField(required=False) error_message = CharField(required=False)
component = CharField(default="ak-stage-access-denied")
class PermissionSerializer(PassiveSerializer): class PermissionSerializer(PassiveSerializer):
@ -80,6 +83,7 @@ class ChallengeResponse(PassiveSerializer):
"""Base class for all challenge responses""" """Base class for all challenge responses"""
stage: Optional["StageView"] stage: Optional["StageView"]
component = CharField(default="xak-flow-response-default")
def __init__(self, instance=None, data=None, **kwargs): def __init__(self, instance=None, data=None, **kwargs):
self.stage = kwargs.pop("stage", None) self.stage = kwargs.pop("stage", None)

View file

@ -26,7 +26,7 @@ PLAN_CONTEXT_SOURCE = "source"
GAUGE_FLOWS_CACHED = UpdatingGauge( GAUGE_FLOWS_CACHED = UpdatingGauge(
"authentik_flows_cached", "authentik_flows_cached",
"Cached flows", "Cached flows",
update_func=lambda: len(cache.keys("flow_*")), update_func=lambda: len(cache.keys("flow_*") or []),
) )
HIST_FLOWS_PLAN_TIME = Histogram( HIST_FLOWS_PLAN_TIME = Histogram(
"authentik_flows_plan_time", "authentik_flows_plan_time",

View file

@ -289,7 +289,11 @@ class TestFlowExecutor(TestCase):
self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200)
self.assertJSONEqual( self.assertJSONEqual(
force_str(response.content), force_str(response.content),
{"to": reverse("authentik_core:root-redirect"), "type": "redirect"}, {
"component": "xak-flow-redirect",
"to": reverse("authentik_core:root-redirect"),
"type": ChallengeTypes.REDIRECT.value,
},
) )
def test_reevaluate_keep(self): def test_reevaluate_keep(self):
@ -366,7 +370,11 @@ class TestFlowExecutor(TestCase):
self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200)
self.assertJSONEqual( self.assertJSONEqual(
force_str(response.content), force_str(response.content),
{"to": reverse("authentik_core:root-redirect"), "type": "redirect"}, {
"component": "xak-flow-redirect",
"to": reverse("authentik_core:root-redirect"),
"type": ChallengeTypes.REDIRECT.value,
},
) )
def test_reevaluate_remove_consecutive(self): def test_reevaluate_remove_consecutive(self):
@ -458,7 +466,11 @@ class TestFlowExecutor(TestCase):
self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200)
self.assertJSONEqual( self.assertJSONEqual(
force_str(response.content), force_str(response.content),
{"to": reverse("authentik_core:root-redirect"), "type": "redirect"}, {
"component": "xak-flow-redirect",
"to": reverse("authentik_core:root-redirect"),
"type": ChallengeTypes.REDIRECT.value,
},
) )
def test_stageview_user_identifier(self): def test_stageview_user_identifier(self):

View file

@ -11,7 +11,12 @@ from django.utils.decorators import method_decorator
from django.views.decorators.clickjacking import xframe_options_sameorigin from django.views.decorators.clickjacking import xframe_options_sameorigin
from django.views.generic import View from django.views.generic import View
from drf_spectacular.types import OpenApiTypes from drf_spectacular.types import OpenApiTypes
from drf_spectacular.utils import OpenApiParameter, OpenApiResponse, extend_schema from drf_spectacular.utils import (
OpenApiParameter,
OpenApiResponse,
PolymorphicProxySerializer,
extend_schema,
)
from rest_framework.permissions import AllowAny from rest_framework.permissions import AllowAny
from rest_framework.views import APIView from rest_framework.views import APIView
from sentry_sdk import capture_exception from sentry_sdk import capture_exception
@ -22,10 +27,12 @@ from authentik.events.models import cleanse_dict
from authentik.flows.challenge import ( from authentik.flows.challenge import (
AccessDeniedChallenge, AccessDeniedChallenge,
Challenge, Challenge,
ChallengeResponse,
ChallengeTypes, ChallengeTypes,
HttpChallengeResponse, HttpChallengeResponse,
RedirectChallenge, RedirectChallenge,
ShellChallenge, ShellChallenge,
WithUserInfoChallenge,
) )
from authentik.flows.exceptions import EmptyFlowException, FlowNonApplicableException from authentik.flows.exceptions import EmptyFlowException, FlowNonApplicableException
from authentik.flows.models import ConfigurableStage, Flow, FlowDesignation, Stage from authentik.flows.models import ConfigurableStage, Flow, FlowDesignation, Stage
@ -35,7 +42,7 @@ from authentik.flows.planner import (
FlowPlan, FlowPlan,
FlowPlanner, FlowPlanner,
) )
from authentik.lib.utils.reflection import class_to_path from authentik.lib.utils.reflection import all_subclasses, class_to_path
from authentik.lib.utils.urls import is_url_absolute, redirect_with_qs from authentik.lib.utils.urls import is_url_absolute, redirect_with_qs
LOGGER = get_logger() LOGGER = get_logger()
@ -46,6 +53,43 @@ SESSION_KEY_APPLICATION_PRE = "authentik_flows_application_pre"
SESSION_KEY_GET = "authentik_flows_get" SESSION_KEY_GET = "authentik_flows_get"
def challenge_types():
"""This is a workaround for PolymorphicProxySerializer not accepting a callable for
`serializers`. This function returns a class which is an iterator, which returns the
subclasses of Challenge, and Challenge itself."""
class Inner(dict):
"""dummy class with custom callback on .items()"""
def items(self):
mapping = {}
classes = all_subclasses(Challenge)
classes.remove(WithUserInfoChallenge)
for cls in classes:
mapping[cls().fields["component"].default] = cls
return mapping.items()
return Inner()
def challenge_response_types():
"""This is a workaround for PolymorphicProxySerializer not accepting a callable for
`serializers`. This function returns a class which is an iterator, which returns the
subclasses of Challenge, and Challenge itself."""
class Inner(dict):
"""dummy class with custom callback on .items()"""
def items(self):
mapping = {}
classes = all_subclasses(ChallengeResponse)
for cls in classes:
mapping[cls(stage=None).fields["component"].default] = cls
return mapping.items()
return Inner()
@method_decorator(xframe_options_sameorigin, name="dispatch") @method_decorator(xframe_options_sameorigin, name="dispatch")
class FlowExecutorView(APIView): class FlowExecutorView(APIView):
"""Stage 1 Flow executor, passing requests to Stage Views""" """Stage 1 Flow executor, passing requests to Stage Views"""
@ -126,7 +170,11 @@ class FlowExecutorView(APIView):
@extend_schema( @extend_schema(
responses={ responses={
200: Challenge(), 200: PolymorphicProxySerializer(
component_name="FlowChallengeRequest",
serializers=challenge_types(),
resource_type_field_name="component",
),
404: OpenApiResponse( 404: OpenApiResponse(
description="No Token found" description="No Token found"
), # This error can be raised by the email stage ), # This error can be raised by the email stage
@ -159,8 +207,18 @@ class FlowExecutorView(APIView):
return to_stage_response(request, FlowErrorResponse(request, exc)) return to_stage_response(request, FlowErrorResponse(request, exc))
@extend_schema( @extend_schema(
responses={200: Challenge()}, responses={
request=OpenApiTypes.OBJECT, 200: PolymorphicProxySerializer(
component_name="FlowChallengeRequest",
serializers=challenge_types(),
resource_type_field_name="component",
),
},
request=PolymorphicProxySerializer(
component_name="FlowChallengeResponse",
serializers=challenge_response_types(),
resource_type_field_name="component",
),
parameters=[ parameters=[
OpenApiParameter( OpenApiParameter(
name="query", name="query",
@ -219,7 +277,7 @@ class FlowExecutorView(APIView):
if self.plan.stages: if self.plan.stages:
self._logger.debug( self._logger.debug(
"f(exec): Continuing with next stage", "f(exec): Continuing with next stage",
reamining=len(self.plan.stages), remaining=len(self.plan.stages),
) )
kwargs = self.kwargs kwargs = self.kwargs
kwargs.update({"flow_slug": self.flow.slug}) kwargs.update({"flow_slug": self.flow.slug})

View file

@ -50,7 +50,7 @@ class WebsocketMessage:
class OutpostConsumer(AuthJsonConsumer): class OutpostConsumer(AuthJsonConsumer):
"""Handler for Outposts that connect over websockets for health checks and live updates""" """Handler for Outposts that connect over websockets for health checks and live updates"""
outpost: Outpost outpost: Optional[Outpost] = None
last_uid: Optional[str] = None last_uid: Optional[str] = None
@ -95,6 +95,9 @@ class OutpostConsumer(AuthJsonConsumer):
uid = msg.args.get("uuid", self.channel_name) uid = msg.args.get("uuid", self.channel_name)
self.last_uid = uid self.last_uid = uid
if not self.outpost:
raise DenyConnection()
state = OutpostState.for_instance_uid(self.outpost, uid) state = OutpostState.for_instance_uid(self.outpost, uid)
if self.channel_name not in state.channel_ids: if self.channel_name not in state.channel_ids:
state.channel_ids.append(self.channel_name) state.channel_ids.append(self.channel_name)

View file

@ -25,7 +25,7 @@ CURRENT_PROCESS = current_process()
GAUGE_POLICIES_CACHED = UpdatingGauge( GAUGE_POLICIES_CACHED = UpdatingGauge(
"authentik_policies_cached", "authentik_policies_cached",
"Cached Policies", "Cached Policies",
update_func=lambda: len(cache.keys("policy_*")), update_func=lambda: len(cache.keys("policy_*") or []),
) )
HIST_POLICIES_BUILD_TIME = Histogram( HIST_POLICIES_BUILD_TIME = Histogram(
"authentik_policies_build_time", "authentik_policies_build_time",

View file

@ -194,6 +194,7 @@ class TestAuthorize(OAuthTestCase):
self.assertJSONEqual( self.assertJSONEqual(
force_str(response.content), force_str(response.content),
{ {
"component": "xak-flow-redirect",
"type": ChallengeTypes.REDIRECT.value, "type": ChallengeTypes.REDIRECT.value,
"to": f"foo://localhost?code={code.code}&state={state}", "to": f"foo://localhost?code={code.code}&state={state}",
}, },
@ -232,6 +233,7 @@ class TestAuthorize(OAuthTestCase):
self.assertJSONEqual( self.assertJSONEqual(
force_str(response.content), force_str(response.content),
{ {
"component": "xak-flow-redirect",
"type": ChallengeTypes.REDIRECT.value, "type": ChallengeTypes.REDIRECT.value,
"to": ( "to": (
f"http://localhost#access_token={token.access_token}" f"http://localhost#access_token={token.access_token}"

View file

@ -3,7 +3,6 @@ from typing import Any, Optional
from django.http import HttpRequest, HttpResponse from django.http import HttpRequest, HttpResponse
from django.http.response import HttpResponseBadRequest from django.http.response import HttpResponseBadRequest
from django.utils.translation import gettext_lazy as _
from django.views import View from django.views import View
from structlog.stdlib import get_logger from structlog.stdlib import get_logger
@ -38,14 +37,14 @@ class UserInfoView(View):
# GitHub Compatibility Scopes are handeled differently, since they required custom paths # GitHub Compatibility Scopes are handeled differently, since they required custom paths
# Hence they don't exist as Scope objects # Hence they don't exist as Scope objects
github_scope_map = { github_scope_map = {
SCOPE_GITHUB_USER: _("GitHub Compatibility: Access your User Information"), SCOPE_GITHUB_USER: ("GitHub Compatibility: Access your User Information"),
SCOPE_GITHUB_USER_READ: _( SCOPE_GITHUB_USER_READ: (
"GitHub Compatibility: Access your User Information" "GitHub Compatibility: Access your User Information"
), ),
SCOPE_GITHUB_USER_EMAIL: _( SCOPE_GITHUB_USER_EMAIL: (
"GitHub Compatibility: Access you Email addresses" "GitHub Compatibility: Access you Email addresses"
), ),
SCOPE_GITHUB_ORG_READ: _("GitHub Compatibility: Access your Groups"), SCOPE_GITHUB_ORG_READ: ("GitHub Compatibility: Access your Groups"),
} }
for scope in scopes: for scope in scopes:
if scope in github_scope_map: if scope in github_scope_map:

View file

@ -34,6 +34,13 @@ class AutosubmitChallenge(Challenge):
url = CharField() url = CharField()
attrs = DictField(child=CharField()) attrs = DictField(child=CharField())
component = CharField(default="ak-stage-autosubmit")
class AutoSubmitChallengeResponse(ChallengeResponse):
"""Pseudo class for autosubmit response"""
component = CharField(default="ak-stage-autosubmit")
# This View doesn't have a URL on purpose, as its called by the FlowExecutor # This View doesn't have a URL on purpose, as its called by the FlowExecutor
@ -42,6 +49,8 @@ class SAMLFlowFinalView(ChallengeStageView):
and redirects to the SP (if REDIRECT is configured) or shows an auto-submit element and redirects to the SP (if REDIRECT is configured) or shows an auto-submit element
(if POST is configured).""" (if POST is configured)."""
response_class = AutoSubmitChallengeResponse
def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse: def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
application: Application = self.executor.plan.context[PLAN_CONTEXT_APPLICATION] application: Application = self.executor.plan.context[PLAN_CONTEXT_APPLICATION]
provider: SAMLProvider = get_object_or_404( provider: SAMLProvider = get_object_or_404(

View file

@ -109,6 +109,7 @@ INSTALLED_APPS = [
"authentik.sources.oauth", "authentik.sources.oauth",
"authentik.sources.plex", "authentik.sources.plex",
"authentik.sources.saml", "authentik.sources.saml",
"authentik.stages.authenticator_duo",
"authentik.stages.authenticator_static", "authentik.stages.authenticator_static",
"authentik.stages.authenticator_totp", "authentik.stages.authenticator_totp",
"authentik.stages.authenticator_validate", "authentik.stages.authenticator_validate",

View file

@ -8,7 +8,7 @@ from rest_framework.serializers import BaseSerializer
from authentik.core.models import Source, UserSourceConnection from authentik.core.models import Source, UserSourceConnection
from authentik.core.types import UILoginButton from authentik.core.types import UILoginButton
from authentik.flows.challenge import Challenge, ChallengeTypes from authentik.flows.challenge import Challenge, ChallengeResponse, ChallengeTypes
from authentik.providers.oauth2.generators import generate_client_id from authentik.providers.oauth2.generators import generate_client_id
@ -17,6 +17,13 @@ class PlexAuthenticationChallenge(Challenge):
client_id = CharField() client_id = CharField()
slug = CharField() slug = CharField()
component = CharField(default="ak-flow-sources-plex")
class PlexAuthenticationChallengeResponse(ChallengeResponse):
"""Pseudo class for plex response"""
component = CharField(default="ak-flow-sources-plex")
class PlexSource(Source): class PlexSource(Source):

View file

@ -8,7 +8,6 @@ from django.http.response import HttpResponseBadRequest
from django.shortcuts import get_object_or_404, redirect from django.shortcuts import get_object_or_404, redirect
from django.utils.decorators import method_decorator from django.utils.decorators import method_decorator
from django.utils.http import urlencode from django.utils.http import urlencode
from django.utils.translation import gettext_lazy as _
from django.views import View from django.views import View
from django.views.decorators.csrf import csrf_exempt from django.views.decorators.csrf import csrf_exempt
from structlog.stdlib import get_logger from structlog.stdlib import get_logger
@ -134,10 +133,8 @@ class InitiateView(View):
return bad_request_message(request, str(exc)) return bad_request_message(request, str(exc))
injected_stages = [] injected_stages = []
plan_kwargs = { plan_kwargs = {
PLAN_CONTEXT_TITLE: _("Redirecting to %(app)s..." % {"app": source.name}), PLAN_CONTEXT_TITLE: f"Redirecting to {source.name}...",
PLAN_CONTEXT_CONSENT_TITLE: _( PLAN_CONTEXT_CONSENT_TITLE: f"Redirecting to {source.name}...",
"Redirecting to %(app)s..." % {"app": source.name}
),
PLAN_CONTEXT_ATTRS: { PLAN_CONTEXT_ATTRS: {
"SAMLRequest": saml_request, "SAMLRequest": saml_request,
"RelayState": relay_state, "RelayState": relay_state,

View file

@ -0,0 +1,103 @@
"""AuthenticatorDuoStage API Views"""
from django_filters.rest_framework.backends import DjangoFilterBackend
from drf_spectacular.types import OpenApiTypes
from drf_spectacular.utils import OpenApiResponse, extend_schema
from rest_framework import mixins
from rest_framework.decorators import action
from rest_framework.filters import OrderingFilter, SearchFilter
from rest_framework.permissions import IsAdminUser
from rest_framework.request import Request
from rest_framework.response import Response
from rest_framework.serializers import ModelSerializer
from rest_framework.viewsets import GenericViewSet, ModelViewSet, ReadOnlyModelViewSet
from authentik.api.authorization import OwnerFilter, OwnerPermissions
from authentik.flows.api.stages import StageSerializer
from authentik.stages.authenticator_duo.models import AuthenticatorDuoStage, DuoDevice
from authentik.stages.authenticator_duo.stage import (
SESSION_KEY_DUO_ACTIVATION_CODE,
SESSION_KEY_DUO_USER_ID,
)
class AuthenticatorDuoStageSerializer(StageSerializer):
"""AuthenticatorDuoStage Serializer"""
class Meta:
model = AuthenticatorDuoStage
fields = StageSerializer.Meta.fields + [
"configure_flow",
"client_id",
"client_secret",
"api_hostname",
]
extra_kwargs = {
"client_secret": {"write_only": True},
}
class AuthenticatorDuoStageViewSet(ModelViewSet):
"""AuthenticatorDuoStage Viewset"""
queryset = AuthenticatorDuoStage.objects.all()
serializer_class = AuthenticatorDuoStageSerializer
@extend_schema(
request=OpenApiTypes.NONE,
responses={
204: OpenApiResponse(description="Enrollment successful"),
420: OpenApiResponse(description="Enrollment pending/failed"),
},
)
@action(methods=["POST"], detail=True, permission_classes=[])
# pylint: disable=invalid-name,unused-argument
def enrollment_status(self, request: Request, pk: str) -> Response:
"""Check enrollment status of user details in current session"""
stage: AuthenticatorDuoStage = self.get_object()
client = stage.client
user_id = self.request.session.get(SESSION_KEY_DUO_USER_ID)
activation_code = self.request.session.get(SESSION_KEY_DUO_ACTIVATION_CODE)
status = client.enroll_status(user_id, activation_code)
if status == "success":
return Response(status=204)
return Response(status=420)
class DuoDeviceSerializer(ModelSerializer):
"""Serializer for Duo authenticator devices"""
class Meta:
model = DuoDevice
fields = ["pk", "name"]
depth = 2
class DuoDeviceViewSet(
mixins.RetrieveModelMixin,
mixins.UpdateModelMixin,
mixins.DestroyModelMixin,
mixins.ListModelMixin,
GenericViewSet,
):
"""Viewset for Duo authenticator devices"""
queryset = DuoDevice.objects.all()
serializer_class = DuoDeviceSerializer
search_fields = ["name"]
filterset_fields = ["name"]
ordering = ["name"]
permission_classes = [OwnerPermissions]
filter_backends = [OwnerFilter, DjangoFilterBackend, OrderingFilter, SearchFilter]
class DuoAdminDeviceViewSet(ReadOnlyModelViewSet):
"""Viewset for Duo authenticator devices (for admins)"""
permission_classes = [IsAdminUser]
queryset = DuoDevice.objects.all()
serializer_class = DuoDeviceSerializer
search_fields = ["name"]
filterset_fields = ["name"]
ordering = ["name"]

View file

@ -0,0 +1,10 @@
"""authentik duo app config"""
from django.apps import AppConfig
class AuthentikStageAuthenticatorDuoConfig(AppConfig):
"""authentik duo config"""
name = "authentik.stages.authenticator_duo"
label = "authentik_stages_authenticator_duo"
verbose_name = "authentik Stages.Authenticator.Duo"

View file

@ -0,0 +1,98 @@
# Generated by Django 3.2.3 on 2021-05-23 20:28
import django.db.models.deletion
from django.conf import settings
from django.db import migrations, models
class Migration(migrations.Migration):
initial = True
dependencies = [
("authentik_flows", "0018_oob_flows"),
migrations.swappable_dependency(settings.AUTH_USER_MODEL),
]
operations = [
migrations.CreateModel(
name="AuthenticatorDuoStage",
fields=[
(
"stage_ptr",
models.OneToOneField(
auto_created=True,
on_delete=django.db.models.deletion.CASCADE,
parent_link=True,
primary_key=True,
serialize=False,
to="authentik_flows.stage",
),
),
("client_id", models.TextField()),
("client_secret", models.TextField()),
("api_hostname", models.TextField()),
(
"configure_flow",
models.ForeignKey(
blank=True,
help_text="Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.",
null=True,
on_delete=django.db.models.deletion.SET_NULL,
to="authentik_flows.flow",
),
),
],
options={
"verbose_name": "Duo Authenticator Setup Stage",
"verbose_name_plural": "Duo Authenticator Setup Stages",
},
bases=("authentik_flows.stage", models.Model),
),
migrations.CreateModel(
name="DuoDevice",
fields=[
(
"id",
models.AutoField(
auto_created=True,
primary_key=True,
serialize=False,
verbose_name="ID",
),
),
(
"name",
models.CharField(
help_text="The human-readable name of this device.",
max_length=64,
),
),
(
"confirmed",
models.BooleanField(
default=True, help_text="Is this device ready for use?"
),
),
("duo_user_id", models.TextField()),
(
"stage",
models.ForeignKey(
on_delete=django.db.models.deletion.CASCADE,
to="authentik_stages_authenticator_duo.authenticatorduostage",
),
),
(
"user",
models.ForeignKey(
on_delete=django.db.models.deletion.CASCADE,
to=settings.AUTH_USER_MODEL,
),
),
],
options={
"verbose_name": "Duo Device",
"verbose_name_plural": "Duo Devices",
},
),
]

View file

@ -0,0 +1,86 @@
"""Duo stage"""
from typing import Optional, Type
from django.contrib.auth import get_user_model
from django.db import models
from django.utils.translation import gettext_lazy as _
from django.views import View
from django_otp.models import Device
from duo_client.auth import Auth
from rest_framework.serializers import BaseSerializer
from authentik import __version__
from authentik.core.types import UserSettingSerializer
from authentik.flows.models import ConfigurableStage, Stage
class AuthenticatorDuoStage(ConfigurableStage, Stage):
"""Setup Duo authenticator devices"""
client_id = models.TextField()
client_secret = models.TextField()
api_hostname = models.TextField()
@property
def serializer(self) -> BaseSerializer:
from authentik.stages.authenticator_duo.api import (
AuthenticatorDuoStageSerializer,
)
return AuthenticatorDuoStageSerializer
@property
def type(self) -> Type[View]:
from authentik.stages.authenticator_duo.stage import AuthenticatorDuoStageView
return AuthenticatorDuoStageView
@property
def client(self) -> Auth:
"""Get an API Client to talk to duo"""
client = Auth(
self.client_id,
self.client_secret,
self.api_hostname,
user_agent=f"authentik {__version__}",
)
return client
@property
def component(self) -> str:
return "ak-stage-authenticator-duo-form"
@property
def ui_user_settings(self) -> Optional[UserSettingSerializer]:
return UserSettingSerializer(
data={
"title": str(self._meta.verbose_name),
"component": "ak-user-settings-authenticator-duo",
}
)
def __str__(self) -> str:
return f"Duo Authenticator Setup Stage {self.name}"
class Meta:
verbose_name = _("Duo Authenticator Setup Stage")
verbose_name_plural = _("Duo Authenticator Setup Stages")
class DuoDevice(Device):
"""Duo Device for a single user"""
user = models.ForeignKey(get_user_model(), on_delete=models.CASCADE)
# Connect to the stage to when validating access we know the API Credentials
stage = models.ForeignKey(AuthenticatorDuoStage, on_delete=models.CASCADE)
duo_user_id = models.TextField()
def __str__(self):
return self.name or str(self.user)
class Meta:
verbose_name = _("Duo Device")
verbose_name_plural = _("Duo Devices")

View file

@ -0,0 +1,86 @@
"""Duo stage"""
from django.http import HttpRequest, HttpResponse
from rest_framework.fields import CharField
from structlog.stdlib import get_logger
from authentik.flows.challenge import (
Challenge,
ChallengeResponse,
ChallengeTypes,
WithUserInfoChallenge,
)
from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER
from authentik.flows.stage import ChallengeStageView
from authentik.stages.authenticator_duo.models import AuthenticatorDuoStage, DuoDevice
LOGGER = get_logger()
SESSION_KEY_DUO_USER_ID = "authentik_stages_authenticator_duo_user_id"
SESSION_KEY_DUO_ACTIVATION_CODE = "authentik_stages_authenticator_duo_activation_code"
class AuthenticatorDuoChallenge(WithUserInfoChallenge):
"""Duo Challenge"""
activation_barcode = CharField()
activation_code = CharField()
stage_uuid = CharField()
component = CharField(default="ak-stage-authenticator-duo")
class AuthenticatorDuoChallengeResponse(ChallengeResponse):
"""Pseudo class for duo response"""
component = CharField(default="ak-stage-authenticator-duo")
class AuthenticatorDuoStageView(ChallengeStageView):
"""Duo stage"""
response_class = AuthenticatorDuoChallengeResponse
def get_challenge(self, *args, **kwargs) -> Challenge:
user = self.get_pending_user()
stage: AuthenticatorDuoStage = self.executor.current_stage
enroll = stage.client.enroll(user.username)
user_id = enroll["user_id"]
self.request.session[SESSION_KEY_DUO_USER_ID] = user_id
self.request.session[SESSION_KEY_DUO_ACTIVATION_CODE] = enroll[
"activation_code"
]
return AuthenticatorDuoChallenge(
data={
"type": ChallengeTypes.NATIVE.value,
"activation_barcode": enroll["activation_barcode"],
"activation_code": enroll["activation_code"],
"stage_uuid": stage.stage_uuid,
}
)
def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
user = self.executor.plan.context.get(PLAN_CONTEXT_PENDING_USER)
if not user:
LOGGER.debug("No pending user, continuing")
return self.executor.stage_ok()
return super().get(request, *args, **kwargs)
def challenge_valid(self, response: ChallengeResponse) -> HttpResponse:
# Duo Challenge has already been validated
stage: AuthenticatorDuoStage = self.executor.current_stage
user_id = self.request.session.get(SESSION_KEY_DUO_USER_ID)
activation_code = self.request.session.get(SESSION_KEY_DUO_ACTIVATION_CODE)
enroll_status = stage.client.enroll_status(user_id, activation_code)
if enroll_status != "success":
return HttpResponse(status=420)
existing_device = DuoDevice.objects.filter(duo_user_id=user_id).first()
self.request.session.pop(SESSION_KEY_DUO_USER_ID)
self.request.session.pop(SESSION_KEY_DUO_ACTIVATION_CODE)
if not existing_device:
DuoDevice.objects.create(
user=self.get_pending_user(), duo_user_id=user_id, stage=stage
)
else:
return self.executor.stage_invalid(
"Device with Credential ID already exists."
)
return self.executor.stage_ok()

View file

@ -22,17 +22,25 @@ class AuthenticatorStaticChallenge(WithUserInfoChallenge):
"""Static authenticator challenge""" """Static authenticator challenge"""
codes = ListField(child=CharField()) codes = ListField(child=CharField())
component = CharField(default="ak-stage-authenticator-static")
class AuthenticatorStaticChallengeResponse(ChallengeResponse):
"""Pseudo class for static response"""
component = CharField(default="ak-stage-authenticator-static")
class AuthenticatorStaticStageView(ChallengeStageView): class AuthenticatorStaticStageView(ChallengeStageView):
"""Static OTP Setup stage""" """Static OTP Setup stage"""
response_class = AuthenticatorStaticChallengeResponse
def get_challenge(self, *args, **kwargs) -> AuthenticatorStaticChallenge: def get_challenge(self, *args, **kwargs) -> AuthenticatorStaticChallenge:
tokens: list[StaticToken] = self.request.session[SESSION_STATIC_TOKENS] tokens: list[StaticToken] = self.request.session[SESSION_STATIC_TOKENS]
return AuthenticatorStaticChallenge( return AuthenticatorStaticChallenge(
data={ data={
"type": ChallengeTypes.NATIVE.value, "type": ChallengeTypes.NATIVE.value,
"component": "ak-stage-authenticator-static",
"codes": [token.token for token in tokens], "codes": [token.token for token in tokens],
} }
) )

View file

@ -25,6 +25,7 @@ class AuthenticatorTOTPChallenge(WithUserInfoChallenge):
"""TOTP Setup challenge""" """TOTP Setup challenge"""
config_url = CharField() config_url = CharField()
component = CharField(default="ak-stage-authenticator-totp")
class AuthenticatorTOTPChallengeResponse(ChallengeResponse): class AuthenticatorTOTPChallengeResponse(ChallengeResponse):
@ -33,6 +34,7 @@ class AuthenticatorTOTPChallengeResponse(ChallengeResponse):
device: TOTPDevice device: TOTPDevice
code = IntegerField() code = IntegerField()
component = CharField(default="ak-stage-authenticator-totp")
def validate_code(self, code: int) -> int: def validate_code(self, code: int) -> int:
"""Validate totp code""" """Validate totp code"""
@ -52,7 +54,6 @@ class AuthenticatorTOTPStageView(ChallengeStageView):
return AuthenticatorTOTPChallenge( return AuthenticatorTOTPChallenge(
data={ data={
"type": ChallengeTypes.NATIVE.value, "type": ChallengeTypes.NATIVE.value,
"component": "ak-stage-authenticator-totp",
"config_url": device.config_url, "config_url": device.config_url,
} }
) )

View file

@ -1,12 +1,13 @@
"""Validation stage challenge checking""" """Validation stage challenge checking"""
from django.http import HttpRequest from django.http import HttpRequest
from django.http.response import Http404
from django.shortcuts import get_object_or_404
from django.utils.translation import gettext_lazy as _ from django.utils.translation import gettext_lazy as _
from django_otp import match_token from django_otp import match_token
from django_otp.models import Device from django_otp.models import Device
from django_otp.plugins.otp_static.models import StaticDevice
from django_otp.plugins.otp_totp.models import TOTPDevice
from rest_framework.fields import CharField, JSONField from rest_framework.fields import CharField, JSONField
from rest_framework.serializers import ValidationError from rest_framework.serializers import ValidationError
from structlog.stdlib import get_logger
from webauthn import WebAuthnAssertionOptions, WebAuthnAssertionResponse, WebAuthnUser from webauthn import WebAuthnAssertionOptions, WebAuthnAssertionResponse, WebAuthnUser
from webauthn.webauthn import ( from webauthn.webauthn import (
AuthenticationRejectedException, AuthenticationRejectedException,
@ -16,9 +17,13 @@ from webauthn.webauthn import (
from authentik.core.api.utils import PassiveSerializer from authentik.core.api.utils import PassiveSerializer
from authentik.core.models import User from authentik.core.models import User
from authentik.lib.utils.http import get_client_ip
from authentik.stages.authenticator_duo.models import AuthenticatorDuoStage, DuoDevice
from authentik.stages.authenticator_webauthn.models import WebAuthnDevice from authentik.stages.authenticator_webauthn.models import WebAuthnDevice
from authentik.stages.authenticator_webauthn.utils import generate_challenge, get_origin from authentik.stages.authenticator_webauthn.utils import generate_challenge, get_origin
LOGGER = get_logger()
class DeviceChallenge(PassiveSerializer): class DeviceChallenge(PassiveSerializer):
"""Single device challenge""" """Single device challenge"""
@ -30,10 +35,10 @@ class DeviceChallenge(PassiveSerializer):
def get_challenge_for_device(request: HttpRequest, device: Device) -> dict: def get_challenge_for_device(request: HttpRequest, device: Device) -> dict:
"""Generate challenge for a single device""" """Generate challenge for a single device"""
if isinstance(device, (TOTPDevice, StaticDevice)): if isinstance(device, WebAuthnDevice):
return get_webauthn_challenge(request, device)
# Code-based challenges have no hints # Code-based challenges have no hints
return {} return {}
return get_webauthn_challenge(request, device)
def get_webauthn_challenge(request: HttpRequest, device: WebAuthnDevice) -> dict: def get_webauthn_challenge(request: HttpRequest, device: WebAuthnDevice) -> dict:
@ -111,3 +116,24 @@ def validate_challenge_webauthn(data: dict, request: HttpRequest, user: User) ->
device.set_sign_count(sign_count) device.set_sign_count(sign_count)
return data return data
def validate_challenge_duo(device_pk: int, request: HttpRequest, user: User) -> int:
"""Duo authentication"""
device = get_object_or_404(DuoDevice, pk=device_pk)
if device.user != user:
LOGGER.warning("device mismatch")
raise Http404
stage: AuthenticatorDuoStage = device.stage
response = stage.client.auth(
"auto",
user_id=device.duo_user_id,
ipaddr=get_client_ip(request),
type="authentik Login request",
display_username=user.username,
device="auto",
)
# {'result': 'allow', 'status': 'allow', 'status_msg': 'Success. Logging you in...'}
if response["result"] == "deny":
raise ValidationError("Duo denied access")
return device_pk

View file

@ -17,6 +17,7 @@ class DeviceClasses(models.TextChoices):
STATIC = "static" STATIC = "static"
TOTP = "totp", _("TOTP") TOTP = "totp", _("TOTP")
WEBAUTHN = "webauthn", _("WebAuthn") WEBAUTHN = "webauthn", _("WebAuthn")
DUO = "duo", _("Duo")
def default_device_classes() -> list: def default_device_classes() -> list:

View file

@ -1,7 +1,7 @@
"""Authenticator Validation""" """Authenticator Validation"""
from django.http import HttpRequest, HttpResponse from django.http import HttpRequest, HttpResponse
from django_otp import devices_for_user from django_otp import devices_for_user
from rest_framework.fields import CharField, JSONField, ListField from rest_framework.fields import CharField, IntegerField, JSONField, ListField
from rest_framework.serializers import ValidationError from rest_framework.serializers import ValidationError
from structlog.stdlib import get_logger from structlog.stdlib import get_logger
@ -17,6 +17,7 @@ from authentik.stages.authenticator_validate.challenge import (
DeviceChallenge, DeviceChallenge,
get_challenge_for_device, get_challenge_for_device,
validate_challenge_code, validate_challenge_code,
validate_challenge_duo,
validate_challenge_webauthn, validate_challenge_webauthn,
) )
from authentik.stages.authenticator_validate.models import ( from authentik.stages.authenticator_validate.models import (
@ -29,28 +30,31 @@ LOGGER = get_logger()
PER_DEVICE_CLASSES = [DeviceClasses.WEBAUTHN] PER_DEVICE_CLASSES = [DeviceClasses.WEBAUTHN]
class AuthenticatorChallenge(WithUserInfoChallenge): class AuthenticatorValidationChallenge(WithUserInfoChallenge):
"""Authenticator challenge""" """Authenticator challenge"""
device_challenges = ListField(child=DeviceChallenge()) device_challenges = ListField(child=DeviceChallenge())
component = CharField(default="ak-stage-authenticator-validate")
class AuthenticatorChallengeResponse(ChallengeResponse): class AuthenticatorValidationChallengeResponse(ChallengeResponse):
"""Challenge used for Code-based and WebAuthn authenticators""" """Challenge used for Code-based and WebAuthn authenticators"""
code = CharField(required=False) code = CharField(required=False)
webauthn = JSONField(required=False) webauthn = JSONField(required=False)
duo = IntegerField(required=False)
component = CharField(default="ak-stage-authenticator-validate")
def validate_code(self, code: str) -> str: def _challenge_allowed(self, classes: list):
"""Validate code-based response, raise error if code isn't allowed"""
device_challenges: list[dict] = self.stage.request.session.get( device_challenges: list[dict] = self.stage.request.session.get(
"device_challenges" "device_challenges"
) )
if not any( if not any(x["device_class"] in classes for x in device_challenges):
x["device_class"] in (DeviceClasses.TOTP, DeviceClasses.STATIC) raise ValidationError("No compatible device class allowed")
for x in device_challenges
): def validate_code(self, code: str) -> str:
raise ValidationError("Got code but no compatible device class allowed") """Validate code-based response, raise error if code isn't allowed"""
self._challenge_allowed([DeviceClasses.TOTP, DeviceClasses.STATIC])
return validate_challenge_code( return validate_challenge_code(
code, self.stage.request, self.stage.get_pending_user() code, self.stage.request, self.stage.get_pending_user()
) )
@ -58,21 +62,22 @@ class AuthenticatorChallengeResponse(ChallengeResponse):
def validate_webauthn(self, webauthn: dict) -> dict: def validate_webauthn(self, webauthn: dict) -> dict:
"""Validate webauthn response, raise error if webauthn wasn't allowed """Validate webauthn response, raise error if webauthn wasn't allowed
or response is invalid""" or response is invalid"""
device_challenges: list[dict] = self.stage.request.session.get( self._challenge_allowed([DeviceClasses.WEBAUTHN])
"device_challenges"
)
if not any(
x["device_class"] in (DeviceClasses.WEBAUTHN) for x in device_challenges
):
raise ValidationError("Got webauthn but no compatible device class allowed")
return validate_challenge_webauthn( return validate_challenge_webauthn(
webauthn, self.stage.request, self.stage.get_pending_user() webauthn, self.stage.request, self.stage.get_pending_user()
) )
def validate_duo(self, duo: int) -> int:
"""Initiate Duo authentication"""
self._challenge_allowed([DeviceClasses.DUO])
return validate_challenge_duo(
duo, self.stage.request, self.stage.get_pending_user()
)
def validate(self, data: dict): def validate(self, data: dict):
# Checking if the given data is from a valid device class is done above # Checking if the given data is from a valid device class is done above
# Here we only check if the any data was sent at all # Here we only check if the any data was sent at all
if "code" not in data and "webauthn" not in data: if "code" not in data and "webauthn" not in data and "duo" not in data:
raise ValidationError("Empty response") raise ValidationError("Empty response")
return data return data
@ -80,7 +85,7 @@ class AuthenticatorChallengeResponse(ChallengeResponse):
class AuthenticatorValidateStageView(ChallengeStageView): class AuthenticatorValidateStageView(ChallengeStageView):
"""Authenticator Validation""" """Authenticator Validation"""
response_class = AuthenticatorChallengeResponse response_class = AuthenticatorValidationChallengeResponse
def get_device_challenges(self) -> list[dict]: def get_device_challenges(self) -> list[dict]:
"""Get a list of all device challenges applicable for the current stage""" """Get a list of all device challenges applicable for the current stage"""
@ -141,19 +146,18 @@ class AuthenticatorValidateStageView(ChallengeStageView):
return self.executor.stage_ok() return self.executor.stage_ok()
return super().get(request, *args, **kwargs) return super().get(request, *args, **kwargs)
def get_challenge(self) -> AuthenticatorChallenge: def get_challenge(self) -> AuthenticatorValidationChallenge:
challenges = self.request.session["device_challenges"] challenges = self.request.session["device_challenges"]
return AuthenticatorChallenge( return AuthenticatorValidationChallenge(
data={ data={
"type": ChallengeTypes.NATIVE.value, "type": ChallengeTypes.NATIVE.value,
"component": "ak-stage-authenticator-validate",
"device_challenges": challenges, "device_challenges": challenges,
} }
) )
# pylint: disable=unused-argument # pylint: disable=unused-argument
def challenge_valid( def challenge_valid(
self, challenge: AuthenticatorChallengeResponse self, challenge: AuthenticatorValidationChallengeResponse
) -> HttpResponse: ) -> HttpResponse:
# All validation is done by the serializer # All validation is done by the serializer
return self.executor.stage_ok() return self.executor.stage_ok()

View file

@ -2,7 +2,7 @@
from django.http import HttpRequest, HttpResponse from django.http import HttpRequest, HttpResponse
from django.http.request import QueryDict from django.http.request import QueryDict
from rest_framework.fields import JSONField from rest_framework.fields import CharField, JSONField
from rest_framework.serializers import ValidationError from rest_framework.serializers import ValidationError
from structlog.stdlib import get_logger from structlog.stdlib import get_logger
from webauthn.webauthn import ( from webauthn.webauthn import (
@ -13,7 +13,12 @@ from webauthn.webauthn import (
) )
from authentik.core.models import User from authentik.core.models import User
from authentik.flows.challenge import Challenge, ChallengeResponse, ChallengeTypes from authentik.flows.challenge import (
Challenge,
ChallengeResponse,
ChallengeTypes,
WithUserInfoChallenge,
)
from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER
from authentik.flows.stage import ChallengeStageView from authentik.flows.stage import ChallengeStageView
from authentik.stages.authenticator_webauthn.models import WebAuthnDevice from authentik.stages.authenticator_webauthn.models import WebAuthnDevice
@ -32,16 +37,18 @@ SESSION_KEY_WEBAUTHN_AUTHENTICATED = (
) )
class AuthenticatorWebAuthnChallenge(Challenge): class AuthenticatorWebAuthnChallenge(WithUserInfoChallenge):
"""WebAuthn Challenge""" """WebAuthn Challenge"""
registration = JSONField() registration = JSONField()
component = CharField(default="ak-stage-authenticator-webauthn")
class AuthenticatorWebAuthnChallengeResponse(ChallengeResponse): class AuthenticatorWebAuthnChallengeResponse(ChallengeResponse):
"""WebAuthn Challenge response""" """WebAuthn Challenge response"""
response = JSONField() response = JSONField()
component = CharField(default="ak-stage-authenticator-webauthn")
request: HttpRequest request: HttpRequest
user: User user: User
@ -129,7 +136,6 @@ class AuthenticatorWebAuthnStageView(ChallengeStageView):
return AuthenticatorWebAuthnChallenge( return AuthenticatorWebAuthnChallenge(
data={ data={
"type": ChallengeTypes.NATIVE.value, "type": ChallengeTypes.NATIVE.value,
"component": "ak-stage-authenticator-webauthn",
"registration": registration_dict, "registration": registration_dict,
} }
) )

View file

@ -21,12 +21,14 @@ class CaptchaChallenge(WithUserInfoChallenge):
"""Site public key""" """Site public key"""
site_key = CharField() site_key = CharField()
component = CharField(default="ak-stage-captcha")
class CaptchaChallengeResponse(ChallengeResponse): class CaptchaChallengeResponse(ChallengeResponse):
"""Validate captcha token""" """Validate captcha token"""
token = CharField() token = CharField()
component = CharField(default="ak-stage-captcha")
def validate_token(self, token: str) -> str: def validate_token(self, token: str) -> str:
"""Validate captcha token""" """Validate captcha token"""
@ -64,7 +66,6 @@ class CaptchaStageView(ChallengeStageView):
return CaptchaChallenge( return CaptchaChallenge(
data={ data={
"type": ChallengeTypes.NATIVE.value, "type": ChallengeTypes.NATIVE.value,
"component": "ak-stage-captcha",
"site_key": self.executor.current_stage.public_key, "site_key": self.executor.current_stage.public_key,
} }
) )

View file

@ -4,6 +4,7 @@ from django.urls import reverse
from django.utils.encoding import force_str from django.utils.encoding import force_str
from authentik.core.models import User from authentik.core.models import User
from authentik.flows.challenge import ChallengeTypes
from authentik.flows.markers import StageMarker from authentik.flows.markers import StageMarker
from authentik.flows.models import Flow, FlowDesignation, FlowStageBinding from authentik.flows.models import Flow, FlowDesignation, FlowStageBinding
from authentik.flows.planner import FlowPlan from authentik.flows.planner import FlowPlan
@ -54,5 +55,9 @@ class TestCaptchaStage(TestCase):
self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200)
self.assertJSONEqual( self.assertJSONEqual(
force_str(response.content), force_str(response.content),
{"to": reverse("authentik_core:root-redirect"), "type": "redirect"}, {
"component": "xak-flow-redirect",
"to": reverse("authentik_core:root-redirect"),
"type": ChallengeTypes.REDIRECT.value,
},
) )

View file

@ -25,11 +25,14 @@ class ConsentChallenge(WithUserInfoChallenge):
header_text = CharField() header_text = CharField()
permissions = PermissionSerializer(many=True) permissions = PermissionSerializer(many=True)
component = CharField(default="ak-stage-consent")
class ConsentChallengeResponse(ChallengeResponse): class ConsentChallengeResponse(ChallengeResponse):
"""Consent challenge response, any valid response request is valid""" """Consent challenge response, any valid response request is valid"""
component = CharField(default="ak-stage-consent")
class ConsentStageView(ChallengeStageView): class ConsentStageView(ChallengeStageView):
"""Simple consent checker.""" """Simple consent checker."""
@ -37,24 +40,19 @@ class ConsentStageView(ChallengeStageView):
response_class = ConsentChallengeResponse response_class = ConsentChallengeResponse
def get_challenge(self) -> Challenge: def get_challenge(self) -> Challenge:
challenge = ConsentChallenge(
data = { data = {
"type": ChallengeTypes.NATIVE.value, "type": ChallengeTypes.NATIVE.value,
"component": "ak-stage-consent", "permissions": self.executor.plan.context.get(
PLAN_CONTEXT_CONSENT_PERMISSIONS, []
),
} }
)
if PLAN_CONTEXT_CONSENT_TITLE in self.executor.plan.context: if PLAN_CONTEXT_CONSENT_TITLE in self.executor.plan.context:
challenge.initial_data["title"] = self.executor.plan.context[ data["title"] = self.executor.plan.context[PLAN_CONTEXT_CONSENT_TITLE]
PLAN_CONTEXT_CONSENT_TITLE
]
if PLAN_CONTEXT_CONSENT_HEADER in self.executor.plan.context: if PLAN_CONTEXT_CONSENT_HEADER in self.executor.plan.context:
challenge.initial_data["header_text"] = self.executor.plan.context[ data["header_text"] = self.executor.plan.context[
PLAN_CONTEXT_CONSENT_HEADER PLAN_CONTEXT_CONSENT_HEADER
] ]
if PLAN_CONTEXT_CONSENT_PERMISSIONS in self.executor.plan.context: challenge = ConsentChallenge(data=data)
challenge.initial_data["permissions"] = self.executor.plan.context[
PLAN_CONTEXT_CONSENT_PERMISSIONS
]
return challenge return challenge
def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse: def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:

View file

@ -7,6 +7,7 @@ from django.utils.encoding import force_str
from authentik.core.models import Application, User from authentik.core.models import Application, User
from authentik.core.tasks import clean_expired_models from authentik.core.tasks import clean_expired_models
from authentik.flows.challenge import ChallengeTypes
from authentik.flows.markers import StageMarker from authentik.flows.markers import StageMarker
from authentik.flows.models import Flow, FlowDesignation, FlowStageBinding from authentik.flows.models import Flow, FlowDesignation, FlowStageBinding
from authentik.flows.planner import PLAN_CONTEXT_APPLICATION, FlowPlan from authentik.flows.planner import PLAN_CONTEXT_APPLICATION, FlowPlan
@ -51,7 +52,11 @@ class TestConsentStage(TestCase):
self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200)
self.assertJSONEqual( self.assertJSONEqual(
force_str(response.content), force_str(response.content),
{"to": reverse("authentik_core:root-redirect"), "type": "redirect"}, {
"component": "xak-flow-redirect",
"to": reverse("authentik_core:root-redirect"),
"type": ChallengeTypes.REDIRECT.value,
},
) )
self.assertFalse(UserConsent.objects.filter(user=self.user).exists()) self.assertFalse(UserConsent.objects.filter(user=self.user).exists())
@ -82,7 +87,11 @@ class TestConsentStage(TestCase):
self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200)
self.assertJSONEqual( self.assertJSONEqual(
force_str(response.content), force_str(response.content),
{"to": reverse("authentik_core:root-redirect"), "type": "redirect"}, {
"component": "xak-flow-redirect",
"to": reverse("authentik_core:root-redirect"),
"type": ChallengeTypes.REDIRECT.value,
},
) )
self.assertTrue( self.assertTrue(
UserConsent.objects.filter( UserConsent.objects.filter(
@ -119,7 +128,11 @@ class TestConsentStage(TestCase):
self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200)
self.assertJSONEqual( self.assertJSONEqual(
force_str(response.content), force_str(response.content),
{"to": reverse("authentik_core:root-redirect"), "type": "redirect"}, {
"component": "xak-flow-redirect",
"to": reverse("authentik_core:root-redirect"),
"type": ChallengeTypes.REDIRECT.value,
},
) )
self.assertTrue( self.assertTrue(
UserConsent.objects.filter( UserConsent.objects.filter(

View file

@ -1,5 +1,6 @@
"""authentik multi-stage authentication engine""" """authentik multi-stage authentication engine"""
from django.http.response import HttpResponse from django.http.response import HttpResponse
from rest_framework.fields import CharField
from authentik.flows.challenge import Challenge, ChallengeResponse, ChallengeTypes from authentik.flows.challenge import Challenge, ChallengeResponse, ChallengeTypes
from authentik.flows.stage import ChallengeStageView from authentik.flows.stage import ChallengeStageView
@ -8,10 +9,14 @@ from authentik.flows.stage import ChallengeStageView
class DummyChallenge(Challenge): class DummyChallenge(Challenge):
"""Dummy challenge""" """Dummy challenge"""
component = CharField(default="ak-stage-dummy")
class DummyChallengeResponse(ChallengeResponse): class DummyChallengeResponse(ChallengeResponse):
"""Dummy challenge response""" """Dummy challenge response"""
component = CharField(default="ak-stage-dummy")
class DummyStageView(ChallengeStageView): class DummyStageView(ChallengeStageView):
"""Dummy stage for testing with multiple stages""" """Dummy stage for testing with multiple stages"""
@ -25,7 +30,6 @@ class DummyStageView(ChallengeStageView):
return DummyChallenge( return DummyChallenge(
data={ data={
"type": ChallengeTypes.NATIVE.value, "type": ChallengeTypes.NATIVE.value,
"component": "ak-stage-dummy",
"title": self.executor.current_stage.name, "title": self.executor.current_stage.name,
} }
) )

View file

@ -4,6 +4,7 @@ from django.urls import reverse
from django.utils.encoding import force_str from django.utils.encoding import force_str
from authentik.core.models import User from authentik.core.models import User
from authentik.flows.challenge import ChallengeTypes
from authentik.flows.models import Flow, FlowDesignation, FlowStageBinding from authentik.flows.models import Flow, FlowDesignation, FlowStageBinding
from authentik.stages.dummy.models import DummyStage from authentik.stages.dummy.models import DummyStage
@ -45,5 +46,9 @@ class TestDummyStage(TestCase):
self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200)
self.assertJSONEqual( self.assertJSONEqual(
force_str(response.content), force_str(response.content),
{"to": reverse("authentik_core:root-redirect"), "type": "redirect"}, {
"component": "xak-flow-redirect",
"to": reverse("authentik_core:root-redirect"),
"type": ChallengeTypes.REDIRECT.value,
},
) )

View file

@ -8,6 +8,7 @@ from django.urls import reverse
from django.utils.http import urlencode from django.utils.http import urlencode
from django.utils.timezone import now from django.utils.timezone import now
from django.utils.translation import gettext as _ from django.utils.translation import gettext as _
from rest_framework.fields import CharField
from rest_framework.serializers import ValidationError from rest_framework.serializers import ValidationError
from structlog.stdlib import get_logger from structlog.stdlib import get_logger
@ -28,11 +29,15 @@ PLAN_CONTEXT_EMAIL_SENT = "email_sent"
class EmailChallenge(Challenge): class EmailChallenge(Challenge):
"""Email challenge""" """Email challenge"""
component = CharField(default="ak-stage-email")
class EmailChallengeResponse(ChallengeResponse): class EmailChallengeResponse(ChallengeResponse):
"""Email challenge resposen. No fields. This challenge is """Email challenge resposen. No fields. This challenge is
always declared invalid to give the user a chance to retry""" always declared invalid to give the user a chance to retry"""
component = CharField(default="ak-stage-email")
def validate(self, data): def validate(self, data):
raise ValidationError("") raise ValidationError("")
@ -97,7 +102,6 @@ class EmailStageView(ChallengeStageView):
challenge = EmailChallenge( challenge = EmailChallenge(
data={ data={
"type": ChallengeTypes.NATIVE.value, "type": ChallengeTypes.NATIVE.value,
"component": "ak-stage-email",
"title": "Email sent.", "title": "Email sent.",
} }
) )

View file

@ -8,6 +8,7 @@ from django.utils.encoding import force_str
from django.utils.http import urlencode from django.utils.http import urlencode
from authentik.core.models import Token, User from authentik.core.models import Token, User
from authentik.flows.challenge import ChallengeTypes
from authentik.flows.markers import StageMarker from authentik.flows.markers import StageMarker
from authentik.flows.models import Flow, FlowDesignation, FlowStageBinding from authentik.flows.models import Flow, FlowDesignation, FlowStageBinding
from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlan from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlan
@ -133,7 +134,11 @@ class TestEmailStage(TestCase):
self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200)
self.assertJSONEqual( self.assertJSONEqual(
force_str(response.content), force_str(response.content),
{"to": reverse("authentik_core:root-redirect"), "type": "redirect"}, {
"component": "xak-flow-redirect",
"to": reverse("authentik_core:root-redirect"),
"type": ChallengeTypes.REDIRECT.value,
},
) )
session = self.client.session session = self.client.session

View file

@ -36,11 +36,15 @@ class IdentificationChallenge(Challenge):
primary_action = CharField() primary_action = CharField()
sources = UILoginButtonSerializer(many=True, required=False) sources = UILoginButtonSerializer(many=True, required=False)
component = CharField(default="ak-stage-identification")
class IdentificationChallengeResponse(ChallengeResponse): class IdentificationChallengeResponse(ChallengeResponse):
"""Identification challenge""" """Identification challenge"""
uid_field = CharField() uid_field = CharField()
component = CharField(default="ak-stage-identification")
pre_user: Optional[User] = None pre_user: Optional[User] = None
def validate_uid_field(self, value: str) -> str: def validate_uid_field(self, value: str) -> str:
@ -81,8 +85,8 @@ class IdentificationStageView(ChallengeStageView):
challenge = IdentificationChallenge( challenge = IdentificationChallenge(
data={ data={
"type": ChallengeTypes.NATIVE.value, "type": ChallengeTypes.NATIVE.value,
"component": "ak-stage-identification",
"primary_action": _("Log in"), "primary_action": _("Log in"),
"component": "ak-stage-identification",
"user_fields": current_stage.user_fields, "user_fields": current_stage.user_fields,
} }
) )

View file

@ -53,7 +53,11 @@ class TestIdentificationStage(TestCase):
self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200)
self.assertJSONEqual( self.assertJSONEqual(
force_str(response.content), force_str(response.content),
{"to": reverse("authentik_core:root-redirect"), "type": "redirect"}, {
"component": "xak-flow-redirect",
"to": reverse("authentik_core:root-redirect"),
"type": ChallengeTypes.REDIRECT.value,
},
) )
def test_invalid_with_username(self): def test_invalid_with_username(self):
@ -118,8 +122,9 @@ class TestIdentificationStage(TestCase):
"icon_url": "/static/authentik/sources/.svg", "icon_url": "/static/authentik/sources/.svg",
"name": "test", "name": "test",
"challenge": { "challenge": {
"component": "xak-flow-redirect",
"to": "/source/oauth/login/test/", "to": "/source/oauth/login/test/",
"type": "redirect", "type": ChallengeTypes.REDIRECT.value,
}, },
} }
], ],
@ -162,8 +167,9 @@ class TestIdentificationStage(TestCase):
"sources": [ "sources": [
{ {
"challenge": { "challenge": {
"component": "xak-flow-redirect",
"to": "/source/oauth/login/test/", "to": "/source/oauth/login/test/",
"type": "redirect", "type": ChallengeTypes.REDIRECT.value,
}, },
"icon_url": "/static/authentik/sources/.svg", "icon_url": "/static/authentik/sources/.svg",
"name": "test", "name": "test",

View file

@ -89,7 +89,11 @@ class TestUserLoginStage(TestCase):
self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200)
self.assertJSONEqual( self.assertJSONEqual(
force_str(response.content), force_str(response.content),
{"to": reverse("authentik_core:root-redirect"), "type": "redirect"}, {
"component": "xak-flow-redirect",
"to": reverse("authentik_core:root-redirect"),
"type": ChallengeTypes.REDIRECT.value,
},
) )
self.stage.continue_flow_without_invitation = False self.stage.continue_flow_without_invitation = False
@ -123,7 +127,11 @@ class TestUserLoginStage(TestCase):
self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200)
self.assertJSONEqual( self.assertJSONEqual(
force_str(response.content), force_str(response.content),
{"to": reverse("authentik_core:root-redirect"), "type": "redirect"}, {
"component": "xak-flow-redirect",
"to": reverse("authentik_core:root-redirect"),
"type": ChallengeTypes.REDIRECT.value,
},
) )
def test_with_invitation_prompt_data(self): def test_with_invitation_prompt_data(self):
@ -154,7 +162,11 @@ class TestUserLoginStage(TestCase):
self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200)
self.assertJSONEqual( self.assertJSONEqual(
force_str(response.content), force_str(response.content),
{"to": reverse("authentik_core:root-redirect"), "type": "redirect"}, {
"component": "xak-flow-redirect",
"to": reverse("authentik_core:root-redirect"),
"type": ChallengeTypes.REDIRECT.value,
},
) )
self.assertFalse(Invitation.objects.filter(pk=invite.pk)) self.assertFalse(Invitation.objects.filter(pk=invite.pk))

View file

@ -63,12 +63,16 @@ class PasswordChallenge(WithUserInfoChallenge):
recovery_url = CharField(required=False) recovery_url = CharField(required=False)
component = CharField(default="ak-stage-password")
class PasswordChallengeResponse(ChallengeResponse): class PasswordChallengeResponse(ChallengeResponse):
"""Password challenge response""" """Password challenge response"""
password = CharField() password = CharField()
component = CharField(default="ak-stage-password")
class PasswordStageView(ChallengeStageView): class PasswordStageView(ChallengeStageView):
"""Authentication stage which authenticates against django's AuthBackend""" """Authentication stage which authenticates against django's AuthBackend"""
@ -79,7 +83,6 @@ class PasswordStageView(ChallengeStageView):
challenge = PasswordChallenge( challenge = PasswordChallenge(
data={ data={
"type": ChallengeTypes.NATIVE.value, "type": ChallengeTypes.NATIVE.value,
"component": "ak-stage-password",
} }
) )
recovery_flow = Flow.objects.filter(designation=FlowDesignation.RECOVERY) recovery_flow = Flow.objects.filter(designation=FlowDesignation.RECOVERY)

View file

@ -118,7 +118,11 @@ class TestPasswordStage(TestCase):
self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200)
self.assertJSONEqual( self.assertJSONEqual(
force_str(response.content), force_str(response.content),
{"to": reverse("authentik_core:root-redirect"), "type": "redirect"}, {
"component": "xak-flow-redirect",
"to": reverse("authentik_core:root-redirect"),
"type": ChallengeTypes.REDIRECT.value,
},
) )
def test_invalid_password(self): def test_invalid_password(self):

View file

@ -26,31 +26,38 @@ LOGGER = get_logger()
PLAN_CONTEXT_PROMPT = "prompt_data" PLAN_CONTEXT_PROMPT = "prompt_data"
class PromptSerializer(PassiveSerializer): class StagePromptSerializer(PassiveSerializer):
"""Serializer for a single Prompt field""" """Serializer for a single Prompt field"""
field_key = CharField() field_key = CharField()
label = CharField(allow_blank=True) label = CharField(allow_blank=True)
type = CharField() type = CharField()
required = BooleanField() required = BooleanField()
placeholder = CharField() placeholder = CharField(allow_blank=True)
order = IntegerField() order = IntegerField()
class PromptChallenge(Challenge): class PromptChallenge(Challenge):
"""Initial challenge being sent, define fields""" """Initial challenge being sent, define fields"""
fields = PromptSerializer(many=True) fields = StagePromptSerializer(many=True)
component = CharField(default="ak-stage-prompt")
class PromptResponseChallenge(ChallengeResponse): class PromptChallengeResponse(ChallengeResponse):
"""Validate response, fields are dynamically created based """Validate response, fields are dynamically created based
on the stage""" on the stage"""
def __init__(self, *args, stage: PromptStage, plan: FlowPlan, **kwargs): component = CharField(default="ak-stage-prompt")
def __init__(self, *args, **kwargs):
stage: PromptStage = kwargs.pop("stage", None)
plan: FlowPlan = kwargs.pop("plan", None)
super().__init__(*args, **kwargs) super().__init__(*args, **kwargs)
self.stage = stage self.stage = stage
self.plan = plan self.plan = plan
if not self.stage:
return
# list() is called so we only load the fields once # list() is called so we only load the fields once
fields = list(self.stage.fields.all()) fields = list(self.stage.fields.all())
for field in fields: for field in fields:
@ -152,15 +159,14 @@ class ListPolicyEngine(PolicyEngine):
class PromptStageView(ChallengeStageView): class PromptStageView(ChallengeStageView):
"""Prompt Stage, save form data in plan context.""" """Prompt Stage, save form data in plan context."""
response_class = PromptResponseChallenge response_class = PromptChallengeResponse
def get_challenge(self, *args, **kwargs) -> Challenge: def get_challenge(self, *args, **kwargs) -> Challenge:
fields = list(self.executor.current_stage.fields.all().order_by("order")) fields = list(self.executor.current_stage.fields.all().order_by("order"))
challenge = PromptChallenge( challenge = PromptChallenge(
data={ data={
"type": ChallengeTypes.NATIVE.value, "type": ChallengeTypes.NATIVE.value,
"component": "ak-stage-prompt", "fields": [StagePromptSerializer(field).data for field in fields],
"fields": [PromptSerializer(field).data for field in fields],
}, },
) )
return challenge return challenge
@ -168,7 +174,7 @@ class PromptStageView(ChallengeStageView):
def get_response_instance(self, data: QueryDict) -> ChallengeResponse: def get_response_instance(self, data: QueryDict) -> ChallengeResponse:
if not self.executor.plan: if not self.executor.plan:
raise ValueError raise ValueError
return PromptResponseChallenge( return PromptChallengeResponse(
instance=None, instance=None,
data=data, data=data,
stage=self.executor.current_stage, stage=self.executor.current_stage,

View file

@ -6,13 +6,14 @@ from django.urls import reverse
from django.utils.encoding import force_str from django.utils.encoding import force_str
from authentik.core.models import User from authentik.core.models import User
from authentik.flows.challenge import ChallengeTypes
from authentik.flows.markers import StageMarker from authentik.flows.markers import StageMarker
from authentik.flows.models import Flow, FlowDesignation, FlowStageBinding from authentik.flows.models import Flow, FlowDesignation, FlowStageBinding
from authentik.flows.planner import FlowPlan from authentik.flows.planner import FlowPlan
from authentik.flows.views import SESSION_KEY_PLAN from authentik.flows.views import SESSION_KEY_PLAN
from authentik.policies.expression.models import ExpressionPolicy from authentik.policies.expression.models import ExpressionPolicy
from authentik.stages.prompt.models import FieldTypes, Prompt, PromptStage from authentik.stages.prompt.models import FieldTypes, Prompt, PromptStage
from authentik.stages.prompt.stage import PLAN_CONTEXT_PROMPT, PromptResponseChallenge from authentik.stages.prompt.stage import PLAN_CONTEXT_PROMPT, PromptChallengeResponse
class TestPromptStage(TestCase): class TestPromptStage(TestCase):
@ -111,7 +112,7 @@ class TestPromptStage(TestCase):
self.assertIn(prompt.label, force_str(response.content)) self.assertIn(prompt.label, force_str(response.content))
self.assertIn(prompt.placeholder, force_str(response.content)) self.assertIn(prompt.placeholder, force_str(response.content))
def test_valid_challenge_with_policy(self) -> PromptResponseChallenge: def test_valid_challenge_with_policy(self) -> PromptChallengeResponse:
"""Test challenge_response validation""" """Test challenge_response validation"""
plan = FlowPlan( plan = FlowPlan(
flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()] flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
@ -122,13 +123,13 @@ class TestPromptStage(TestCase):
) )
self.stage.validation_policies.set([expr_policy]) self.stage.validation_policies.set([expr_policy])
self.stage.save() self.stage.save()
challenge_response = PromptResponseChallenge( challenge_response = PromptChallengeResponse(
None, stage=self.stage, plan=plan, data=self.prompt_data None, stage=self.stage, plan=plan, data=self.prompt_data
) )
self.assertEqual(challenge_response.is_valid(), True) self.assertEqual(challenge_response.is_valid(), True)
return challenge_response return challenge_response
def test_invalid_challenge(self) -> PromptResponseChallenge: def test_invalid_challenge(self) -> PromptChallengeResponse:
"""Test challenge_response validation""" """Test challenge_response validation"""
plan = FlowPlan( plan = FlowPlan(
flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()] flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
@ -139,7 +140,7 @@ class TestPromptStage(TestCase):
) )
self.stage.validation_policies.set([expr_policy]) self.stage.validation_policies.set([expr_policy])
self.stage.save() self.stage.save()
challenge_response = PromptResponseChallenge( challenge_response = PromptChallengeResponse(
None, stage=self.stage, plan=plan, data=self.prompt_data None, stage=self.stage, plan=plan, data=self.prompt_data
) )
self.assertEqual(challenge_response.is_valid(), False) self.assertEqual(challenge_response.is_valid(), False)
@ -167,7 +168,11 @@ class TestPromptStage(TestCase):
self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200)
self.assertJSONEqual( self.assertJSONEqual(
force_str(response.content), force_str(response.content),
{"to": reverse("authentik_core:root-redirect"), "type": "redirect"}, {
"component": "xak-flow-redirect",
"to": reverse("authentik_core:root-redirect"),
"type": ChallengeTypes.REDIRECT.value,
},
) )
# Check that valid data has been saved # Check that valid data has been saved

View file

@ -75,7 +75,11 @@ class TestUserDeleteStage(TestCase):
self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200)
self.assertJSONEqual( self.assertJSONEqual(
force_str(response.content), force_str(response.content),
{"to": reverse("authentik_core:root-redirect"), "type": "redirect"}, {
"component": "xak-flow-redirect",
"to": reverse("authentik_core:root-redirect"),
"type": ChallengeTypes.REDIRECT.value,
},
) )
self.assertFalse(User.objects.filter(username=self.username).exists()) self.assertFalse(User.objects.filter(username=self.username).exists())

View file

@ -49,7 +49,11 @@ class TestUserLoginStage(TestCase):
self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200)
self.assertJSONEqual( self.assertJSONEqual(
force_str(response.content), force_str(response.content),
{"to": reverse("authentik_core:root-redirect"), "type": "redirect"}, {
"component": "xak-flow-redirect",
"to": reverse("authentik_core:root-redirect"),
"type": ChallengeTypes.REDIRECT.value,
},
) )
def test_expiry(self): def test_expiry(self):
@ -70,7 +74,11 @@ class TestUserLoginStage(TestCase):
self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200)
self.assertJSONEqual( self.assertJSONEqual(
force_str(response.content), force_str(response.content),
{"to": reverse("authentik_core:root-redirect"), "type": "redirect"}, {
"component": "xak-flow-redirect",
"to": reverse("authentik_core:root-redirect"),
"type": ChallengeTypes.REDIRECT.value,
},
) )
self.assertNotEqual(list(self.client.session.keys()), []) self.assertNotEqual(list(self.client.session.keys()), [])
sleep(3) sleep(3)

View file

@ -4,6 +4,7 @@ from django.urls import reverse
from django.utils.encoding import force_str from django.utils.encoding import force_str
from authentik.core.models import User from authentik.core.models import User
from authentik.flows.challenge import ChallengeTypes
from authentik.flows.markers import StageMarker from authentik.flows.markers import StageMarker
from authentik.flows.models import Flow, FlowDesignation, FlowStageBinding from authentik.flows.models import Flow, FlowDesignation, FlowStageBinding
from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlan from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlan
@ -48,5 +49,9 @@ class TestUserLogoutStage(TestCase):
self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200)
self.assertJSONEqual( self.assertJSONEqual(
force_str(response.content), force_str(response.content),
{"to": reverse("authentik_core:root-redirect"), "type": "redirect"}, {
"component": "xak-flow-redirect",
"to": reverse("authentik_core:root-redirect"),
"type": ChallengeTypes.REDIRECT.value,
},
) )

View file

@ -2,6 +2,7 @@
from django.contrib import messages from django.contrib import messages
from django.contrib.auth import update_session_auth_hash from django.contrib.auth import update_session_auth_hash
from django.contrib.auth.backends import ModelBackend from django.contrib.auth.backends import ModelBackend
from django.db.utils import IntegrityError
from django.http import HttpRequest, HttpResponse from django.http import HttpRequest, HttpResponse
from django.utils.translation import gettext as _ from django.utils.translation import gettext as _
from structlog.stdlib import get_logger from structlog.stdlib import get_logger
@ -84,7 +85,11 @@ class UserWriteStageView(StageView):
PLAN_CONTEXT_SOURCES_CONNECTION PLAN_CONTEXT_SOURCES_CONNECTION
] ]
user.attributes[USER_ATTRIBUTE_SOURCES].append(connection.source.name) user.attributes[USER_ATTRIBUTE_SOURCES].append(connection.source.name)
try:
user.save() user.save()
except IntegrityError as exc:
LOGGER.warning("Failed to save user", exc=exc)
self.executor.stage_invalid()
user_write.send( user_write.send(
sender=self, request=request, user=user, data=data, created=user_created sender=self, request=request, user=user, data=data, created=user_created
) )

View file

@ -60,7 +60,11 @@ class TestUserWriteStage(TestCase):
self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200)
self.assertJSONEqual( self.assertJSONEqual(
force_str(response.content), force_str(response.content),
{"to": reverse("authentik_core:root-redirect"), "type": "redirect"}, {
"component": "xak-flow-redirect",
"to": reverse("authentik_core:root-redirect"),
"type": ChallengeTypes.REDIRECT.value,
},
) )
user_qs = User.objects.filter( user_qs = User.objects.filter(
username=plan.context[PLAN_CONTEXT_PROMPT]["username"] username=plan.context[PLAN_CONTEXT_PROMPT]["username"]
@ -97,7 +101,11 @@ class TestUserWriteStage(TestCase):
self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200)
self.assertJSONEqual( self.assertJSONEqual(
force_str(response.content), force_str(response.content),
{"to": reverse("authentik_core:root-redirect"), "type": "redirect"}, {
"component": "xak-flow-redirect",
"to": reverse("authentik_core:root-redirect"),
"type": ChallengeTypes.REDIRECT.value,
},
) )
user_qs = User.objects.filter( user_qs = User.objects.filter(
username=plan.context[PLAN_CONTEXT_PROMPT]["username"] username=plan.context[PLAN_CONTEXT_PROMPT]["username"]

View file

@ -8,6 +8,7 @@ import (
"net/http" "net/http"
"net/http/cookiejar" "net/http/cookiejar"
"net/url" "net/url"
"strconv"
"strings" "strings"
"time" "time"
@ -52,8 +53,6 @@ func (pi *ProviderInstance) Bind(username string, bindDN, bindPW string, conn ne
// Create new http client that also sets the correct ip // Create new http client that also sets the correct ip
config := api.NewConfiguration() config := api.NewConfiguration()
// Carry over the bearer authentication, so that failed login attempts are attributed to the outpost
config.DefaultHeader = pi.s.ac.Client.GetConfig().DefaultHeader
config.Host = pi.s.ac.Client.GetConfig().Host config.Host = pi.s.ac.Client.GetConfig().Host
config.Scheme = pi.s.ac.Client.GetConfig().Scheme config.Scheme = pi.s.ac.Client.GetConfig().Scheme
config.HTTPClient = &http.Client{ config.HTTPClient = &http.Client{
@ -75,7 +74,7 @@ func (pi *ProviderInstance) Bind(username string, bindDN, bindPW string, conn ne
if !passed { if !passed {
return ldap.LDAPResultInvalidCredentials, nil return ldap.LDAPResultInvalidCredentials, nil
} }
r, err := pi.s.ac.Client.CoreApi.CoreApplicationsCheckAccessRetrieve(context.Background(), pi.appSlug).Execute() r, err := apiClient.CoreApi.CoreApplicationsCheckAccessRetrieve(context.Background(), pi.appSlug).Execute()
if r.StatusCode == 403 { if r.StatusCode == 403 {
pi.log.WithField("bindDN", bindDN).Info("Access denied for user") pi.log.WithField("bindDN", bindDN).Info("Access denied for user")
return ldap.LDAPResultInsufficientAccessRights, nil return ldap.LDAPResultInsufficientAccessRights, nil
@ -86,7 +85,7 @@ func (pi *ProviderInstance) Bind(username string, bindDN, bindPW string, conn ne
} }
pi.log.WithField("bindDN", bindDN).Info("User has access") pi.log.WithField("bindDN", bindDN).Info("User has access")
// Get user info to store in context // Get user info to store in context
userInfo, _, err := pi.s.ac.Client.CoreApi.CoreUsersMeRetrieve(context.Background()).Execute() userInfo, _, err := apiClient.CoreApi.CoreUsersMeRetrieve(context.Background()).Execute()
if err != nil { if err != nil {
pi.log.WithField("bindDN", bindDN).WithError(err).Warning("failed to get user info") pi.log.WithField("bindDN", bindDN).WithError(err).Warning("failed to get user info")
return ldap.LDAPResultOperationsError, nil return ldap.LDAPResultOperationsError, nil
@ -133,48 +132,69 @@ func (pi *ProviderInstance) delayDeleteUserInfo(dn string) {
}() }()
} }
type ChallengeInt interface {
GetComponent() string
GetType() api.ChallengeChoices
GetResponseErrors() map[string][]api.ErrorDetail
}
func (pi *ProviderInstance) solveFlowChallenge(bindDN string, password string, client *api.APIClient, urlParams string, depth int) (bool, error) { func (pi *ProviderInstance) solveFlowChallenge(bindDN string, password string, client *api.APIClient, urlParams string, depth int) (bool, error) {
req := client.FlowsApi.FlowsExecutorGet(context.Background(), pi.flowSlug) req := client.FlowsApi.FlowsExecutorGet(context.Background(), pi.flowSlug).Query(urlParams)
req.Query(urlParams)
challenge, _, err := req.Execute() challenge, _, err := req.Execute()
if err != nil { if err != nil {
pi.log.WithError(err).Warning("Failed to get challenge") pi.log.WithError(err).Warning("Failed to get challenge")
return false, err return false, err
} }
pi.log.WithField("component", challenge.Component).WithField("type", challenge.Type).Debug("Got challenge") ch := challenge.GetActualInstance().(ChallengeInt)
responseReq := client.FlowsApi.FlowsExecutorSolve(context.Background(), pi.flowSlug) pi.log.WithField("component", ch.GetComponent()).WithField("type", ch.GetType()).Debug("Got challenge")
responseReq.Query(urlParams) responseReq := client.FlowsApi.FlowsExecutorSolve(context.Background(), pi.flowSlug).Query(urlParams)
switch *challenge.Component { switch ch.GetComponent() {
case "ak-stage-identification": case "ak-stage-identification":
responseReq.RequestBody(map[string]interface{}{ responseReq = responseReq.FlowChallengeResponseRequest(api.IdentificationChallengeResponseRequestAsFlowChallengeResponseRequest(api.NewIdentificationChallengeResponseRequest(bindDN)))
"uid_field": bindDN,
})
case "ak-stage-password": case "ak-stage-password":
responseReq.RequestBody(map[string]interface{}{ responseReq = responseReq.FlowChallengeResponseRequest(api.PasswordChallengeResponseRequestAsFlowChallengeResponseRequest(api.NewPasswordChallengeResponseRequest(password)))
"password": password, case "ak-stage-authenticator-validate":
}) // We only support duo as authenticator, check if that's allowed
var deviceChallenge *api.DeviceChallenge
for _, devCh := range challenge.AuthenticatorValidationChallenge.DeviceChallenges {
if devCh.DeviceClass == string(api.DEVICECLASSESENUM_DUO) {
deviceChallenge = &devCh
}
}
if deviceChallenge == nil {
return false, errors.New("got ak-stage-authenticator-validate without duo")
}
devId, err := strconv.Atoi(deviceChallenge.DeviceUid)
if err != nil {
return false, errors.New("failed to convert duo device id to int")
}
devId32 := int32(devId)
inner := api.NewAuthenticatorValidationChallengeResponseRequest()
inner.Duo = &devId32
responseReq = responseReq.FlowChallengeResponseRequest(api.AuthenticatorValidationChallengeResponseRequestAsFlowChallengeResponseRequest(inner))
case "ak-stage-access-denied": case "ak-stage-access-denied":
return false, errors.New("got ak-stage-access-denied") return false, errors.New("got ak-stage-access-denied")
default: default:
return false, fmt.Errorf("unsupported challenge type: %s", *challenge.Component) return false, fmt.Errorf("unsupported challenge type: %s", ch.GetComponent())
} }
response, _, err := responseReq.Execute() response, _, err := responseReq.Execute()
pi.log.WithField("component", response.Component).WithField("type", response.Type).Debug("Got response") ch = response.GetActualInstance().(ChallengeInt)
switch *response.Component { pi.log.WithField("component", ch.GetComponent()).WithField("type", ch.GetType()).Debug("Got response")
switch ch.GetComponent() {
case "ak-stage-access-denied": case "ak-stage-access-denied":
return false, errors.New("got ak-stage-access-denied") return false, errors.New("got ak-stage-access-denied")
} }
if response.Type == "redirect" { if ch.GetType() == "redirect" {
return true, nil return true, nil
} }
if err != nil { if err != nil {
pi.log.WithError(err).Warning("Failed to submit challenge") pi.log.WithError(err).Warning("Failed to submit challenge")
return false, err return false, err
} }
if len(*response.ResponseErrors) > 0 { if len(ch.GetResponseErrors()) > 0 {
for key, errs := range *response.ResponseErrors { for key, errs := range ch.GetResponseErrors() {
for _, err := range errs { for _, err := range errs {
pi.log.WithField("key", key).WithField("code", err.Code).Debug(err.String) pi.log.WithField("key", key).WithField("code", err.Code).WithField("msg", err.String).Warning("Flow error")
return false, nil return false, nil
} }
} }

View file

@ -8,8 +8,15 @@ import (
"strings" "strings"
"github.com/nmcclain/ldap" "github.com/nmcclain/ldap"
"goauthentik.io/outpost/api"
) )
func (pi *ProviderInstance) SearchMe(user api.User, searchReq ldap.SearchRequest, conn net.Conn) (ldap.ServerSearchResult, error) {
entries := make([]*ldap.Entry, 1)
entries[0] = pi.UserEntry(user)
return ldap.ServerSearchResult{Entries: entries, Referrals: []string{}, Controls: []ldap.Control{}, ResultCode: ldap.LDAPResultSuccess}, nil
}
func (pi *ProviderInstance) Search(bindDN string, searchReq ldap.SearchRequest, conn net.Conn) (ldap.ServerSearchResult, error) { func (pi *ProviderInstance) Search(bindDN string, searchReq ldap.SearchRequest, conn net.Conn) (ldap.ServerSearchResult, error) {
bindDN = strings.ToLower(bindDN) bindDN = strings.ToLower(bindDN)
baseDN := strings.ToLower("," + pi.BaseDN) baseDN := strings.ToLower("," + pi.BaseDN)
@ -29,14 +36,13 @@ func (pi *ProviderInstance) Search(bindDN string, searchReq ldap.SearchRequest,
pi.boundUsersMutex.RLock() pi.boundUsersMutex.RLock()
defer pi.boundUsersMutex.RUnlock() defer pi.boundUsersMutex.RUnlock()
flags, ok := pi.boundUsers[bindDN] flags, ok := pi.boundUsers[bindDN]
pi.log.WithField("bindDN", bindDN).WithField("ok", ok).Debugf("%+v\n", flags)
if !ok { if !ok {
pi.log.Debug("User info not cached") pi.log.Debug("User info not cached")
return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultInsufficientAccessRights}, errors.New("access denied") return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultInsufficientAccessRights}, errors.New("access denied")
} }
if !flags.CanSearch { if !flags.CanSearch {
pi.log.Debug("User can't search") pi.log.Debug("User can't search, showing info about user")
return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultInsufficientAccessRights}, errors.New("access denied") return pi.SearchMe(flags.UserInfo, searchReq, conn)
} }
switch filterEntity { switch filterEntity {
@ -49,24 +55,7 @@ func (pi *ProviderInstance) Search(bindDN string, searchReq ldap.SearchRequest,
} }
pi.log.WithField("count", len(groups.Results)).Trace("Got results from API") pi.log.WithField("count", len(groups.Results)).Trace("Got results from API")
for _, g := range groups.Results { for _, g := range groups.Results {
attrs := []*ldap.EntryAttribute{ entries = append(entries, pi.GroupEntry(g))
{
Name: "cn",
Values: []string{g.Name},
},
{
Name: "uid",
Values: []string{string(g.Pk)},
},
{
Name: "objectClass",
Values: []string{GroupObjectClass, "goauthentik.io/ldap/group"},
},
}
attrs = append(attrs, AKAttrsToLDAP(g.Attributes)...)
dn := pi.GetGroupDN(g)
entries = append(entries, &ldap.Entry{DN: dn, Attributes: attrs})
} }
case UserObjectClass, "": case UserObjectClass, "":
users, _, err := pi.s.ac.Client.CoreApi.CoreUsersList(context.Background()).Execute() users, _, err := pi.s.ac.Client.CoreApi.CoreUsersList(context.Background()).Execute()
@ -74,6 +63,14 @@ func (pi *ProviderInstance) Search(bindDN string, searchReq ldap.SearchRequest,
return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("API Error: %s", err) return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("API Error: %s", err)
} }
for _, u := range users.Results { for _, u := range users.Results {
entries = append(entries, pi.UserEntry(u))
}
}
pi.log.WithField("filter", searchReq.Filter).Debug("Search OK")
return ldap.ServerSearchResult{Entries: entries, Referrals: []string{}, Controls: []ldap.Control{}, ResultCode: ldap.LDAPResultSuccess}, nil
}
func (pi *ProviderInstance) UserEntry(u api.User) *ldap.Entry {
attrs := []*ldap.EntryAttribute{ attrs := []*ldap.EntryAttribute{
{ {
Name: "cn", Name: "cn",
@ -118,9 +115,27 @@ func (pi *ProviderInstance) Search(bindDN string, searchReq ldap.SearchRequest,
attrs = append(attrs, AKAttrsToLDAP(u.Attributes)...) attrs = append(attrs, AKAttrsToLDAP(u.Attributes)...)
dn := fmt.Sprintf("cn=%s,%s", u.Username, pi.UserDN) dn := fmt.Sprintf("cn=%s,%s", u.Username, pi.UserDN)
entries = append(entries, &ldap.Entry{DN: dn, Attributes: attrs})
return &ldap.Entry{DN: dn, Attributes: attrs}
} }
func (pi *ProviderInstance) GroupEntry(g api.Group) *ldap.Entry {
attrs := []*ldap.EntryAttribute{
{
Name: "cn",
Values: []string{g.Name},
},
{
Name: "uid",
Values: []string{string(g.Pk)},
},
{
Name: "objectClass",
Values: []string{GroupObjectClass, "goauthentik.io/ldap/group"},
},
} }
pi.log.WithField("filter", searchReq.Filter).Debug("Search OK") attrs = append(attrs, AKAttrsToLDAP(g.Attributes)...)
return ldap.ServerSearchResult{Entries: entries, Referrals: []string{}, Controls: []ldap.Control{}, ResultCode: ldap.LDAPResultSuccess}, nil
dn := pi.GetGroupDN(g)
return &ldap.Entry{DN: dn, Attributes: attrs}
} }

View file

@ -9,7 +9,8 @@ import (
func AKAttrsToLDAP(attrs interface{}) []*ldap.EntryAttribute { func AKAttrsToLDAP(attrs interface{}) []*ldap.EntryAttribute {
attrList := []*ldap.EntryAttribute{} attrList := []*ldap.EntryAttribute{}
for attrKey, attrValue := range attrs.(map[string]interface{}) { a := attrs.(*map[string]interface{})
for attrKey, attrValue := range *a {
entry := &ldap.EntryAttribute{Name: attrKey} entry := &ldap.EntryAttribute{Name: attrKey}
switch t := attrValue.(type) { switch t := attrValue.(type) {
case []string: case []string:

1450
schema.yml

File diff suppressed because it is too large Load diff

View file

@ -27,6 +27,7 @@ class TestFlowsAuthenticator(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
def test_totp_validate(self): def test_totp_validate(self):
"""test flow with otp stages""" """test flow with otp stages"""
sleep(1) sleep(1)
@ -65,6 +66,7 @@ class TestFlowsAuthenticator(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_stages_authenticator_totp", "0006_default_setup_flow") @apply_migration("authentik_stages_authenticator_totp", "0006_default_setup_flow")
def test_totp_setup(self): def test_totp_setup(self):
"""test TOTP Setup stage""" """test TOTP Setup stage"""
@ -115,6 +117,7 @@ class TestFlowsAuthenticator(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_stages_authenticator_static", "0005_default_setup_flow") @apply_migration("authentik_stages_authenticator_static", "0005_default_setup_flow")
def test_static_setup(self): def test_static_setup(self):
"""test Static OTP Setup stage""" """test Static OTP Setup stage"""

View file

@ -40,6 +40,7 @@ class TestFlowsEnroll(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
def test_enroll_2_step(self): def test_enroll_2_step(self):
"""Test 2-step enroll flow""" """Test 2-step enroll flow"""
# First stage fields # First stage fields
@ -77,6 +78,7 @@ class TestFlowsEnroll(SeleniumTestCase):
flow = Flow.objects.create( flow = Flow.objects.create(
name="default-enrollment-flow", name="default-enrollment-flow",
slug="default-enrollment-flow", slug="default-enrollment-flow",
title="default-enrollment-flow",
designation=FlowDesignation.ENROLLMENT, designation=FlowDesignation.ENROLLMENT,
) )
@ -108,6 +110,7 @@ class TestFlowsEnroll(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@override_settings(EMAIL_BACKEND="django.core.mail.backends.smtp.EmailBackend") @override_settings(EMAIL_BACKEND="django.core.mail.backends.smtp.EmailBackend")
def test_enroll_email(self): def test_enroll_email(self):
"""Test enroll with Email verification""" """Test enroll with Email verification"""
@ -152,6 +155,7 @@ class TestFlowsEnroll(SeleniumTestCase):
flow = Flow.objects.create( flow = Flow.objects.create(
name="default-enrollment-flow", name="default-enrollment-flow",
slug="default-enrollment-flow", slug="default-enrollment-flow",
title="default-enrollment-flow",
designation=FlowDesignation.ENROLLMENT, designation=FlowDesignation.ENROLLMENT,
) )

View file

@ -12,6 +12,7 @@ class TestFlowsLogin(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
def test_login(self): def test_login(self):
"""test default login flow""" """test default login flow"""
self.driver.get( self.driver.get(

View file

@ -19,6 +19,7 @@ class TestFlowsStageSetup(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_stages_password", "0002_passwordstage_change_flow") @apply_migration("authentik_stages_password", "0002_passwordstage_change_flow")
def test_password_change(self): def test_password_change(self):
"""test password change flow""" """test password change flow"""

View file

@ -63,6 +63,7 @@ class TestProviderOAuth2Github(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0010_provider_flows") @apply_migration("authentik_flows", "0010_provider_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
def test_authorization_consent_implied(self): def test_authorization_consent_implied(self):
@ -117,6 +118,7 @@ class TestProviderOAuth2Github(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0010_provider_flows") @apply_migration("authentik_flows", "0010_provider_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
def test_authorization_consent_explicit(self): def test_authorization_consent_explicit(self):
@ -194,6 +196,7 @@ class TestProviderOAuth2Github(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0010_provider_flows") @apply_migration("authentik_flows", "0010_provider_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
def test_denied(self): def test_denied(self):

View file

@ -83,6 +83,7 @@ class TestProviderOAuth2OAuth(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0010_provider_flows") @apply_migration("authentik_flows", "0010_provider_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
def test_redirect_uri_error(self): def test_redirect_uri_error(self):
@ -124,6 +125,7 @@ class TestProviderOAuth2OAuth(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0010_provider_flows") @apply_migration("authentik_flows", "0010_provider_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
@object_manager @object_manager
@ -186,6 +188,7 @@ class TestProviderOAuth2OAuth(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0010_provider_flows") @apply_migration("authentik_flows", "0010_provider_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
@object_manager @object_manager
@ -256,6 +259,7 @@ class TestProviderOAuth2OAuth(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0010_provider_flows") @apply_migration("authentik_flows", "0010_provider_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
@object_manager @object_manager
@ -337,6 +341,7 @@ class TestProviderOAuth2OAuth(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0010_provider_flows") @apply_migration("authentik_flows", "0010_provider_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
def test_authorization_denied(self): def test_authorization_denied(self):

View file

@ -78,6 +78,7 @@ class TestProviderOAuth2OIDC(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0010_provider_flows") @apply_migration("authentik_flows", "0010_provider_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
def test_redirect_uri_error(self): def test_redirect_uri_error(self):
@ -119,6 +120,7 @@ class TestProviderOAuth2OIDC(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0010_provider_flows") @apply_migration("authentik_flows", "0010_provider_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
@object_manager @object_manager
@ -168,6 +170,7 @@ class TestProviderOAuth2OIDC(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0010_provider_flows") @apply_migration("authentik_flows", "0010_provider_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
@object_manager @object_manager
@ -234,6 +237,7 @@ class TestProviderOAuth2OIDC(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0010_provider_flows") @apply_migration("authentik_flows", "0010_provider_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
def test_authorization_denied(self): def test_authorization_denied(self):

View file

@ -78,6 +78,7 @@ class TestProviderOAuth2OIDCImplicit(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0010_provider_flows") @apply_migration("authentik_flows", "0010_provider_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
def test_redirect_uri_error(self): def test_redirect_uri_error(self):
@ -119,6 +120,7 @@ class TestProviderOAuth2OIDCImplicit(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0010_provider_flows") @apply_migration("authentik_flows", "0010_provider_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
@object_manager @object_manager
@ -165,6 +167,7 @@ class TestProviderOAuth2OIDCImplicit(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0010_provider_flows") @apply_migration("authentik_flows", "0010_provider_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
@object_manager @object_manager
@ -228,6 +231,7 @@ class TestProviderOAuth2OIDCImplicit(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0010_provider_flows") @apply_migration("authentik_flows", "0010_provider_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
def test_authorization_denied(self): def test_authorization_denied(self):

View file

@ -60,6 +60,7 @@ class TestProviderProxy(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0010_provider_flows") @apply_migration("authentik_flows", "0010_provider_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
@object_manager @object_manager
@ -112,6 +113,7 @@ class TestProviderProxyConnect(ChannelsLiveServerTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0010_provider_flows") @apply_migration("authentik_flows", "0010_provider_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
@object_manager @object_manager

View file

@ -74,6 +74,7 @@ class TestProviderSAML(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0010_provider_flows") @apply_migration("authentik_flows", "0010_provider_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
@object_manager @object_manager
@ -138,6 +139,7 @@ class TestProviderSAML(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0010_provider_flows") @apply_migration("authentik_flows", "0010_provider_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
@object_manager @object_manager
@ -219,6 +221,7 @@ class TestProviderSAML(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0010_provider_flows") @apply_migration("authentik_flows", "0010_provider_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
@object_manager @object_manager
@ -289,6 +292,7 @@ class TestProviderSAML(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0010_provider_flows") @apply_migration("authentik_flows", "0010_provider_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
@object_manager @object_manager

View file

@ -131,6 +131,7 @@ class TestSourceOAuth2(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0009_source_flows") @apply_migration("authentik_flows", "0009_source_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
@object_manager @object_manager
@ -188,6 +189,7 @@ class TestSourceOAuth2(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0009_source_flows") @apply_migration("authentik_flows", "0009_source_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
@object_manager @object_manager
@ -228,6 +230,7 @@ class TestSourceOAuth2(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0009_source_flows") @apply_migration("authentik_flows", "0009_source_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
@object_manager @object_manager
@ -318,6 +321,7 @@ class TestSourceOAuth1(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0009_source_flows") @apply_migration("authentik_flows", "0009_source_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
@patch( @patch(

View file

@ -98,6 +98,7 @@ class TestSourceSAML(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0009_source_flows") @apply_migration("authentik_flows", "0009_source_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
@apply_migration( @apply_migration(
@ -166,6 +167,7 @@ class TestSourceSAML(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0009_source_flows") @apply_migration("authentik_flows", "0009_source_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
@apply_migration( @apply_migration(
@ -247,6 +249,7 @@ class TestSourceSAML(SeleniumTestCase):
@retry() @retry()
@apply_migration("authentik_core", "0003_default_user") @apply_migration("authentik_core", "0003_default_user")
@apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0008_default_flows")
@apply_migration("authentik_flows", "0011_flow_title")
@apply_migration("authentik_flows", "0009_source_flows") @apply_migration("authentik_flows", "0009_source_flows")
@apply_migration("authentik_crypto", "0002_create_self_signed_kp") @apply_migration("authentik_crypto", "0002_create_self_signed_kp")
@apply_migration( @apply_migration(

View file

@ -136,13 +136,13 @@ class SeleniumTestCase(StaticLiveServerTestCase):
) )
identification_stage.find_element( identification_stage.find_element(
By.CSS_SELECTOR, "input[name=uid_field]" By.CSS_SELECTOR, "input[name=uidField]"
).click() ).click()
identification_stage.find_element( identification_stage.find_element(
By.CSS_SELECTOR, "input[name=uid_field]" By.CSS_SELECTOR, "input[name=uidField]"
).send_keys(USER().username) ).send_keys(USER().username)
identification_stage.find_element( identification_stage.find_element(
By.CSS_SELECTOR, "input[name=uid_field]" By.CSS_SELECTOR, "input[name=uidField]"
).send_keys(Keys.ENTER) ).send_keys(Keys.ENTER)
flow_executor = self.get_shadow_root("ak-flow-executor") flow_executor = self.get_shadow_root("ak-flow-executor")

View file

@ -8,23 +8,3 @@ export interface Error {
export interface ErrorDict { export interface ErrorDict {
[key: string]: Error[]; [key: string]: Error[];
} }
export interface Challenge {
type: ChallengeChoices;
component?: string;
title?: string;
response_errors?: ErrorDict;
}
export interface WithUserInfoChallenge extends Challenge {
pending_user: string;
pending_user_avatar: string;
}
export interface ShellChallenge extends Challenge {
body: string;
}
export interface RedirectChallenge extends Challenge {
to: string;
}

View file

@ -13,6 +13,7 @@ import { unsafeHTML } from "lit-html/directives/unsafe-html";
import "./access_denied/FlowAccessDenied"; import "./access_denied/FlowAccessDenied";
import "./stages/authenticator_static/AuthenticatorStaticStage"; import "./stages/authenticator_static/AuthenticatorStaticStage";
import "./stages/authenticator_totp/AuthenticatorTOTPStage"; import "./stages/authenticator_totp/AuthenticatorTOTPStage";
import "./stages/authenticator_duo/AuthenticatorDuoStage";
import "./stages/authenticator_validate/AuthenticatorValidateStage"; import "./stages/authenticator_validate/AuthenticatorValidateStage";
import "./stages/authenticator_webauthn/WebAuthnAuthenticatorRegisterStage"; import "./stages/authenticator_webauthn/WebAuthnAuthenticatorRegisterStage";
import "./stages/autosubmit/AutosubmitStage"; import "./stages/autosubmit/AutosubmitStage";
@ -24,28 +25,14 @@ import "./stages/identification/IdentificationStage";
import "./stages/password/PasswordStage"; import "./stages/password/PasswordStage";
import "./stages/prompt/PromptStage"; import "./stages/prompt/PromptStage";
import "./sources/plex/PlexLoginInit"; import "./sources/plex/PlexLoginInit";
import { ShellChallenge, RedirectChallenge } from "../api/Flows";
import { IdentificationChallenge } from "./stages/identification/IdentificationStage";
import { PasswordChallenge } from "./stages/password/PasswordStage";
import { ConsentChallenge } from "./stages/consent/ConsentStage";
import { EmailChallenge } from "./stages/email/EmailStage";
import { AutosubmitChallenge } from "./stages/autosubmit/AutosubmitStage";
import { PromptChallenge } from "./stages/prompt/PromptStage";
import { AuthenticatorTOTPChallenge } from "./stages/authenticator_totp/AuthenticatorTOTPStage";
import { AuthenticatorStaticChallenge } from "./stages/authenticator_static/AuthenticatorStaticStage";
import { AuthenticatorValidateStageChallenge } from "./stages/authenticator_validate/AuthenticatorValidateStage";
import { WebAuthnAuthenticatorRegisterChallenge } from "./stages/authenticator_webauthn/WebAuthnAuthenticatorRegisterStage";
import { CaptchaChallenge } from "./stages/captcha/CaptchaStage";
import { StageHost } from "./stages/base"; import { StageHost } from "./stages/base";
import { Challenge, ChallengeChoices, Config, FlowsApi } from "authentik-api"; import { ChallengeChoices, Config, FlowChallengeRequest, FlowChallengeResponseRequest, FlowsApi, RedirectChallenge, ShellChallenge } from "authentik-api";
import { config, DEFAULT_CONFIG } from "../api/Config"; import { config, DEFAULT_CONFIG } from "../api/Config";
import { ifDefined } from "lit-html/directives/if-defined"; import { ifDefined } from "lit-html/directives/if-defined";
import { until } from "lit-html/directives/until"; import { until } from "lit-html/directives/until";
import { AccessDeniedChallenge } from "./access_denied/FlowAccessDenied";
import { PFSize } from "../elements/Spinner"; import { PFSize } from "../elements/Spinner";
import { TITLE_DEFAULT } from "../constants"; import { TITLE_DEFAULT } from "../constants";
import { configureSentry } from "../api/Sentry"; import { configureSentry } from "../api/Sentry";
import { PlexAuthenticationChallenge } from "./sources/plex/PlexLoginInit";
@customElement("ak-flow-executor") @customElement("ak-flow-executor")
export class FlowExecutor extends LitElement implements StageHost { export class FlowExecutor extends LitElement implements StageHost {
@ -53,7 +40,7 @@ export class FlowExecutor extends LitElement implements StageHost {
flowSlug: string; flowSlug: string;
@property({attribute: false}) @property({attribute: false})
challenge?: Challenge; challenge?: FlowChallengeRequest;
@property({type: Boolean}) @property({type: Boolean})
loading = false; loading = false;
@ -88,9 +75,6 @@ export class FlowExecutor extends LitElement implements StageHost {
constructor() { constructor() {
super(); super();
this.addEventListener("ak-flow-submit", () => {
this.submit();
});
this.flowSlug = window.location.pathname.split("/")[3]; this.flowSlug = window.location.pathname.split("/")[3];
} }
@ -110,19 +94,21 @@ export class FlowExecutor extends LitElement implements StageHost {
}); });
} }
submit<T>(formData?: T): Promise<void> { submit(payload?: FlowChallengeResponseRequest): Promise<void> {
if (!payload) return Promise.reject();
if (!this.challenge) return Promise.reject();
// @ts-ignore
payload.component = this.challenge.component;
this.loading = true; this.loading = true;
return new FlowsApi(DEFAULT_CONFIG).flowsExecutorSolveRaw({ return new FlowsApi(DEFAULT_CONFIG).flowsExecutorSolve({
flowSlug: this.flowSlug, flowSlug: this.flowSlug,
requestBody: formData || {},
query: window.location.search.substring(1), query: window.location.search.substring(1),
}).then((challengeRaw) => { flowChallengeResponseRequest: payload,
return challengeRaw.raw.json();
}).then((data) => { }).then((data) => {
this.challenge = data; this.challenge = data;
this.postUpdate(); this.postUpdate();
}).catch((e: Response) => { }).catch((e: Error) => {
this.errorMessage(e.statusText); this.errorMessage(e.toString());
}).finally(() => { }).finally(() => {
this.loading = false; this.loading = false;
}); });
@ -133,28 +119,26 @@ export class FlowExecutor extends LitElement implements StageHost {
this.config = config; this.config = config;
}); });
this.loading = true; this.loading = true;
new FlowsApi(DEFAULT_CONFIG).flowsExecutorGetRaw({ new FlowsApi(DEFAULT_CONFIG).flowsExecutorGet({
flowSlug: this.flowSlug, flowSlug: this.flowSlug,
query: window.location.search.substring(1), query: window.location.search.substring(1),
}).then((challengeRaw) => {
return challengeRaw.raw.json();
}).then((challenge) => { }).then((challenge) => {
this.challenge = challenge as Challenge; this.challenge = challenge;
// Only set background on first update, flow won't change throughout execution // Only set background on first update, flow won't change throughout execution
if (this.challenge?.background) { if (this.challenge?.background) {
this.setBackground(this.challenge.background); this.setBackground(this.challenge.background);
} }
this.postUpdate(); this.postUpdate();
}).catch((e: Response) => { }).catch((e: Error) => {
// Catch JSON or Update errors // Catch JSON or Update errors
this.errorMessage(e.statusText); this.errorMessage(e.toString());
}).finally(() => { }).finally(() => {
this.loading = false; this.loading = false;
}); });
} }
errorMessage(error: string): void { errorMessage(error: string): void {
this.challenge = <ShellChallenge>{ this.challenge = {
type: ChallengeChoices.Shell, type: ChallengeChoices.Shell,
body: `<header class="pf-c-login__main-header"> body: `<header class="pf-c-login__main-header">
<h1 class="pf-c-title pf-m-3xl"> <h1 class="pf-c-title pf-m-3xl">
@ -174,7 +158,7 @@ export class FlowExecutor extends LitElement implements StageHost {
</li> </li>
</ul> </ul>
</footer>` </footer>`
}; } as FlowChallengeRequest;
} }
renderLoading(): TemplateResult { renderLoading(): TemplateResult {
@ -200,33 +184,35 @@ export class FlowExecutor extends LitElement implements StageHost {
case ChallengeChoices.Native: case ChallengeChoices.Native:
switch (this.challenge.component) { switch (this.challenge.component) {
case "ak-stage-access-denied": case "ak-stage-access-denied":
return html`<ak-stage-access-denied .host=${this} .challenge=${this.challenge as AccessDeniedChallenge}></ak-stage-access-denied>`; return html`<ak-stage-access-denied .host=${this as StageHost} .challenge=${this.challenge}></ak-stage-access-denied>`;
case "ak-stage-identification": case "ak-stage-identification":
return html`<ak-stage-identification .host=${this} .challenge=${this.challenge as IdentificationChallenge}></ak-stage-identification>`; return html`<ak-stage-identification .host=${this as StageHost} .challenge=${this.challenge}></ak-stage-identification>`;
case "ak-stage-password": case "ak-stage-password":
return html`<ak-stage-password .host=${this} .challenge=${this.challenge as PasswordChallenge}></ak-stage-password>`; return html`<ak-stage-password .host=${this as StageHost} .challenge=${this.challenge}></ak-stage-password>`;
case "ak-stage-captcha": case "ak-stage-captcha":
return html`<ak-stage-captcha .host=${this} .challenge=${this.challenge as CaptchaChallenge}></ak-stage-captcha>`; return html`<ak-stage-captcha .host=${this as StageHost} .challenge=${this.challenge}></ak-stage-captcha>`;
case "ak-stage-consent": case "ak-stage-consent":
return html`<ak-stage-consent .host=${this} .challenge=${this.challenge as ConsentChallenge}></ak-stage-consent>`; return html`<ak-stage-consent .host=${this as StageHost} .challenge=${this.challenge}></ak-stage-consent>`;
case "ak-stage-dummy": case "ak-stage-dummy":
return html`<ak-stage-dummy .host=${this} .challenge=${this.challenge as Challenge}></ak-stage-dummy>`; return html`<ak-stage-dummy .host=${this as StageHost} .challenge=${this.challenge}></ak-stage-dummy>`;
case "ak-stage-email": case "ak-stage-email":
return html`<ak-stage-email .host=${this} .challenge=${this.challenge as EmailChallenge}></ak-stage-email>`; return html`<ak-stage-email .host=${this as StageHost} .challenge=${this.challenge}></ak-stage-email>`;
case "ak-stage-autosubmit": case "ak-stage-autosubmit":
return html`<ak-stage-autosubmit .host=${this} .challenge=${this.challenge as AutosubmitChallenge}></ak-stage-autosubmit>`; return html`<ak-stage-autosubmit .host=${this as StageHost} .challenge=${this.challenge}></ak-stage-autosubmit>`;
case "ak-stage-prompt": case "ak-stage-prompt":
return html`<ak-stage-prompt .host=${this} .challenge=${this.challenge as PromptChallenge}></ak-stage-prompt>`; return html`<ak-stage-prompt .host=${this as StageHost} .challenge=${this.challenge}></ak-stage-prompt>`;
case "ak-stage-authenticator-totp": case "ak-stage-authenticator-totp":
return html`<ak-stage-authenticator-totp .host=${this} .challenge=${this.challenge as AuthenticatorTOTPChallenge}></ak-stage-authenticator-totp>`; return html`<ak-stage-authenticator-totp .host=${this as StageHost} .challenge=${this.challenge}></ak-stage-authenticator-totp>`;
case "ak-stage-authenticator-duo":
return html`<ak-stage-authenticator-duo .host=${this as StageHost} .challenge=${this.challenge}></ak-stage-authenticator-duo>`;
case "ak-stage-authenticator-static": case "ak-stage-authenticator-static":
return html`<ak-stage-authenticator-static .host=${this} .challenge=${this.challenge as AuthenticatorStaticChallenge}></ak-stage-authenticator-static>`; return html`<ak-stage-authenticator-static .host=${this as StageHost} .challenge=${this.challenge}></ak-stage-authenticator-static>`;
case "ak-stage-authenticator-webauthn": case "ak-stage-authenticator-webauthn":
return html`<ak-stage-authenticator-webauthn .host=${this} .challenge=${this.challenge as WebAuthnAuthenticatorRegisterChallenge}></ak-stage-authenticator-webauthn>`; return html`<ak-stage-authenticator-webauthn .host=${this as StageHost} .challenge=${this.challenge}></ak-stage-authenticator-webauthn>`;
case "ak-stage-authenticator-validate": case "ak-stage-authenticator-validate":
return html`<ak-stage-authenticator-validate .host=${this} .challenge=${this.challenge as AuthenticatorValidateStageChallenge}></ak-stage-authenticator-validate>`; return html`<ak-stage-authenticator-validate .host=${this as StageHost} .challenge=${this.challenge}></ak-stage-authenticator-validate>`;
case "ak-flow-sources-plex": case "ak-flow-sources-plex":
return html`<ak-flow-sources-plex .host=${this} .challenge=${this.challenge as PlexAuthenticationChallenge}></ak-flow-sources-plex>`; return html`<ak-flow-sources-plex .host=${this as StageHost} .challenge=${this.challenge}></ak-flow-sources-plex>`;
default: default:
break; break;
} }
@ -284,8 +270,7 @@ export class FlowExecutor extends LitElement implements StageHost {
</li>`; </li>`;
}))} }))}
${this.config?.brandingTitle != "authentik" ? html` ${this.config?.brandingTitle != "authentik" ? html`
<li><a href="https://goauthentik.io">${t`Powered by authentik`}</a></li> <li><a href="https://goauthentik.io">${t`Powered by authentik`}</a></li>` : html``}
` : html``}
</ul> </ul>
</footer> </footer>
</div> </div>

View file

@ -1,5 +1,5 @@
import { Challenge } from "authentik-api"; import { AccessDeniedChallenge, FlowChallengeResponseRequest } from "authentik-api";
import { CSSResult, customElement, html, property, TemplateResult } from "lit-element"; import { CSSResult, customElement, html, TemplateResult } from "lit-element";
import { BaseStage } from "../stages/base"; import { BaseStage } from "../stages/base";
import PFLogin from "@patternfly/patternfly/components/Login/login.css"; import PFLogin from "@patternfly/patternfly/components/Login/login.css";
import PFTitle from "@patternfly/patternfly/components/Title/title.css"; import PFTitle from "@patternfly/patternfly/components/Title/title.css";
@ -12,15 +12,8 @@ import { t } from "@lingui/macro";
import "../../elements/EmptyState"; import "../../elements/EmptyState";
export interface AccessDeniedChallenge extends Challenge {
error_message?: string;
}
@customElement("ak-stage-access-denied") @customElement("ak-stage-access-denied")
export class FlowAccessDenied extends BaseStage { export class FlowAccessDenied extends BaseStage<AccessDeniedChallenge, FlowChallengeResponseRequest> {
@property({ attribute: false })
challenge?: AccessDeniedChallenge;
static get styles(): CSSResult[] { static get styles(): CSSResult[] {
return [PFBase, PFLogin, PFForm, PFList, PFFormControl, PFTitle, AKGlobal]; return [PFBase, PFLogin, PFForm, PFList, PFFormControl, PFTitle, AKGlobal];
@ -45,9 +38,9 @@ export class FlowAccessDenied extends BaseStage {
<i class="pf-icon pf-icon-error-circle-o"></i> <i class="pf-icon pf-icon-error-circle-o"></i>
${t`Request has been denied.`} ${t`Request has been denied.`}
</p> </p>
${this.challenge?.error_message && ${this.challenge?.errorMessage &&
html`<hr> html`<hr>
<p>${this.challenge.error_message}</p>`} <p>${this.challenge.errorMessage}</p>`}
</div> </div>
</form> </form>
</div> </div>

View file

@ -1,5 +1,5 @@
import { t } from "@lingui/macro"; import { t } from "@lingui/macro";
import { Challenge } from "authentik-api"; import { PlexAuthenticationChallenge } from "authentik-api";
import PFLogin from "@patternfly/patternfly/components/Login/login.css"; import PFLogin from "@patternfly/patternfly/components/Login/login.css";
import PFForm from "@patternfly/patternfly/components/Form/form.css"; import PFForm from "@patternfly/patternfly/components/Form/form.css";
import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css"; import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css";
@ -7,7 +7,7 @@ import PFTitle from "@patternfly/patternfly/components/Title/title.css";
import PFButton from "@patternfly/patternfly/components/Button/button.css"; import PFButton from "@patternfly/patternfly/components/Button/button.css";
import PFBase from "@patternfly/patternfly/patternfly-base.css"; import PFBase from "@patternfly/patternfly/patternfly-base.css";
import AKGlobal from "../../../authentik.css"; import AKGlobal from "../../../authentik.css";
import { CSSResult, customElement, property } from "lit-element"; import { CSSResult, customElement } from "lit-element";
import { html, TemplateResult } from "lit-html"; import { html, TemplateResult } from "lit-html";
import { BaseStage } from "../../stages/base"; import { BaseStage } from "../../stages/base";
import { PlexAPIClient, popupCenterScreen } from "./API"; import { PlexAPIClient, popupCenterScreen } from "./API";
@ -15,28 +15,20 @@ import { DEFAULT_CONFIG } from "../../../api/Config";
import { SourcesApi } from "authentik-api"; import { SourcesApi } from "authentik-api";
import { showMessage } from "../../../elements/messages/MessageContainer"; import { showMessage } from "../../../elements/messages/MessageContainer";
import { MessageLevel } from "../../../elements/messages/Message"; import { MessageLevel } from "../../../elements/messages/Message";
import { PlexAuthenticationChallengeResponseRequest } from "authentik-api/dist/models/PlexAuthenticationChallengeResponseRequest";
export interface PlexAuthenticationChallenge extends Challenge {
client_id: string;
slug: string;
}
@customElement("ak-flow-sources-plex") @customElement("ak-flow-sources-plex")
export class PlexLoginInit extends BaseStage { export class PlexLoginInit extends BaseStage<PlexAuthenticationChallenge, PlexAuthenticationChallengeResponseRequest> {
@property({ attribute: false })
challenge?: PlexAuthenticationChallenge;
static get styles(): CSSResult[] { static get styles(): CSSResult[] {
return [PFBase, PFLogin, PFForm, PFFormControl, PFButton, PFTitle, AKGlobal]; return [PFBase, PFLogin, PFForm, PFFormControl, PFButton, PFTitle, AKGlobal];
} }
async firstUpdated(): Promise<void> { async firstUpdated(): Promise<void> {
const authInfo = await PlexAPIClient.getPin(this.challenge?.client_id || ""); const authInfo = await PlexAPIClient.getPin(this.challenge?.clientId || "");
const authWindow = popupCenterScreen(authInfo.authUrl, "plex auth", 550, 700); const authWindow = popupCenterScreen(authInfo.authUrl, "plex auth", 550, 700);
PlexAPIClient.pinPoll(this.challenge?.client_id || "", authInfo.pin.id).then(token => { PlexAPIClient.pinPoll(this.challenge?.clientId || "", authInfo.pin.id).then(token => {
authWindow?.close(); authWindow?.close();
new SourcesApi(DEFAULT_CONFIG).sourcesPlexRedeemTokenCreate({ new SourcesApi(DEFAULT_CONFIG).sourcesPlexRedeemTokenCreate({
plexTokenRedeemRequest: { plexTokenRedeemRequest: {

View file

@ -0,0 +1,87 @@
import { t } from "@lingui/macro";
import { CSSResult, customElement, html, TemplateResult } from "lit-element";
import PFLogin from "@patternfly/patternfly/components/Login/login.css";
import PFForm from "@patternfly/patternfly/components/Form/form.css";
import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css";
import PFTitle from "@patternfly/patternfly/components/Title/title.css";
import PFButton from "@patternfly/patternfly/components/Button/button.css";
import PFBase from "@patternfly/patternfly/patternfly-base.css";
import AKGlobal from "../../../authentik.css";
import { BaseStage } from "../base";
import "../../../elements/forms/FormElement";
import "../../../elements/EmptyState";
import "../../FormStatic";
import { FlowURLManager } from "../../../api/legacy";
import { AuthenticatorDuoChallenge, StagesApi } from "authentik-api";
import { DEFAULT_CONFIG } from "../../../api/Config";
import { AuthenticatorDuoChallengeResponseRequest } from "authentik-api/dist/models/AuthenticatorDuoChallengeResponseRequest";
@customElement("ak-stage-authenticator-duo")
export class AuthenticatorDuoStage extends BaseStage<AuthenticatorDuoChallenge, AuthenticatorDuoChallengeResponseRequest> {
static get styles(): CSSResult[] {
return [PFBase, PFLogin, PFForm, PFFormControl, PFTitle, PFButton, AKGlobal];
}
firstUpdated(): void {
const i = setInterval(() => {
this.checkEnrollStatus().then(() => {
clearInterval(i);
});
}, 3000);
}
checkEnrollStatus(): Promise<void> {
return new StagesApi(DEFAULT_CONFIG).stagesAuthenticatorDuoEnrollmentStatusCreate({
stageUuid: this.challenge?.stageUuid || "",
}).then(() => {
this.host?.submit({});
}).catch(() => {
console.debug("authentik/flows/duo: Waiting for auth status");
});
}
render(): TemplateResult {
if (!this.challenge) {
return html`<ak-empty-state
?loading="${true}"
header=${t`Loading`}>
</ak-empty-state>`;
}
return html`<header class="pf-c-login__main-header">
<h1 class="pf-c-title pf-m-3xl">
${this.challenge.title}
</h1>
</header>
<div class="pf-c-login__main-body">
<form class="pf-c-form" @submit=${(e: Event) => { this.submitForm(e); }}>
<ak-form-static
class="pf-c-form__group"
userAvatar="${this.challenge.pendingUserAvatar}"
user=${this.challenge.pendingUser}>
<div slot="link">
<a href="${FlowURLManager.cancel()}">${t`Not you?`}</a>
</div>
</ak-form-static>
<img src=${this.challenge.activationBarcode} />
<p>
${t`Alternatively, if your current device has Duo installed, click on this link:`}
</p>
<a href=${this.challenge.activationCode}>${t`Duo activation`}</a>
<div class="pf-c-form__group pf-m-action">
<button type="button" class="pf-c-button pf-m-primary pf-m-block" @click=${() => {
this.checkEnrollStatus();
}}>
${t`Check status`}
</button>
</div>
</form>
</div>
<footer class="pf-c-login__main-footer">
<ul class="pf-c-login__main-footer-links">
</ul>
</footer>`;
}
}

View file

@ -1,6 +1,5 @@
import { t } from "@lingui/macro"; import { t } from "@lingui/macro";
import { css, CSSResult, customElement, html, property, TemplateResult } from "lit-element"; import { css, CSSResult, customElement, html, TemplateResult } from "lit-element";
import { WithUserInfoChallenge } from "../../../api/Flows";
import PFLogin from "@patternfly/patternfly/components/Login/login.css"; import PFLogin from "@patternfly/patternfly/components/Login/login.css";
import PFForm from "@patternfly/patternfly/components/Form/form.css"; import PFForm from "@patternfly/patternfly/components/Form/form.css";
import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css"; import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css";
@ -13,6 +12,8 @@ import "../../../elements/forms/FormElement";
import "../../../elements/EmptyState"; import "../../../elements/EmptyState";
import "../../FormStatic"; import "../../FormStatic";
import { FlowURLManager } from "../../../api/legacy"; import { FlowURLManager } from "../../../api/legacy";
import { AuthenticatorStaticChallenge } from "authentik-api";
import { AuthenticatorStaticChallengeResponseRequest } from "authentik-api/dist/models/AuthenticatorStaticChallengeResponseRequest";
export const STATIC_TOKEN_STYLE = css` export const STATIC_TOKEN_STYLE = css`
/* Static OTP Tokens */ /* Static OTP Tokens */
@ -29,15 +30,9 @@ export const STATIC_TOKEN_STYLE = css`
} }
`; `;
export interface AuthenticatorStaticChallenge extends WithUserInfoChallenge {
codes: number[];
}
@customElement("ak-stage-authenticator-static") @customElement("ak-stage-authenticator-static")
export class AuthenticatorStaticStage extends BaseStage { export class AuthenticatorStaticStage extends BaseStage<AuthenticatorStaticChallenge, AuthenticatorStaticChallengeResponseRequest> {
@property({ attribute: false })
challenge?: AuthenticatorStaticChallenge;
static get styles(): CSSResult[] { static get styles(): CSSResult[] {
return [PFBase, PFLogin, PFForm, PFFormControl, PFTitle, PFButton, AKGlobal, STATIC_TOKEN_STYLE]; return [PFBase, PFLogin, PFForm, PFFormControl, PFTitle, PFButton, AKGlobal, STATIC_TOKEN_STYLE];
@ -59,8 +54,8 @@ export class AuthenticatorStaticStage extends BaseStage {
<form class="pf-c-form" @submit=${(e: Event) => { this.submitForm(e); }}> <form class="pf-c-form" @submit=${(e: Event) => { this.submitForm(e); }}>
<ak-form-static <ak-form-static
class="pf-c-form__group" class="pf-c-form__group"
userAvatar="${this.challenge.pending_user_avatar}" userAvatar="${this.challenge.pendingUserAvatar}"
user=${this.challenge.pending_user}> user=${this.challenge.pendingUser}>
<div slot="link"> <div slot="link">
<a href="${FlowURLManager.cancel()}">${t`Not you?`}</a> <a href="${FlowURLManager.cancel()}">${t`Not you?`}</a>
</div> </div>

View file

@ -1,6 +1,5 @@
import { t } from "@lingui/macro"; import { t } from "@lingui/macro";
import { CSSResult, customElement, html, property, TemplateResult } from "lit-element"; import { CSSResult, customElement, html, TemplateResult } from "lit-element";
import { WithUserInfoChallenge } from "../../../api/Flows";
import PFLogin from "@patternfly/patternfly/components/Login/login.css"; import PFLogin from "@patternfly/patternfly/components/Login/login.css";
import PFForm from "@patternfly/patternfly/components/Form/form.css"; import PFForm from "@patternfly/patternfly/components/Form/form.css";
import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css"; import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css";
@ -16,16 +15,11 @@ import "../../../elements/EmptyState";
import "../../FormStatic"; import "../../FormStatic";
import { MessageLevel } from "../../../elements/messages/Message"; import { MessageLevel } from "../../../elements/messages/Message";
import { FlowURLManager } from "../../../api/legacy"; import { FlowURLManager } from "../../../api/legacy";
import { AuthenticatorTOTPChallenge, AuthenticatorTOTPChallengeResponseRequest } from "authentik-api";
export interface AuthenticatorTOTPChallenge extends WithUserInfoChallenge {
config_url: string;
}
@customElement("ak-stage-authenticator-totp") @customElement("ak-stage-authenticator-totp")
export class AuthenticatorTOTPStage extends BaseStage { export class AuthenticatorTOTPStage extends BaseStage<AuthenticatorTOTPChallenge, AuthenticatorTOTPChallengeResponseRequest> {
@property({ attribute: false })
challenge?: AuthenticatorTOTPChallenge;
static get styles(): CSSResult[] { static get styles(): CSSResult[] {
return [PFBase, PFLogin, PFForm, PFFormControl, PFTitle, PFButton, AKGlobal]; return [PFBase, PFLogin, PFForm, PFFormControl, PFTitle, PFButton, AKGlobal];
@ -47,20 +41,20 @@ export class AuthenticatorTOTPStage extends BaseStage {
<form class="pf-c-form" @submit=${(e: Event) => { this.submitForm(e); }}> <form class="pf-c-form" @submit=${(e: Event) => { this.submitForm(e); }}>
<ak-form-static <ak-form-static
class="pf-c-form__group" class="pf-c-form__group"
userAvatar="${this.challenge.pending_user_avatar}" userAvatar="${this.challenge.pendingUserAvatar}"
user=${this.challenge.pending_user}> user=${this.challenge.pendingUser}>
<div slot="link"> <div slot="link">
<a href="${FlowURLManager.cancel()}">${t`Not you?`}</a> <a href="${FlowURLManager.cancel()}">${t`Not you?`}</a>
</div> </div>
</ak-form-static> </ak-form-static>
<input type="hidden" name="otp_uri" value=${this.challenge.config_url} /> <input type="hidden" name="otp_uri" value=${this.challenge.configUrl} />
<ak-form-element> <ak-form-element>
<!-- @ts-ignore --> <!-- @ts-ignore -->
<qr-code data="${this.challenge.config_url}"></qr-code> <qr-code data="${this.challenge.configUrl}"></qr-code>
<button type="button" class="pf-c-button pf-m-secondary pf-m-progress pf-m-in-progress" @click=${(e: Event) => { <button type="button" class="pf-c-button pf-m-secondary pf-m-progress pf-m-in-progress" @click=${(e: Event) => {
e.preventDefault(); e.preventDefault();
if (!this.challenge?.config_url) return; if (!this.challenge?.configUrl) return;
navigator.clipboard.writeText(this.challenge?.config_url).then(() => { navigator.clipboard.writeText(this.challenge?.configUrl).then(() => {
showMessage({ showMessage({
level: MessageLevel.success, level: MessageLevel.success,
message: t`Successfully copied TOTP Config.` message: t`Successfully copied TOTP Config.`
@ -75,7 +69,7 @@ export class AuthenticatorTOTPStage extends BaseStage {
label="${t`Code`}" label="${t`Code`}"
?required="${true}" ?required="${true}"
class="pf-c-form__group" class="pf-c-form__group"
.errors=${(this.challenge?.response_errors || {})["code"]}> .errors=${(this.challenge?.responseErrors || {})["code"]}>
<!-- @ts-ignore --> <!-- @ts-ignore -->
<input type="text" <input type="text"
name="code" name="code"

View file

@ -1,6 +1,5 @@
import { t } from "@lingui/macro"; import { t } from "@lingui/macro";
import { css, CSSResult, customElement, html, property, TemplateResult } from "lit-element"; import { css, CSSResult, customElement, html, property, TemplateResult } from "lit-element";
import { WithUserInfoChallenge } from "../../../api/Flows";
import PFLogin from "@patternfly/patternfly/components/Login/login.css"; import PFLogin from "@patternfly/patternfly/components/Login/login.css";
import PFForm from "@patternfly/patternfly/components/Form/form.css"; import PFForm from "@patternfly/patternfly/components/Form/form.css";
import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css"; import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css";
@ -11,40 +10,26 @@ import AKGlobal from "../../../authentik.css";
import { BaseStage, StageHost } from "../base"; import { BaseStage, StageHost } from "../base";
import "./AuthenticatorValidateStageWebAuthn"; import "./AuthenticatorValidateStageWebAuthn";
import "./AuthenticatorValidateStageCode"; import "./AuthenticatorValidateStageCode";
import "./AuthenticatorValidateStageDuo";
import { PasswordManagerPrefill } from "../identification/IdentificationStage"; import { PasswordManagerPrefill } from "../identification/IdentificationStage";
import { AuthenticatorValidationChallengeResponseRequest, DeviceChallenge } from "authentik-api";
import { AuthenticatorValidationChallenge } from "authentik-api/dist/models/AuthenticatorValidationChallenge";
export enum DeviceClasses { export enum DeviceClasses {
STATIC = "static", STATIC = "static",
TOTP = "totp", TOTP = "totp",
WEBAUTHN = "webauthn", WEBAUTHN = "webauthn",
} DUO = "duo",
export interface DeviceChallenge {
device_class: DeviceClasses;
device_uid: string;
challenge: unknown;
}
export interface AuthenticatorValidateStageChallenge extends WithUserInfoChallenge {
device_challenges: DeviceChallenge[];
}
export interface AuthenticatorValidateStageChallengeResponse {
code: string;
webauthn: string;
} }
@customElement("ak-stage-authenticator-validate") @customElement("ak-stage-authenticator-validate")
export class AuthenticatorValidateStage extends BaseStage implements StageHost { export class AuthenticatorValidateStage extends BaseStage<AuthenticatorValidationChallenge, AuthenticatorValidationChallengeResponseRequest> implements StageHost {
@property({ attribute: false })
challenge?: AuthenticatorValidateStageChallenge;
@property({attribute: false}) @property({attribute: false})
selectedDeviceChallenge?: DeviceChallenge; selectedDeviceChallenge?: DeviceChallenge;
submit<T>(formData?: T): Promise<void> { submit(payload: AuthenticatorValidationChallengeResponseRequest): Promise<void> {
return this.host?.submit<T>(formData) || Promise.resolve(); return this.host?.submit(payload) || Promise.resolve();
} }
static get styles(): CSSResult[] { static get styles(): CSSResult[] {
@ -76,7 +61,13 @@ export class AuthenticatorValidateStage extends BaseStage implements StageHost {
} }
renderDevicePickerSingle(deviceChallenge: DeviceChallenge): TemplateResult { renderDevicePickerSingle(deviceChallenge: DeviceChallenge): TemplateResult {
switch (deviceChallenge.device_class) { switch (deviceChallenge.deviceClass) {
case DeviceClasses.DUO:
return html`<i class="fas fa-mobile-alt"></i>
<div class="right">
<p>${t`Duo push-notifications`}</p>
<small>${t`Receive a push notification on your phone to prove your identity.`}</small>
</div>`;
case DeviceClasses.WEBAUTHN: case DeviceClasses.WEBAUTHN:
return html`<i class="fas fa-mobile-alt"></i> return html`<i class="fas fa-mobile-alt"></i>
<div class="right"> <div class="right">
@ -115,7 +106,7 @@ export class AuthenticatorValidateStage extends BaseStage implements StageHost {
renderDevicePicker(): TemplateResult { renderDevicePicker(): TemplateResult {
return html` return html`
<ul> <ul>
${this.challenge?.device_challenges.map((challenges) => { ${this.challenge?.deviceChallenges.map((challenges) => {
return html`<li> return html`<li>
<button class="pf-c-button authenticator-button" type="button" @click=${() => { <button class="pf-c-button authenticator-button" type="button" @click=${() => {
this.selectedDeviceChallenge = challenges; this.selectedDeviceChallenge = challenges;
@ -131,23 +122,31 @@ export class AuthenticatorValidateStage extends BaseStage implements StageHost {
if (!this.selectedDeviceChallenge) { if (!this.selectedDeviceChallenge) {
return html``; return html``;
} }
switch (this.selectedDeviceChallenge?.device_class) { switch (this.selectedDeviceChallenge?.deviceClass) {
case DeviceClasses.STATIC: case DeviceClasses.STATIC:
case DeviceClasses.TOTP: case DeviceClasses.TOTP:
return html`<ak-stage-authenticator-validate-code return html`<ak-stage-authenticator-validate-code
.host=${this} .host=${this}
.challenge=${this.challenge} .challenge=${this.challenge}
.deviceChallenge=${this.selectedDeviceChallenge} .deviceChallenge=${this.selectedDeviceChallenge}
.showBackButton=${(this.challenge?.device_challenges.length || []) > 1}> .showBackButton=${(this.challenge?.deviceChallenges.length || []) > 1}>
</ak-stage-authenticator-validate-code>`; </ak-stage-authenticator-validate-code>`;
case DeviceClasses.WEBAUTHN: case DeviceClasses.WEBAUTHN:
return html`<ak-stage-authenticator-validate-webauthn return html`<ak-stage-authenticator-validate-webauthn
.host=${this} .host=${this}
.challenge=${this.challenge} .challenge=${this.challenge}
.deviceChallenge=${this.selectedDeviceChallenge} .deviceChallenge=${this.selectedDeviceChallenge}
.showBackButton=${(this.challenge?.device_challenges.length || []) > 1}> .showBackButton=${(this.challenge?.deviceChallenges.length || []) > 1}>
</ak-stage-authenticator-validate-webauthn>`; </ak-stage-authenticator-validate-webauthn>`;
case DeviceClasses.DUO:
return html`<ak-stage-authenticator-validate-duo
.host=${this}
.challenge=${this.challenge}
.deviceChallenge=${this.selectedDeviceChallenge}
.showBackButton=${(this.challenge?.deviceChallenges.length || []) > 1}>
</ak-stage-authenticator-validate-duo>`;
} }
return html``;
} }
render(): TemplateResult { render(): TemplateResult {
@ -158,8 +157,8 @@ export class AuthenticatorValidateStage extends BaseStage implements StageHost {
</ak-empty-state>`; </ak-empty-state>`;
} }
// User only has a single device class, so we don't show a picker // User only has a single device class, so we don't show a picker
if (this.challenge?.device_challenges.length === 1) { if (this.challenge?.deviceChallenges.length === 1) {
this.selectedDeviceChallenge = this.challenge.device_challenges[0]; this.selectedDeviceChallenge = this.challenge.deviceChallenges[0];
} }
return html`<header class="pf-c-login__main-header"> return html`<header class="pf-c-login__main-header">
<h1 class="pf-c-title pf-m-3xl"> <h1 class="pf-c-title pf-m-3xl">

View file

@ -8,18 +8,17 @@ import PFButton from "@patternfly/patternfly/components/Button/button.css";
import PFBase from "@patternfly/patternfly/patternfly-base.css"; import PFBase from "@patternfly/patternfly/patternfly-base.css";
import AKGlobal from "../../../authentik.css"; import AKGlobal from "../../../authentik.css";
import { BaseStage } from "../base"; import { BaseStage } from "../base";
import { AuthenticatorValidateStage, AuthenticatorValidateStageChallenge, DeviceChallenge } from "./AuthenticatorValidateStage"; import { AuthenticatorValidateStage } from "./AuthenticatorValidateStage";
import "../../../elements/forms/FormElement"; import "../../../elements/forms/FormElement";
import "../../../elements/EmptyState"; import "../../../elements/EmptyState";
import { PasswordManagerPrefill } from "../identification/IdentificationStage"; import { PasswordManagerPrefill } from "../identification/IdentificationStage";
import "../../FormStatic"; import "../../FormStatic";
import { FlowURLManager } from "../../../api/legacy"; import { FlowURLManager } from "../../../api/legacy";
import { AuthenticatorValidationChallenge } from "authentik-api/dist/models/AuthenticatorValidationChallenge";
import { AuthenticatorValidationChallengeResponseRequest, DeviceChallenge } from "authentik-api";
@customElement("ak-stage-authenticator-validate-code") @customElement("ak-stage-authenticator-validate-code")
export class AuthenticatorValidateStageWebCode extends BaseStage { export class AuthenticatorValidateStageWebCode extends BaseStage<AuthenticatorValidationChallenge, AuthenticatorValidationChallengeResponseRequest> {
@property({ attribute: false })
challenge?: AuthenticatorValidateStageChallenge;
@property({ attribute: false }) @property({ attribute: false })
deviceChallenge?: DeviceChallenge; deviceChallenge?: DeviceChallenge;
@ -42,8 +41,8 @@ export class AuthenticatorValidateStageWebCode extends BaseStage {
<form class="pf-c-form" @submit=${(e: Event) => { this.submitForm(e); }}> <form class="pf-c-form" @submit=${(e: Event) => { this.submitForm(e); }}>
<ak-form-static <ak-form-static
class="pf-c-form__group" class="pf-c-form__group"
userAvatar="${this.challenge.pending_user_avatar}" userAvatar="${this.challenge.pendingUserAvatar}"
user=${this.challenge.pending_user}> user=${this.challenge.pendingUser}>
<div slot="link"> <div slot="link">
<a href="${FlowURLManager.cancel()}">${t`Not you?`}</a> <a href="${FlowURLManager.cancel()}">${t`Not you?`}</a>
</div> </div>
@ -52,7 +51,7 @@ export class AuthenticatorValidateStageWebCode extends BaseStage {
label="${t`Code`}" label="${t`Code`}"
?required="${true}" ?required="${true}"
class="pf-c-form__group" class="pf-c-form__group"
.errors=${(this.challenge?.response_errors || {})["code"]}> .errors=${(this.challenge?.responseErrors || {})["code"]}>
<!-- @ts-ignore --> <!-- @ts-ignore -->
<input type="text" <input type="text"
name="code" name="code"

View file

@ -0,0 +1,79 @@
import { t } from "@lingui/macro";
import { CSSResult, customElement, html, property, TemplateResult } from "lit-element";
import PFLogin from "@patternfly/patternfly/components/Login/login.css";
import PFForm from "@patternfly/patternfly/components/Form/form.css";
import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css";
import PFTitle from "@patternfly/patternfly/components/Title/title.css";
import PFButton from "@patternfly/patternfly/components/Button/button.css";
import PFBase from "@patternfly/patternfly/patternfly-base.css";
import AKGlobal from "../../../authentik.css";
import { BaseStage } from "../base";
import { AuthenticatorValidateStage } from "./AuthenticatorValidateStage";
import "../../../elements/forms/FormElement";
import "../../../elements/EmptyState";
import "../../FormStatic";
import { FlowURLManager } from "../../../api/legacy";
import { AuthenticatorValidationChallenge } from "authentik-api/dist/models/AuthenticatorValidationChallenge";
import { AuthenticatorValidationChallengeResponseRequest, DeviceChallenge } from "authentik-api";
@customElement("ak-stage-authenticator-validate-duo")
export class AuthenticatorValidateStageWebDuo extends BaseStage<AuthenticatorValidationChallenge, AuthenticatorValidationChallengeResponseRequest> {
@property({ attribute: false })
deviceChallenge?: DeviceChallenge;
@property({ type: Boolean })
showBackButton = false;
static get styles(): CSSResult[] {
return [PFBase, PFLogin, PFForm, PFFormControl, PFTitle, PFButton, AKGlobal];
}
firstUpdated(): void {
this.host?.submit({
"duo": this.deviceChallenge?.deviceUid
});
}
render(): TemplateResult {
if (!this.challenge) {
return html`<ak-empty-state
?loading="${true}"
header=${t`Loading`}>
</ak-empty-state>`;
}
return html`<div class="pf-c-login__main-body">
<form class="pf-c-form" @submit=${(e: Event) => { this.submitForm(e); }}>
<ak-form-static
class="pf-c-form__group"
userAvatar="${this.challenge.pendingUserAvatar}"
user=${this.challenge.pendingUser}>
<div slot="link">
<a href="${FlowURLManager.cancel()}">${t`Not you?`}</a>
</div>
</ak-form-static>
<div class="pf-c-form__group pf-m-action">
<button type="submit" class="pf-c-button pf-m-primary pf-m-block">
${t`Continue`}
</button>
</div>
</form>
</div>
<footer class="pf-c-login__main-footer">
<ul class="pf-c-login__main-footer-links">
${this.showBackButton ?
html`<li class="pf-c-login__main-footer-links-item">
<button class="pf-c-button pf-m-secondary pf-m-block" @click=${() => {
if (!this.host) return;
(this.host as AuthenticatorValidateStage).selectedDeviceChallenge = undefined;
}}>
${t`Return to device picker`}
</button>
</li>`:
html``}
</ul>
</footer>`;
}
}

View file

@ -10,13 +10,12 @@ import AKGlobal from "../../../authentik.css";
import { PFSize } from "../../../elements/Spinner"; import { PFSize } from "../../../elements/Spinner";
import { transformAssertionForServer, transformCredentialRequestOptions } from "../authenticator_webauthn/utils"; import { transformAssertionForServer, transformCredentialRequestOptions } from "../authenticator_webauthn/utils";
import { BaseStage } from "../base"; import { BaseStage } from "../base";
import { AuthenticatorValidateStage, AuthenticatorValidateStageChallenge, DeviceChallenge } from "./AuthenticatorValidateStage"; import { AuthenticatorValidateStage } from "./AuthenticatorValidateStage";
import { AuthenticatorValidationChallenge } from "authentik-api/dist/models/AuthenticatorValidationChallenge";
import { AuthenticatorValidationChallengeResponseRequest, DeviceChallenge } from "authentik-api";
@customElement("ak-stage-authenticator-validate-webauthn") @customElement("ak-stage-authenticator-validate-webauthn")
export class AuthenticatorValidateStageWebAuthn extends BaseStage { export class AuthenticatorValidateStageWebAuthn extends BaseStage<AuthenticatorValidationChallenge, AuthenticatorValidationChallengeResponseRequest> {
@property({attribute: false})
challenge?: AuthenticatorValidateStageChallenge;
@property({attribute: false}) @property({attribute: false})
deviceChallenge?: DeviceChallenge; deviceChallenge?: DeviceChallenge;
@ -60,9 +59,9 @@ export class AuthenticatorValidateStageWebAuthn extends BaseStage {
// post the assertion to the server for verification. // post the assertion to the server for verification.
try { try {
const formData = new FormData(); await this.host?.submit({
formData.set("webauthn", JSON.stringify(transformedAssertionForServer)); webauthn: transformedAssertionForServer
await this.host?.submit(formData); });
} catch (err) { } catch (err) {
throw new Error(t`Error when validating assertion on server: ${err}`); throw new Error(t`Error when validating assertion on server: ${err}`);
} }

View file

@ -1,6 +1,5 @@
import { t } from "@lingui/macro"; import { t } from "@lingui/macro";
import { CSSResult, customElement, html, property, TemplateResult } from "lit-element"; import { CSSResult, customElement, html, property, TemplateResult } from "lit-element";
import { WithUserInfoChallenge } from "../../../api/Flows";
import PFLogin from "@patternfly/patternfly/components/Login/login.css"; import PFLogin from "@patternfly/patternfly/components/Login/login.css";
import PFForm from "@patternfly/patternfly/components/Form/form.css"; import PFForm from "@patternfly/patternfly/components/Form/form.css";
import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css"; import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css";
@ -11,20 +10,14 @@ import AKGlobal from "../../../authentik.css";
import { PFSize } from "../../../elements/Spinner"; import { PFSize } from "../../../elements/Spinner";
import { BaseStage } from "../base"; import { BaseStage } from "../base";
import { Assertion, transformCredentialCreateOptions, transformNewAssertionForServer } from "./utils"; import { Assertion, transformCredentialCreateOptions, transformNewAssertionForServer } from "./utils";
import { AuthenticatorWebAuthnChallenge, AuthenticatorWebAuthnChallengeResponseRequest } from "authentik-api";
export interface WebAuthnAuthenticatorRegisterChallenge extends WithUserInfoChallenge {
registration: PublicKeyCredentialCreationOptions;
}
export interface WebAuthnAuthenticatorRegisterChallengeResponse { export interface WebAuthnAuthenticatorRegisterChallengeResponse {
response: Assertion; response: Assertion;
} }
@customElement("ak-stage-authenticator-webauthn") @customElement("ak-stage-authenticator-webauthn")
export class WebAuthnAuthenticatorRegisterStage extends BaseStage { export class WebAuthnAuthenticatorRegisterStage extends BaseStage<AuthenticatorWebAuthnChallenge, AuthenticatorWebAuthnChallengeResponseRequest> {
@property({ attribute: false })
challenge?: WebAuthnAuthenticatorRegisterChallenge;
@property({type: Boolean}) @property({type: Boolean})
registerRunning = false; registerRunning = false;
@ -42,7 +35,7 @@ export class WebAuthnAuthenticatorRegisterStage extends BaseStage {
} }
// convert certain members of the PublicKeyCredentialCreateOptions into // convert certain members of the PublicKeyCredentialCreateOptions into
// byte arrays as expected by the spec. // byte arrays as expected by the spec.
const publicKeyCredentialCreateOptions = transformCredentialCreateOptions(this.challenge?.registration); const publicKeyCredentialCreateOptions = transformCredentialCreateOptions(this.challenge?.registration as PublicKeyCredentialCreationOptions);
// request the authenticator(s) to create a new credential keypair. // request the authenticator(s) to create a new credential keypair.
let credential; let credential;
@ -106,8 +99,8 @@ export class WebAuthnAuthenticatorRegisterStage extends BaseStage {
</div>`: </div>`:
html` html`
<div class="pf-c-form__group pf-m-action"> <div class="pf-c-form__group pf-m-action">
${this.challenge?.response_errors ? ${this.challenge?.responseErrors ?
html`<p class="pf-m-block">${this.challenge.response_errors["response"][0].string}</p>`: html`<p class="pf-m-block">${this.challenge.responseErrors["response"][0].string}</p>`:
html``} html``}
<p class="pf-m-block">${this.registerMessage}</p> <p class="pf-m-block">${this.registerMessage}</p>
<button class="pf-c-button pf-m-primary pf-m-block" @click=${() => { <button class="pf-c-button pf-m-primary pf-m-block" @click=${() => {

View file

@ -1,6 +1,5 @@
import { t } from "@lingui/macro"; import { t } from "@lingui/macro";
import { CSSResult, customElement, html, property, TemplateResult } from "lit-element"; import { CSSResult, customElement, html, TemplateResult } from "lit-element";
import { WithUserInfoChallenge } from "../../../api/Flows";
import PFLogin from "@patternfly/patternfly/components/Login/login.css"; import PFLogin from "@patternfly/patternfly/components/Login/login.css";
import PFForm from "@patternfly/patternfly/components/Form/form.css"; import PFForm from "@patternfly/patternfly/components/Form/form.css";
import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css"; import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css";
@ -10,17 +9,11 @@ import PFBase from "@patternfly/patternfly/patternfly-base.css";
import AKGlobal from "../../../authentik.css"; import AKGlobal from "../../../authentik.css";
import { BaseStage } from "../base"; import { BaseStage } from "../base";
import "../../../elements/EmptyState"; import "../../../elements/EmptyState";
import { AutosubmitChallenge } from "authentik-api";
export interface AutosubmitChallenge extends WithUserInfoChallenge { import { AutoSubmitChallengeResponseRequest } from "authentik-api/dist/models/AutoSubmitChallengeResponseRequest";
url: string;
attrs: { [key: string]: string };
}
@customElement("ak-stage-autosubmit") @customElement("ak-stage-autosubmit")
export class AutosubmitStage extends BaseStage { export class AutosubmitStage extends BaseStage<AutosubmitChallenge, AutoSubmitChallengeResponseRequest> {
@property({ attribute: false })
challenge?: AutosubmitChallenge;
static get styles(): CSSResult[] { static get styles(): CSSResult[] {
return [PFBase, PFLogin, PFForm, PFFormControl, PFButton, PFTitle, AKGlobal]; return [PFBase, PFLogin, PFForm, PFFormControl, PFButton, PFTitle, AKGlobal];
@ -45,7 +38,7 @@ export class AutosubmitStage extends BaseStage {
<div class="pf-c-login__main-body"> <div class="pf-c-login__main-body">
<form class="pf-c-form" action="${this.challenge.url}" method="POST"> <form class="pf-c-form" action="${this.challenge.url}" method="POST">
${Object.entries(this.challenge.attrs).map(([ key, value ]) => { ${Object.entries(this.challenge.attrs).map(([ key, value ]) => {
return html`<input type="hidden" name="${key}" value="${value}">`; return html`<input type="hidden" name="${key as string}" value="${value as string}">`;
})} })}
<ak-empty-state <ak-empty-state
?loading="${true}"> ?loading="${true}">

View file

@ -1,14 +1,16 @@
import { Challenge } from "authentik-api"; import { LitElement, property } from "lit-element";
import { LitElement } from "lit-element";
export interface StageHost { export interface StageHost {
challenge?: Challenge; challenge?: unknown;
submit<T>(formData?: T): Promise<void>; submit(payload: unknown): Promise<void>;
} }
export class BaseStage extends LitElement { export class BaseStage<Tin, Tout> extends LitElement {
host?: StageHost; host!: StageHost;
@property({ attribute: false })
challenge!: Tin;
submitForm(e: Event): void { submitForm(e: Event): void {
e.preventDefault(); e.preventDefault();
@ -17,7 +19,7 @@ export class BaseStage extends LitElement {
} = {}; } = {};
const form = new FormData(this.shadowRoot?.querySelector("form") || undefined); const form = new FormData(this.shadowRoot?.querySelector("form") || undefined);
form.forEach((value, key) => object[key] = value); form.forEach((value, key) => object[key] = value);
this.host?.submit(object); this.host?.submit(object as unknown as Tout);
} }
} }

View file

@ -1,6 +1,5 @@
import { t } from "@lingui/macro"; import { t } from "@lingui/macro";
import { CSSResult, customElement, html, property, TemplateResult } from "lit-element"; import { CSSResult, customElement, html, TemplateResult } from "lit-element";
import { WithUserInfoChallenge } from "../../../api/Flows";
import PFLogin from "@patternfly/patternfly/components/Login/login.css"; import PFLogin from "@patternfly/patternfly/components/Login/login.css";
import PFForm from "@patternfly/patternfly/components/Form/form.css"; import PFForm from "@patternfly/patternfly/components/Form/form.css";
import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css"; import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css";
@ -14,27 +13,15 @@ import "../../../elements/forms/FormElement";
import "../../../elements/EmptyState"; import "../../../elements/EmptyState";
import "../../FormStatic"; import "../../FormStatic";
import { FlowURLManager } from "../../../api/legacy"; import { FlowURLManager } from "../../../api/legacy";
import { CaptchaChallenge, CaptchaChallengeResponseRequest } from "authentik-api";
export interface CaptchaChallenge extends WithUserInfoChallenge {
site_key: string;
}
@customElement("ak-stage-captcha") @customElement("ak-stage-captcha")
export class CaptchaStage extends BaseStage { export class CaptchaStage extends BaseStage<CaptchaChallenge, CaptchaChallengeResponseRequest> {
@property({ attribute: false })
challenge?: CaptchaChallenge;
static get styles(): CSSResult[] { static get styles(): CSSResult[] {
return [PFBase, PFLogin, PFForm, PFFormControl, PFTitle, PFButton, AKGlobal]; return [PFBase, PFLogin, PFForm, PFFormControl, PFTitle, PFButton, AKGlobal];
} }
submitFormAlt(token: string): void {
const form = new FormData();
form.set("token", token);
this.host?.submit(form);
}
firstUpdated(): void { firstUpdated(): void {
const script = document.createElement("script"); const script = document.createElement("script");
script.src = "https://www.google.com/recaptcha/api.js"; script.src = "https://www.google.com/recaptcha/api.js";
@ -45,12 +32,14 @@ export class CaptchaStage extends BaseStage {
script.onload = () => { script.onload = () => {
console.debug("authentik/stages/captcha: script loaded"); console.debug("authentik/stages/captcha: script loaded");
grecaptcha.ready(() => { grecaptcha.ready(() => {
if (!this.challenge?.site_key) return; if (!this.challenge?.siteKey) return;
console.debug("authentik/stages/captcha: ready"); console.debug("authentik/stages/captcha: ready");
const captchaId = grecaptcha.render(captchaContainer, { const captchaId = grecaptcha.render(captchaContainer, {
sitekey: this.challenge.site_key, sitekey: this.challenge.siteKey,
callback: (token) => { callback: (token) => {
this.submitFormAlt(token); this.host?.submit({
"token": token,
});
}, },
size: "invisible", size: "invisible",
}); });
@ -76,8 +65,8 @@ export class CaptchaStage extends BaseStage {
<form class="pf-c-form"> <form class="pf-c-form">
<ak-form-static <ak-form-static
class="pf-c-form__group" class="pf-c-form__group"
userAvatar="${this.challenge.pending_user_avatar}" userAvatar="${this.challenge.pendingUserAvatar}"
user=${this.challenge.pending_user}> user=${this.challenge.pendingUser}>
<div slot="link"> <div slot="link">
<a href="${FlowURLManager.cancel()}">${t`Not you?`}</a> <a href="${FlowURLManager.cancel()}">${t`Not you?`}</a>
</div> </div>

View file

@ -1,6 +1,5 @@
import { t } from "@lingui/macro"; import { t } from "@lingui/macro";
import { CSSResult, customElement, html, property, TemplateResult } from "lit-element"; import { CSSResult, customElement, html, TemplateResult } from "lit-element";
import { WithUserInfoChallenge } from "../../../api/Flows";
import PFLogin from "@patternfly/patternfly/components/Login/login.css"; import PFLogin from "@patternfly/patternfly/components/Login/login.css";
import PFForm from "@patternfly/patternfly/components/Form/form.css"; import PFForm from "@patternfly/patternfly/components/Form/form.css";
import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css"; import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css";
@ -12,24 +11,11 @@ import { BaseStage } from "../base";
import "../../../elements/EmptyState"; import "../../../elements/EmptyState";
import "../../FormStatic"; import "../../FormStatic";
import { FlowURLManager } from "../../../api/legacy"; import { FlowURLManager } from "../../../api/legacy";
import { ConsentChallenge, ConsentChallengeResponseRequest } from "authentik-api";
export interface Permission {
name: string;
id: string;
}
export interface ConsentChallenge extends WithUserInfoChallenge {
header_text: string;
permissions?: Permission[];
}
@customElement("ak-stage-consent") @customElement("ak-stage-consent")
export class ConsentStage extends BaseStage { export class ConsentStage extends BaseStage<ConsentChallenge, ConsentChallengeResponseRequest> {
@property({ attribute: false })
challenge?: ConsentChallenge;
static get styles(): CSSResult[] { static get styles(): CSSResult[] {
return [PFBase, PFLogin, PFForm, PFFormControl, PFTitle, PFButton, AKGlobal]; return [PFBase, PFLogin, PFForm, PFFormControl, PFTitle, PFButton, AKGlobal];
@ -51,15 +37,15 @@ export class ConsentStage extends BaseStage {
<form class="pf-c-form" @submit=${(e: Event) => { this.submitForm(e); }}> <form class="pf-c-form" @submit=${(e: Event) => { this.submitForm(e); }}>
<ak-form-static <ak-form-static
class="pf-c-form__group" class="pf-c-form__group"
userAvatar="${this.challenge.pending_user_avatar}" userAvatar="${this.challenge.pendingUserAvatar}"
user=${this.challenge.pending_user}> user=${this.challenge.pendingUser}>
<div slot="link"> <div slot="link">
<a href="${FlowURLManager.cancel()}">${t`Not you?`}</a> <a href="${FlowURLManager.cancel()}">${t`Not you?`}</a>
</div> </div>
</ak-form-static> </ak-form-static>
<div class="pf-c-form__group"> <div class="pf-c-form__group">
<p id="header-text"> <p id="header-text">
${this.challenge.header_text} ${this.challenge.headerText}
</p> </p>
<p>${t`Application requires following permissions`}</p> <p>${t`Application requires following permissions`}</p>
<ul class="pf-c-list" id="permmissions"> <ul class="pf-c-list" id="permmissions">

View file

@ -1,6 +1,5 @@
import { t } from "@lingui/macro"; import { t } from "@lingui/macro";
import { CSSResult, customElement, html, property, TemplateResult } from "lit-element"; import { CSSResult, customElement, html, TemplateResult } from "lit-element";
import { Challenge } from "../../../api/Flows";
import PFLogin from "@patternfly/patternfly/components/Login/login.css"; import PFLogin from "@patternfly/patternfly/components/Login/login.css";
import PFForm from "@patternfly/patternfly/components/Form/form.css"; import PFForm from "@patternfly/patternfly/components/Form/form.css";
import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css"; import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css";
@ -11,12 +10,10 @@ import AKGlobal from "../../../authentik.css";
import { BaseStage } from "../base"; import { BaseStage } from "../base";
import "../../../elements/EmptyState"; import "../../../elements/EmptyState";
import "../../FormStatic"; import "../../FormStatic";
import { DummyChallenge, DummyChallengeResponseRequest } from "authentik-api";
@customElement("ak-stage-dummy") @customElement("ak-stage-dummy")
export class DummyStage extends BaseStage { export class DummyStage extends BaseStage<DummyChallenge, DummyChallengeResponseRequest> {
@property({ attribute: false })
challenge?: Challenge;
static get styles(): CSSResult[] { static get styles(): CSSResult[] {
return [PFBase, PFLogin, PFForm, PFFormControl, PFTitle, PFButton, AKGlobal]; return [PFBase, PFLogin, PFForm, PFFormControl, PFTitle, PFButton, AKGlobal];

View file

@ -1,6 +1,5 @@
import { t } from "@lingui/macro"; import { t } from "@lingui/macro";
import { CSSResult, customElement, html, property, TemplateResult } from "lit-element"; import { CSSResult, customElement, html, TemplateResult } from "lit-element";
import { Challenge } from "authentik-api";
import PFLogin from "@patternfly/patternfly/components/Login/login.css"; import PFLogin from "@patternfly/patternfly/components/Login/login.css";
import PFForm from "@patternfly/patternfly/components/Form/form.css"; import PFForm from "@patternfly/patternfly/components/Form/form.css";
import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css"; import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css";
@ -10,14 +9,10 @@ import PFBase from "@patternfly/patternfly/patternfly-base.css";
import AKGlobal from "../../../authentik.css"; import AKGlobal from "../../../authentik.css";
import { BaseStage } from "../base"; import { BaseStage } from "../base";
import "../../../elements/EmptyState"; import "../../../elements/EmptyState";
import { EmailChallenge, EmailChallengeResponseRequest } from "authentik-api";
export type EmailChallenge = Challenge;
@customElement("ak-stage-email") @customElement("ak-stage-email")
export class EmailStage extends BaseStage { export class EmailStage extends BaseStage<EmailChallenge, EmailChallengeResponseRequest> {
@property({ attribute: false })
challenge?: EmailChallenge;
static get styles(): CSSResult[] { static get styles(): CSSResult[] {
return [PFBase, PFLogin, PFForm, PFFormControl, PFButton, PFTitle, AKGlobal]; return [PFBase, PFLogin, PFForm, PFFormControl, PFButton, PFTitle, AKGlobal];

View file

@ -1,5 +1,5 @@
import { t } from "@lingui/macro"; import { t } from "@lingui/macro";
import { css, CSSResult, customElement, html, property, TemplateResult } from "lit-element"; import { css, CSSResult, customElement, html, TemplateResult } from "lit-element";
import { BaseStage } from "../base"; import { BaseStage } from "../base";
import PFLogin from "@patternfly/patternfly/components/Login/login.css"; import PFLogin from "@patternfly/patternfly/components/Login/login.css";
import PFForm from "@patternfly/patternfly/components/Form/form.css"; import PFForm from "@patternfly/patternfly/components/Form/form.css";
@ -10,7 +10,7 @@ import PFBase from "@patternfly/patternfly/patternfly-base.css";
import AKGlobal from "../../../authentik.css"; import AKGlobal from "../../../authentik.css";
import "../../../elements/forms/FormElement"; import "../../../elements/forms/FormElement";
import "../../../elements/EmptyState"; import "../../../elements/EmptyState";
import { Challenge } from "../../../api/Flows"; import { FlowChallengeRequest, IdentificationChallenge, IdentificationChallengeResponseRequest, UILoginButton } from "authentik-api";
export const PasswordManagerPrefill: { export const PasswordManagerPrefill: {
password: string | undefined; password: string | undefined;
@ -20,30 +20,9 @@ export const PasswordManagerPrefill: {
totp: undefined, totp: undefined,
}; };
export interface IdentificationChallenge extends Challenge {
user_fields?: string[];
primary_action: string;
sources?: UILoginButton[];
application_pre?: string;
enroll_url?: string;
recovery_url?: string;
}
export interface UILoginButton {
name: string;
challenge: Challenge;
icon_url?: string;
}
@customElement("ak-stage-identification") @customElement("ak-stage-identification")
export class IdentificationStage extends BaseStage { export class IdentificationStage extends BaseStage<IdentificationChallenge, IdentificationChallengeResponseRequest> {
@property({attribute: false})
challenge?: IdentificationChallenge;
static get styles(): CSSResult[] { static get styles(): CSSResult[] {
return [PFBase, PFLogin, PFForm, PFFormControl, PFTitle, PFButton, AKGlobal].concat( return [PFBase, PFLogin, PFForm, PFFormControl, PFTitle, PFButton, AKGlobal].concat(
@ -75,7 +54,7 @@ export class IdentificationStage extends BaseStage {
username.setAttribute("autocomplete", "username"); username.setAttribute("autocomplete", "username");
username.onkeyup = (ev: Event) => { username.onkeyup = (ev: Event) => {
const el = ev.target as HTMLInputElement; const el = ev.target as HTMLInputElement;
(this.shadowRoot || this).querySelectorAll<HTMLInputElement>("input[name=uid_field]").forEach(input => { (this.shadowRoot || this).querySelectorAll<HTMLInputElement>("input[name=uidField]").forEach(input => {
input.value = el.value; input.value = el.value;
// Because we assume only one input field exists that matches this // Because we assume only one input field exists that matches this
// call focus so the user can press enter // call focus so the user can press enter
@ -98,7 +77,7 @@ export class IdentificationStage extends BaseStage {
PasswordManagerPrefill.password = el.value; PasswordManagerPrefill.password = el.value;
// Because password managers fill username, then password, // Because password managers fill username, then password,
// we need to re-focus the uid_field here too // we need to re-focus the uid_field here too
(this.shadowRoot || this).querySelectorAll<HTMLInputElement>("input[name=uid_field]").forEach(input => { (this.shadowRoot || this).querySelectorAll<HTMLInputElement>("input[name=uidField]").forEach(input => {
// Because we assume only one input field exists that matches this // Because we assume only one input field exists that matches this
// call focus so the user can press enter // call focus so the user can press enter
input.focus(); input.focus();
@ -120,7 +99,7 @@ export class IdentificationStage extends BaseStage {
PasswordManagerPrefill.totp = el.value; PasswordManagerPrefill.totp = el.value;
// Because totp managers fill username, then password, then optionally, // Because totp managers fill username, then password, then optionally,
// we need to re-focus the uid_field here too // we need to re-focus the uid_field here too
(this.shadowRoot || this).querySelectorAll<HTMLInputElement>("input[name=uid_field]").forEach(input => { (this.shadowRoot || this).querySelectorAll<HTMLInputElement>("input[name=uidField]").forEach(input => {
// Because we assume only one input field exists that matches this // Because we assume only one input field exists that matches this
// call focus so the user can press enter // call focus so the user can press enter
input.focus(); input.focus();
@ -131,13 +110,13 @@ export class IdentificationStage extends BaseStage {
renderSource(source: UILoginButton): TemplateResult { renderSource(source: UILoginButton): TemplateResult {
let icon = html`<i class="fas fas fa-share-square" title="${source.name}"></i>`; let icon = html`<i class="fas fas fa-share-square" title="${source.name}"></i>`;
if (source.icon_url) { if (source.iconUrl) {
icon = html`<img src="${source.icon_url}" alt="${source.name}">`; icon = html`<img src="${source.iconUrl}" alt="${source.name}">`;
} }
return html`<li class="pf-c-login__main-footer-links-item"> return html`<li class="pf-c-login__main-footer-links-item">
<button type="button" @click=${() => { <button type="button" @click=${() => {
if (!this.host) return; if (!this.host) return;
this.host.challenge = source.challenge; this.host.challenge = source.challenge as FlowChallengeRequest;
}}> }}>
${icon} ${icon}
</button> </button>
@ -145,18 +124,18 @@ export class IdentificationStage extends BaseStage {
} }
renderFooter(): TemplateResult { renderFooter(): TemplateResult {
if (!this.challenge?.enroll_url && !this.challenge?.recovery_url) { if (!this.challenge?.enrollUrl && !this.challenge?.recoveryUrl) {
return html``; return html``;
} }
return html`<div class="pf-c-login__main-footer-band"> return html`<div class="pf-c-login__main-footer-band">
${this.challenge.enroll_url ? html` ${this.challenge.enrollUrl ? html`
<p class="pf-c-login__main-footer-band-item"> <p class="pf-c-login__main-footer-band-item">
${t`Need an account?`} ${t`Need an account?`}
<a id="enroll" href="${this.challenge.enroll_url}">${t`Sign up.`}</a> <a id="enroll" href="${this.challenge.enrollUrl}">${t`Sign up.`}</a>
</p>` : html``} </p>` : html``}
${this.challenge.recovery_url ? html` ${this.challenge.recoveryUrl ? html`
<p class="pf-c-login__main-footer-band-item"> <p class="pf-c-login__main-footer-band-item">
<a id="recovery" href="${this.challenge.recovery_url}">${t`Forgot username or password?`}</a> <a id="recovery" href="${this.challenge.recoveryUrl}">${t`Forgot username or password?`}</a>
</p>` : html``} </p>` : html``}
</div>`; </div>`;
} }
@ -164,15 +143,15 @@ export class IdentificationStage extends BaseStage {
renderInput(): TemplateResult { renderInput(): TemplateResult {
let label = ""; let label = "";
let type = "text"; let type = "text";
if (!this.challenge?.user_fields) { if (!this.challenge?.userFields) {
return html`<p> return html`<p>
${t`Select one of the sources below to login.`} ${t`Select one of the sources below to login.`}
</p>`; </p>`;
} }
if (this.challenge?.user_fields === ["email"]) { if (this.challenge?.userFields === ["email"]) {
label = t`Email`; label = t`Email`;
type = "email"; type = "email";
} else if (this.challenge?.user_fields === ["username"]) { } else if (this.challenge?.userFields === ["username"]) {
label = t`Username`; label = t`Username`;
} else { } else {
label = t`Email or username`; label = t`Email or username`;
@ -181,10 +160,10 @@ export class IdentificationStage extends BaseStage {
label=${label} label=${label}
?required="${true}" ?required="${true}"
class="pf-c-form__group" class="pf-c-form__group"
.errors=${(this.challenge?.response_errors || {})["uid_field"]}> .errors=${(this.challenge?.responseErrors || {})["uid_field"]}>
<!-- @ts-ignore --> <!-- @ts-ignore -->
<input type=${type} <input type=${type}
name="uid_field" name="uidField"
placeholder="Email or Username" placeholder="Email or Username"
autofocus="" autofocus=""
autocomplete="username" autocomplete="username"
@ -193,7 +172,7 @@ export class IdentificationStage extends BaseStage {
</ak-form-element> </ak-form-element>
<div class="pf-c-form__group pf-m-action"> <div class="pf-c-form__group pf-m-action">
<button type="submit" class="pf-c-button pf-m-primary pf-m-block"> <button type="submit" class="pf-c-button pf-m-primary pf-m-block">
${this.challenge.primary_action} ${this.challenge.primaryAction}
</button> </button>
</div>`; </div>`;
} }
@ -212,9 +191,9 @@ export class IdentificationStage extends BaseStage {
</header> </header>
<div class="pf-c-login__main-body"> <div class="pf-c-login__main-body">
<form class="pf-c-form" @submit=${(e: Event) => {this.submitForm(e);}}> <form class="pf-c-form" @submit=${(e: Event) => {this.submitForm(e);}}>
${this.challenge.application_pre ? ${this.challenge.applicationPre ?
html`<p> html`<p>
${t`Login to continue to ${this.challenge.application_pre}.`} ${t`Login to continue to ${this.challenge.applicationPre}.`}
</p>`: </p>`:
html``} html``}
${this.renderInput()} ${this.renderInput()}

View file

@ -1,6 +1,5 @@
import { t } from "@lingui/macro"; import { t } from "@lingui/macro";
import { CSSResult, customElement, html, property, TemplateResult } from "lit-element"; import { CSSResult, customElement, html, TemplateResult } from "lit-element";
import { WithUserInfoChallenge } from "../../../api/Flows";
import PFLogin from "@patternfly/patternfly/components/Login/login.css"; import PFLogin from "@patternfly/patternfly/components/Login/login.css";
import PFForm from "@patternfly/patternfly/components/Form/form.css"; import PFForm from "@patternfly/patternfly/components/Form/form.css";
import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css"; import PFFormControl from "@patternfly/patternfly/components/FormControl/form-control.css";
@ -14,16 +13,10 @@ import "../../../elements/EmptyState";
import { PasswordManagerPrefill } from "../identification/IdentificationStage"; import { PasswordManagerPrefill } from "../identification/IdentificationStage";
import "../../FormStatic"; import "../../FormStatic";
import { FlowURLManager } from "../../../api/legacy"; import { FlowURLManager } from "../../../api/legacy";
import { PasswordChallenge, PasswordChallengeResponseRequest } from "authentik-api";
export interface PasswordChallenge extends WithUserInfoChallenge {
recovery_url?: string;
}
@customElement("ak-stage-password") @customElement("ak-stage-password")
export class PasswordStage extends BaseStage { export class PasswordStage extends BaseStage<PasswordChallenge, PasswordChallengeResponseRequest> {
@property({attribute: false})
challenge?: PasswordChallenge;
static get styles(): CSSResult[] { static get styles(): CSSResult[] {
return [PFBase, PFLogin, PFForm, PFFormControl, PFButton, PFTitle, AKGlobal]; return [PFBase, PFLogin, PFForm, PFFormControl, PFButton, PFTitle, AKGlobal];
@ -45,18 +38,18 @@ export class PasswordStage extends BaseStage {
<form class="pf-c-form" @submit=${(e: Event) => {this.submitForm(e);}}> <form class="pf-c-form" @submit=${(e: Event) => {this.submitForm(e);}}>
<ak-form-static <ak-form-static
class="pf-c-form__group" class="pf-c-form__group"
userAvatar="${this.challenge.pending_user_avatar}" userAvatar="${this.challenge.pendingUserAvatar}"
user=${this.challenge.pending_user}> user=${this.challenge.pendingUser}>
<div slot="link"> <div slot="link">
<a href="${FlowURLManager.cancel()}">${t`Not you?`}</a> <a href="${FlowURLManager.cancel()}">${t`Not you?`}</a>
</div> </div>
</ak-form-static> </ak-form-static>
<input name="username" autocomplete="username" type="hidden" value="${this.challenge.pending_user}"> <input name="username" autocomplete="username" type="hidden" value="${this.challenge.pendingUser}">
<ak-form-element <ak-form-element
label="${t`Password`}" label="${t`Password`}"
?required="${true}" ?required="${true}"
class="pf-c-form__group" class="pf-c-form__group"
.errors=${(this.challenge?.response_errors || {})["password"]}> .errors=${(this.challenge?.responseErrors || {})["password"]}>
<input type="password" <input type="password"
name="password" name="password"
placeholder="${t`Please enter your password`}" placeholder="${t`Please enter your password`}"
@ -67,8 +60,8 @@ export class PasswordStage extends BaseStage {
value=${PasswordManagerPrefill.password || ""}> value=${PasswordManagerPrefill.password || ""}>
</ak-form-element> </ak-form-element>
${this.challenge.recovery_url ? ${this.challenge.recoveryUrl ?
html`<a href="${this.challenge.recovery_url}"> html`<a href="${this.challenge.recoveryUrl}">
${t`Forgot password?`}</a>` : ""} ${t`Forgot password?`}</a>` : ""}
<div class="pf-c-form__group pf-m-action"> <div class="pf-c-form__group pf-m-action">

View file

@ -1,5 +1,5 @@
import { t } from "@lingui/macro"; import { t } from "@lingui/macro";
import { CSSResult, customElement, html, property, TemplateResult } from "lit-element"; import { CSSResult, customElement, html, TemplateResult } from "lit-element";
import { unsafeHTML } from "lit-html/directives/unsafe-html"; import { unsafeHTML } from "lit-html/directives/unsafe-html";
import PFLogin from "@patternfly/patternfly/components/Login/login.css"; import PFLogin from "@patternfly/patternfly/components/Login/login.css";
import PFForm from "@patternfly/patternfly/components/Form/form.css"; import PFForm from "@patternfly/patternfly/components/Form/form.css";
@ -13,37 +13,23 @@ import { BaseStage } from "../base";
import "../../../elements/forms/FormElement"; import "../../../elements/forms/FormElement";
import "../../../elements/EmptyState"; import "../../../elements/EmptyState";
import "../../../elements/Divider"; import "../../../elements/Divider";
import { Challenge, Error } from "../../../api/Flows"; import { Error } from "../../../api/Flows";
import { PromptChallenge, PromptChallengeResponseRequest, StagePrompt } from "authentik-api";
export interface Prompt {
field_key: string;
label: string;
type: string;
required: boolean;
placeholder: string;
order: number;
}
export interface PromptChallenge extends Challenge {
fields: Prompt[];
}
@customElement("ak-stage-prompt") @customElement("ak-stage-prompt")
export class PromptStage extends BaseStage { export class PromptStage extends BaseStage<PromptChallenge, PromptChallengeResponseRequest> {
@property({attribute: false})
challenge?: PromptChallenge;
static get styles(): CSSResult[] { static get styles(): CSSResult[] {
return [PFBase, PFLogin, PFAlert, PFForm, PFFormControl, PFTitle, PFButton, AKGlobal]; return [PFBase, PFLogin, PFAlert, PFForm, PFFormControl, PFTitle, PFButton, AKGlobal];
} }
renderPromptInner(prompt: Prompt): string { renderPromptInner(prompt: StagePrompt): string {
switch (prompt.type) { switch (prompt.type) {
case "text": case "text":
return `<input return `<input
type="text" type="text"
name="${prompt.field_key}" name="${prompt.fieldKey}"
placeholder="${prompt.placeholder}" placeholder="${prompt.placeholder}"
autocomplete="off" autocomplete="off"
class="pf-c-form-control" class="pf-c-form-control"
@ -52,7 +38,7 @@ export class PromptStage extends BaseStage {
case "username": case "username":
return `<input return `<input
type="text" type="text"
name="${prompt.field_key}" name="${prompt.fieldKey}"
placeholder="${prompt.placeholder}" placeholder="${prompt.placeholder}"
autocomplete="username" autocomplete="username"
class="pf-c-form-control" class="pf-c-form-control"
@ -61,7 +47,7 @@ export class PromptStage extends BaseStage {
case "email": case "email":
return `<input return `<input
type="email" type="email"
name="${prompt.field_key}" name="${prompt.fieldKey}"
placeholder="${prompt.placeholder}" placeholder="${prompt.placeholder}"
class="pf-c-form-control" class="pf-c-form-control"
?required=${prompt.required} ?required=${prompt.required}
@ -69,7 +55,7 @@ export class PromptStage extends BaseStage {
case "password": case "password":
return `<input return `<input
type="password" type="password"
name="${prompt.field_key}" name="${prompt.fieldKey}"
placeholder="${prompt.placeholder}" placeholder="${prompt.placeholder}"
autocomplete="new-password" autocomplete="new-password"
class="pf-c-form-control" class="pf-c-form-control"
@ -77,28 +63,28 @@ export class PromptStage extends BaseStage {
case "number": case "number":
return `<input return `<input
type="number" type="number"
name="${prompt.field_key}" name="${prompt.fieldKey}"
placeholder="${prompt.placeholder}" placeholder="${prompt.placeholder}"
class="pf-c-form-control" class="pf-c-form-control"
?required=${prompt.required}>`; ?required=${prompt.required}>`;
case "checkbox": case "checkbox":
return `<input return `<input
type="checkbox" type="checkbox"
name="${prompt.field_key}" name="${prompt.fieldKey}"
placeholder="${prompt.placeholder}" placeholder="${prompt.placeholder}"
class="pf-c-form-control" class="pf-c-form-control"
?required=${prompt.required}>`; ?required=${prompt.required}>`;
case "date": case "date":
return `<input return `<input
type="date" type="date"
name="${prompt.field_key}" name="${prompt.fieldKey}"
placeholder="${prompt.placeholder}" placeholder="${prompt.placeholder}"
class="pf-c-form-control" class="pf-c-form-control"
?required=${prompt.required}>`; ?required=${prompt.required}>`;
case "date-time": case "date-time":
return `<input return `<input
type="datetime" type="datetime"
name="${prompt.field_key}" name="${prompt.fieldKey}"
placeholder="${prompt.placeholder}" placeholder="${prompt.placeholder}"
class="pf-c-form-control" class="pf-c-form-control"
?required=${prompt.required}>`; ?required=${prompt.required}>`;
@ -107,7 +93,7 @@ export class PromptStage extends BaseStage {
case "hidden": case "hidden":
return `<input return `<input
type="hidden" type="hidden"
name="${prompt.field_key}" name="${prompt.fieldKey}"
value="${prompt.placeholder}" value="${prompt.placeholder}"
class="pf-c-form-control" class="pf-c-form-control"
?required=${prompt.required}>`; ?required=${prompt.required}>`;
@ -158,12 +144,12 @@ export class PromptStage extends BaseStage {
label="${prompt.label}" label="${prompt.label}"
?required="${prompt.required}" ?required="${prompt.required}"
class="pf-c-form__group" class="pf-c-form__group"
.errors=${(this.challenge?.response_errors || {})[prompt.field_key]}> .errors=${(this.challenge?.responseErrors || {})[prompt.fieldKey]}>
${unsafeHTML(this.renderPromptInner(prompt))} ${unsafeHTML(this.renderPromptInner(prompt))}
</ak-form-element>`; </ak-form-element>`;
})} })}
${"non_field_errors" in (this.challenge?.response_errors || {}) ? ${"non_field_errors" in (this.challenge?.responseErrors || {}) ?
this.renderNonFieldErrors(this.challenge?.response_errors?.non_field_errors || []): this.renderNonFieldErrors(this.challenge?.responseErrors?.non_field_errors || []):
html``} html``}
<div class="pf-c-form__group pf-m-action"> <div class="pf-c-form__group pf-m-action">
<button type="submit" class="pf-c-button pf-m-primary pf-m-block"> <button type="submit" class="pf-c-button pf-m-primary pf-m-block">

View file

@ -63,6 +63,10 @@ msgstr "ANY, any policy must match to grant access."
msgid "ANY, any policy must match to include this stage access." msgid "ANY, any policy must match to include this stage access."
msgstr "ANY, any policy must match to include this stage access." msgstr "ANY, any policy must match to include this stage access."
#: src/pages/stages/authenticator_duo/AuthenticatorDuoStageForm.ts
msgid "API Hostname"
msgstr "API Hostname"
#: src/elements/notifications/APIDrawer.ts #: src/elements/notifications/APIDrawer.ts
msgid "API Requests" msgid "API Requests"
msgstr "API Requests" msgstr "API Requests"
@ -180,6 +184,10 @@ msgstr "Allows/denys requests based on the users and/or the IPs reputation."
msgid "Also known as Entity ID. Defaults the Metadata URL." msgid "Also known as Entity ID. Defaults the Metadata URL."
msgstr "Also known as Entity ID. Defaults the Metadata URL." msgstr "Also known as Entity ID. Defaults the Metadata URL."
#: src/flows/stages/authenticator_duo/AuthenticatorDuoStage.ts
msgid "Alternatively, if your current device has Duo installed, click on this link:"
msgstr "Alternatively, if your current device has Duo installed, click on this link:"
#: src/pages/stages/consent/ConsentStageForm.ts #: src/pages/stages/consent/ConsentStageForm.ts
msgid "Always require consent" msgid "Always require consent"
msgstr "Always require consent" msgstr "Always require consent"
@ -522,6 +530,10 @@ msgstr "Check IP"
msgid "Check Username" msgid "Check Username"
msgstr "Check Username" msgstr "Check Username"
#: src/flows/stages/authenticator_duo/AuthenticatorDuoStage.ts
msgid "Check status"
msgstr "Check status"
#: src/flows/stages/email/EmailStage.ts #: src/flows/stages/email/EmailStage.ts
msgid "Check your Emails for a password reset link." msgid "Check your Emails for a password reset link."
msgstr "Check your Emails for a password reset link." msgstr "Check your Emails for a password reset link."
@ -616,6 +628,7 @@ msgstr "Confidential clients are capable of maintaining the confidentiality of t
msgid "Configuration" msgid "Configuration"
msgstr "Configuration" msgstr "Configuration"
#: src/pages/stages/authenticator_duo/AuthenticatorDuoStageForm.ts
#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts #: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts
#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts #: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts
#: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts
@ -715,6 +728,7 @@ msgstr "Context"
#: src/flows/stages/authenticator_static/AuthenticatorStaticStage.ts #: src/flows/stages/authenticator_static/AuthenticatorStaticStage.ts
#: src/flows/stages/authenticator_totp/AuthenticatorTOTPStage.ts #: src/flows/stages/authenticator_totp/AuthenticatorTOTPStage.ts
#: src/flows/stages/authenticator_validate/AuthenticatorValidateStageCode.ts #: src/flows/stages/authenticator_validate/AuthenticatorValidateStageCode.ts
#: src/flows/stages/authenticator_validate/AuthenticatorValidateStageDuo.ts
#: src/flows/stages/autosubmit/AutosubmitStage.ts #: src/flows/stages/autosubmit/AutosubmitStage.ts
#: src/flows/stages/consent/ConsentStage.ts #: src/flows/stages/consent/ConsentStage.ts
#: src/flows/stages/dummy/DummyStage.ts #: src/flows/stages/dummy/DummyStage.ts
@ -1010,6 +1024,10 @@ msgstr "Determines how authentik sends the response back to the Service Provider
msgid "Determines how long a session lasts. Default of 0 seconds means that the sessions lasts until the browser is closed." msgid "Determines how long a session lasts. Default of 0 seconds means that the sessions lasts until the browser is closed."
msgstr "Determines how long a session lasts. Default of 0 seconds means that the sessions lasts until the browser is closed." msgstr "Determines how long a session lasts. Default of 0 seconds means that the sessions lasts until the browser is closed."
#: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts
msgid "Device classes"
msgstr "Device classes"
#: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts
msgid "Device classes which can be used to authenticate." msgid "Device classes which can be used to authenticate."
msgstr "Device classes which can be used to authenticate." msgstr "Device classes which can be used to authenticate."
@ -1032,6 +1050,7 @@ msgstr "Digits"
msgid "Disable" msgid "Disable"
msgstr "Disable" msgstr "Disable"
#: src/pages/user-settings/settings/UserSettingsAuthenticatorDuo.ts
#: src/pages/user-settings/settings/UserSettingsAuthenticatorStatic.ts #: src/pages/user-settings/settings/UserSettingsAuthenticatorStatic.ts
msgid "Disable Static Tokens" msgid "Disable Static Tokens"
msgstr "Disable Static Tokens" msgstr "Disable Static Tokens"
@ -1070,6 +1089,22 @@ msgstr "Download Private key"
msgid "Dummy stage used for testing. Shows a simple continue button and always passes." msgid "Dummy stage used for testing. Shows a simple continue button and always passes."
msgstr "Dummy stage used for testing. Shows a simple continue button and always passes." msgstr "Dummy stage used for testing. Shows a simple continue button and always passes."
#: src/pages/user-settings/settings/UserSettingsAuthenticatorDuo.ts
msgid "Duo"
msgstr "Duo"
#: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts
msgid "Duo Authenticators"
msgstr "Duo Authenticators"
#: src/flows/stages/authenticator_duo/AuthenticatorDuoStage.ts
msgid "Duo activation"
msgstr "Duo activation"
#: src/flows/stages/authenticator_validate/AuthenticatorValidateStage.ts
msgid "Duo push-notifications"
msgstr "Duo push-notifications"
#: src/pages/providers/oauth2/OAuth2ProviderForm.ts #: src/pages/providers/oauth2/OAuth2ProviderForm.ts
msgid "Each provider has a different issuer, based on the application slug." msgid "Each provider has a different issuer, based on the application slug."
msgstr "Each provider has a different issuer, based on the application slug." msgstr "Each provider has a different issuer, based on the application slug."
@ -1159,6 +1194,7 @@ msgstr "Enable"
msgid "Enable StartTLS" msgid "Enable StartTLS"
msgstr "Enable StartTLS" msgstr "Enable StartTLS"
#: src/pages/user-settings/settings/UserSettingsAuthenticatorDuo.ts
#: src/pages/user-settings/settings/UserSettingsAuthenticatorStatic.ts #: src/pages/user-settings/settings/UserSettingsAuthenticatorStatic.ts
msgid "Enable Static Tokens" msgid "Enable Static Tokens"
msgstr "Enable Static Tokens" msgstr "Enable Static Tokens"
@ -1431,6 +1467,7 @@ msgstr "Flow used before authentication."
msgid "Flow used by an authenticated user to configure their password. If empty, user will not be able to configure change their password." msgid "Flow used by an authenticated user to configure their password. If empty, user will not be able to configure change their password."
msgstr "Flow used by an authenticated user to configure their password. If empty, user will not be able to configure change their password." msgstr "Flow used by an authenticated user to configure their password. If empty, user will not be able to configure change their password."
#: src/pages/stages/authenticator_duo/AuthenticatorDuoStageForm.ts
#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts #: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts
#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts #: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts
msgid "Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage." msgid "Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage."
@ -1664,6 +1701,10 @@ msgstr "Include User claims from scopes in the id_token, for applications that d
msgid "Include claims in id_token" msgid "Include claims in id_token"
msgstr "Include claims in id_token" msgstr "Include claims in id_token"
#: src/pages/stages/authenticator_duo/AuthenticatorDuoStageForm.ts
msgid "Integration key"
msgstr "Integration key"
#: src/pages/providers/proxy/ProxyProviderViewPage.ts #: src/pages/providers/proxy/ProxyProviderViewPage.ts
msgid "Internal Host" msgid "Internal Host"
msgstr "Internal Host" msgstr "Internal Host"
@ -1803,10 +1844,12 @@ msgstr "Load servers"
#: src/flows/FlowExecutor.ts #: src/flows/FlowExecutor.ts
#: src/flows/FlowExecutor.ts #: src/flows/FlowExecutor.ts
#: src/flows/access_denied/FlowAccessDenied.ts #: src/flows/access_denied/FlowAccessDenied.ts
#: src/flows/stages/authenticator_duo/AuthenticatorDuoStage.ts
#: src/flows/stages/authenticator_static/AuthenticatorStaticStage.ts #: src/flows/stages/authenticator_static/AuthenticatorStaticStage.ts
#: src/flows/stages/authenticator_totp/AuthenticatorTOTPStage.ts #: src/flows/stages/authenticator_totp/AuthenticatorTOTPStage.ts
#: src/flows/stages/authenticator_validate/AuthenticatorValidateStage.ts #: src/flows/stages/authenticator_validate/AuthenticatorValidateStage.ts
#: src/flows/stages/authenticator_validate/AuthenticatorValidateStageCode.ts #: src/flows/stages/authenticator_validate/AuthenticatorValidateStageCode.ts
#: src/flows/stages/authenticator_validate/AuthenticatorValidateStageDuo.ts
#: src/flows/stages/autosubmit/AutosubmitStage.ts #: src/flows/stages/autosubmit/AutosubmitStage.ts
#: src/flows/stages/captcha/CaptchaStage.ts #: src/flows/stages/captcha/CaptchaStage.ts
#: src/flows/stages/consent/ConsentStage.ts #: src/flows/stages/consent/ConsentStage.ts
@ -1866,6 +1909,7 @@ msgstr "Loading"
#: src/pages/sources/saml/SAMLSourceForm.ts #: src/pages/sources/saml/SAMLSourceForm.ts
#: src/pages/sources/saml/SAMLSourceForm.ts #: src/pages/sources/saml/SAMLSourceForm.ts
#: src/pages/sources/saml/SAMLSourceForm.ts #: src/pages/sources/saml/SAMLSourceForm.ts
#: src/pages/stages/authenticator_duo/AuthenticatorDuoStageForm.ts
#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts #: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts
#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts #: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts
#: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts
@ -2041,6 +2085,7 @@ msgstr "My Applications"
#: src/pages/sources/saml/SAMLSourceForm.ts #: src/pages/sources/saml/SAMLSourceForm.ts
#: src/pages/sources/saml/SAMLSourceViewPage.ts #: src/pages/sources/saml/SAMLSourceViewPage.ts
#: src/pages/stages/StageListPage.ts #: src/pages/stages/StageListPage.ts
#: src/pages/stages/authenticator_duo/AuthenticatorDuoStageForm.ts
#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts #: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts
#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts #: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts
#: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts
@ -2173,9 +2218,11 @@ msgstr "Not found"
msgid "Not synced yet." msgid "Not synced yet."
msgstr "Not synced yet." msgstr "Not synced yet."
#: src/flows/stages/authenticator_duo/AuthenticatorDuoStage.ts
#: src/flows/stages/authenticator_static/AuthenticatorStaticStage.ts #: src/flows/stages/authenticator_static/AuthenticatorStaticStage.ts
#: src/flows/stages/authenticator_totp/AuthenticatorTOTPStage.ts #: src/flows/stages/authenticator_totp/AuthenticatorTOTPStage.ts
#: src/flows/stages/authenticator_validate/AuthenticatorValidateStageCode.ts #: src/flows/stages/authenticator_validate/AuthenticatorValidateStageCode.ts
#: src/flows/stages/authenticator_validate/AuthenticatorValidateStageDuo.ts
#: src/flows/stages/captcha/CaptchaStage.ts #: src/flows/stages/captcha/CaptchaStage.ts
#: src/flows/stages/consent/ConsentStage.ts #: src/flows/stages/consent/ConsentStage.ts
#: src/flows/stages/password/PasswordStage.ts #: src/flows/stages/password/PasswordStage.ts
@ -2617,6 +2664,10 @@ msgstr "RSA-SHA512"
msgid "Re-evaluate policies" msgid "Re-evaluate policies"
msgstr "Re-evaluate policies" msgstr "Re-evaluate policies"
#: src/flows/stages/authenticator_validate/AuthenticatorValidateStage.ts
msgid "Receive a push notification on your phone to prove your identity."
msgstr "Receive a push notification on your phone to prove your identity."
#: src/pages/flows/FlowForm.ts #: src/pages/flows/FlowForm.ts
msgid "Recovery" msgid "Recovery"
msgstr "Recovery" msgstr "Recovery"
@ -2728,6 +2779,7 @@ msgid "Return home"
msgstr "Return home" msgstr "Return home"
#: src/flows/stages/authenticator_validate/AuthenticatorValidateStageCode.ts #: src/flows/stages/authenticator_validate/AuthenticatorValidateStageCode.ts
#: src/flows/stages/authenticator_validate/AuthenticatorValidateStageDuo.ts
#: src/flows/stages/authenticator_validate/AuthenticatorValidateStageWebAuthn.ts #: src/flows/stages/authenticator_validate/AuthenticatorValidateStageWebAuthn.ts
msgid "Return to device picker" msgid "Return to device picker"
msgstr "Return to device picker" msgstr "Return to device picker"
@ -2804,6 +2856,10 @@ msgstr "Scopes"
msgid "Search..." msgid "Search..."
msgstr "Search..." msgstr "Search..."
#: src/pages/stages/authenticator_duo/AuthenticatorDuoStageForm.ts
msgid "Secret key"
msgstr "Secret key"
#: src/pages/events/EventInfo.ts #: src/pages/events/EventInfo.ts
msgid "Secret:" msgid "Secret:"
msgstr "Secret:" msgstr "Secret:"
@ -3033,6 +3089,10 @@ msgstr "Stage used to configure a TOTP authenticator (i.e. Authy/Google Authenti
msgid "Stage used to configure a WebAutnn authenticator (i.e. Yubikey, FaceID/Windows Hello)." msgid "Stage used to configure a WebAutnn authenticator (i.e. Yubikey, FaceID/Windows Hello)."
msgstr "Stage used to configure a WebAutnn authenticator (i.e. Yubikey, FaceID/Windows Hello)." msgstr "Stage used to configure a WebAutnn authenticator (i.e. Yubikey, FaceID/Windows Hello)."
#: src/pages/stages/authenticator_duo/AuthenticatorDuoStageForm.ts
msgid "Stage used to configure a duo-based authenticator. This stage should be used for configuration flows."
msgstr "Stage used to configure a duo-based authenticator. This stage should be used for configuration flows."
#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts #: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts
msgid "Stage used to configure a static authenticator (i.e. static tokens). This stage should be used for configuration flows." msgid "Stage used to configure a static authenticator (i.e. static tokens). This stage should be used for configuration flows."
msgstr "Stage used to configure a static authenticator (i.e. static tokens). This stage should be used for configuration flows." msgstr "Stage used to configure a static authenticator (i.e. static tokens). This stage should be used for configuration flows."
@ -3041,6 +3101,7 @@ msgstr "Stage used to configure a static authenticator (i.e. static tokens). Thi
msgid "Stage used to validate any authenticator. This stage should be used during authentication or authorization flows." msgid "Stage used to validate any authenticator. This stage should be used during authentication or authorization flows."
msgstr "Stage used to validate any authenticator. This stage should be used during authentication or authorization flows." msgstr "Stage used to validate any authenticator. This stage should be used during authentication or authorization flows."
#: src/pages/stages/authenticator_duo/AuthenticatorDuoStageForm.ts
#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts #: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts
#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts #: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts
#: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts
@ -3074,7 +3135,7 @@ msgstr "State"
msgid "Static Tokens" msgid "Static Tokens"
msgstr "Static Tokens" msgstr "Static Tokens"
#: src/pages/user-settings/settings/UserSettingsAuthenticatorTOTP.ts #: src/pages/user-settings/settings/UserSettingsAuthenticatorStatic.ts
msgid "Static tokens" msgid "Static tokens"
msgstr "Static tokens" msgstr "Static tokens"
@ -3090,11 +3151,13 @@ msgstr "Statically deny the flow. To use this stage effectively, disable *Evalua
msgid "Status" msgid "Status"
msgstr "Status" msgstr "Status"
#: src/pages/user-settings/settings/UserSettingsAuthenticatorDuo.ts
#: src/pages/user-settings/settings/UserSettingsAuthenticatorStatic.ts #: src/pages/user-settings/settings/UserSettingsAuthenticatorStatic.ts
#: src/pages/user-settings/settings/UserSettingsAuthenticatorTOTP.ts #: src/pages/user-settings/settings/UserSettingsAuthenticatorTOTP.ts
msgid "Status: Disabled" msgid "Status: Disabled"
msgstr "Status: Disabled" msgstr "Status: Disabled"
#: src/pages/user-settings/settings/UserSettingsAuthenticatorDuo.ts
#: src/pages/user-settings/settings/UserSettingsAuthenticatorStatic.ts #: src/pages/user-settings/settings/UserSettingsAuthenticatorStatic.ts
#: src/pages/user-settings/settings/UserSettingsAuthenticatorTOTP.ts #: src/pages/user-settings/settings/UserSettingsAuthenticatorTOTP.ts
msgid "Status: Enabled" msgid "Status: Enabled"
@ -3204,6 +3267,7 @@ msgstr "Successfully created service-connection."
msgid "Successfully created source." msgid "Successfully created source."
msgstr "Successfully created source." msgstr "Successfully created source."
#: src/pages/stages/authenticator_duo/AuthenticatorDuoStageForm.ts
#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts #: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts
#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts #: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts
#: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts
@ -3342,6 +3406,7 @@ msgstr "Successfully updated service-connection."
msgid "Successfully updated source." msgid "Successfully updated source."
msgstr "Successfully updated source." msgstr "Successfully updated source."
#: src/pages/stages/authenticator_duo/AuthenticatorDuoStageForm.ts
#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts #: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts
#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts #: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts
#: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts
@ -3533,7 +3598,7 @@ msgstr "Time in minutes the token sent is valid."
msgid "Time offset when temporary users should be deleted. This only applies if your IDP uses the NameID Format 'transient', and the user doesn't log out manually. (Format: hours=1;minutes=2;seconds=3)." msgid "Time offset when temporary users should be deleted. This only applies if your IDP uses the NameID Format 'transient', and the user doesn't log out manually. (Format: hours=1;minutes=2;seconds=3)."
msgstr "Time offset when temporary users should be deleted. This only applies if your IDP uses the NameID Format 'transient', and the user doesn't log out manually. (Format: hours=1;minutes=2;seconds=3)." msgstr "Time offset when temporary users should be deleted. This only applies if your IDP uses the NameID Format 'transient', and the user doesn't log out manually. (Format: hours=1;minutes=2;seconds=3)."
#: src/pages/user-settings/settings/UserSettingsAuthenticatorStatic.ts #: src/pages/user-settings/settings/UserSettingsAuthenticatorTOTP.ts
msgid "Time-based One-Time Passwords" msgid "Time-based One-Time Passwords"
msgstr "Time-based One-Time Passwords" msgstr "Time-based One-Time Passwords"
@ -3893,7 +3958,6 @@ msgstr "User details"
msgid "User events" msgid "User events"
msgstr "User events" msgstr "User events"
#: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts
#: src/pages/stages/identification/IdentificationStageForm.ts #: src/pages/stages/identification/IdentificationStageForm.ts
msgid "User fields" msgid "User fields"
msgstr "User fields" msgstr "User fields"

View file

@ -63,6 +63,10 @@ msgstr ""
msgid "ANY, any policy must match to include this stage access." msgid "ANY, any policy must match to include this stage access."
msgstr "" msgstr ""
#:
msgid "API Hostname"
msgstr ""
#: #:
msgid "API Requests" msgid "API Requests"
msgstr "" msgstr ""
@ -180,6 +184,10 @@ msgstr ""
msgid "Also known as Entity ID. Defaults the Metadata URL." msgid "Also known as Entity ID. Defaults the Metadata URL."
msgstr "" msgstr ""
#:
msgid "Alternatively, if your current device has Duo installed, click on this link:"
msgstr ""
#: #:
msgid "Always require consent" msgid "Always require consent"
msgstr "" msgstr ""
@ -518,6 +526,10 @@ msgstr ""
msgid "Check Username" msgid "Check Username"
msgstr "" msgstr ""
#:
msgid "Check status"
msgstr ""
#: #:
msgid "Check your Emails for a password reset link." msgid "Check your Emails for a password reset link."
msgstr "" msgstr ""
@ -614,6 +626,7 @@ msgstr ""
#: #:
#: #:
#: #:
#:
msgid "Configuration flow" msgid "Configuration flow"
msgstr "" msgstr ""
@ -715,6 +728,7 @@ msgstr ""
#: #:
#: #:
#: #:
#:
msgid "Continue" msgid "Continue"
msgstr "" msgstr ""
@ -1002,6 +1016,10 @@ msgstr ""
msgid "Determines how long a session lasts. Default of 0 seconds means that the sessions lasts until the browser is closed." msgid "Determines how long a session lasts. Default of 0 seconds means that the sessions lasts until the browser is closed."
msgstr "" msgstr ""
#:
msgid "Device classes"
msgstr ""
#: #:
msgid "Device classes which can be used to authenticate." msgid "Device classes which can be used to authenticate."
msgstr "" msgstr ""
@ -1024,6 +1042,7 @@ msgstr ""
msgid "Disable" msgid "Disable"
msgstr "" msgstr ""
#:
#: #:
msgid "Disable Static Tokens" msgid "Disable Static Tokens"
msgstr "" msgstr ""
@ -1062,6 +1081,22 @@ msgstr ""
msgid "Dummy stage used for testing. Shows a simple continue button and always passes." msgid "Dummy stage used for testing. Shows a simple continue button and always passes."
msgstr "" msgstr ""
#:
msgid "Duo"
msgstr ""
#:
msgid "Duo Authenticators"
msgstr ""
#:
msgid "Duo activation"
msgstr ""
#:
msgid "Duo push-notifications"
msgstr ""
#: #:
msgid "Each provider has a different issuer, based on the application slug." msgid "Each provider has a different issuer, based on the application slug."
msgstr "" msgstr ""
@ -1151,6 +1186,7 @@ msgstr ""
msgid "Enable StartTLS" msgid "Enable StartTLS"
msgstr "" msgstr ""
#:
#: #:
msgid "Enable Static Tokens" msgid "Enable Static Tokens"
msgstr "" msgstr ""
@ -1423,6 +1459,7 @@ msgstr ""
msgid "Flow used by an authenticated user to configure their password. If empty, user will not be able to configure change their password." msgid "Flow used by an authenticated user to configure their password. If empty, user will not be able to configure change their password."
msgstr "" msgstr ""
#:
#: #:
#: #:
msgid "Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage." msgid "Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage."
@ -1656,6 +1693,10 @@ msgstr ""
msgid "Include claims in id_token" msgid "Include claims in id_token"
msgstr "" msgstr ""
#:
msgid "Integration key"
msgstr ""
#: #:
msgid "Internal Host" msgid "Internal Host"
msgstr "" msgstr ""
@ -1811,6 +1852,8 @@ msgstr ""
#: #:
#: #:
#: #:
#:
#:
msgid "Loading" msgid "Loading"
msgstr "" msgstr ""
@ -1867,6 +1910,7 @@ msgstr ""
#: #:
#: #:
#: #:
#:
msgid "Loading..." msgid "Loading..."
msgstr "" msgstr ""
@ -2054,6 +2098,7 @@ msgstr ""
#: #:
#: #:
#: #:
#:
msgid "Name" msgid "Name"
msgstr "" msgstr ""
@ -2171,6 +2216,8 @@ msgstr ""
#: #:
#: #:
#: #:
#:
#:
msgid "Not you?" msgid "Not you?"
msgstr "" msgstr ""
@ -2609,6 +2656,10 @@ msgstr ""
msgid "Re-evaluate policies" msgid "Re-evaluate policies"
msgstr "" msgstr ""
#:
msgid "Receive a push notification on your phone to prove your identity."
msgstr ""
#: #:
msgid "Recovery" msgid "Recovery"
msgstr "" msgstr ""
@ -2719,6 +2770,7 @@ msgstr ""
msgid "Return home" msgid "Return home"
msgstr "" msgstr ""
#:
#: #:
#: #:
msgid "Return to device picker" msgid "Return to device picker"
@ -2796,6 +2848,10 @@ msgstr ""
msgid "Search..." msgid "Search..."
msgstr "" msgstr ""
#:
msgid "Secret key"
msgstr ""
#: #:
msgid "Secret:" msgid "Secret:"
msgstr "" msgstr ""
@ -3025,6 +3081,10 @@ msgstr ""
msgid "Stage used to configure a WebAutnn authenticator (i.e. Yubikey, FaceID/Windows Hello)." msgid "Stage used to configure a WebAutnn authenticator (i.e. Yubikey, FaceID/Windows Hello)."
msgstr "" msgstr ""
#:
msgid "Stage used to configure a duo-based authenticator. This stage should be used for configuration flows."
msgstr ""
#: #:
msgid "Stage used to configure a static authenticator (i.e. static tokens). This stage should be used for configuration flows." msgid "Stage used to configure a static authenticator (i.e. static tokens). This stage should be used for configuration flows."
msgstr "" msgstr ""
@ -3044,6 +3104,7 @@ msgstr ""
#: #:
#: #:
#: #:
#:
msgid "Stage-specific settings" msgid "Stage-specific settings"
msgstr "" msgstr ""
@ -3082,11 +3143,13 @@ msgstr ""
msgid "Status" msgid "Status"
msgstr "" msgstr ""
#:
#: #:
#: #:
msgid "Status: Disabled" msgid "Status: Disabled"
msgstr "" msgstr ""
#:
#: #:
#: #:
msgid "Status: Enabled" msgid "Status: Enabled"
@ -3213,6 +3276,7 @@ msgstr ""
#: #:
#: #:
#: #:
#:
msgid "Successfully created stage." msgid "Successfully created stage."
msgstr "" msgstr ""
@ -3351,6 +3415,7 @@ msgstr ""
#: #:
#: #:
#: #:
#:
msgid "Successfully updated stage." msgid "Successfully updated stage."
msgstr "" msgstr ""
@ -3881,7 +3946,6 @@ msgstr ""
msgid "User events" msgid "User events"
msgstr "" msgstr ""
#:
#: #:
msgid "User fields" msgid "User fields"
msgstr "" msgstr ""

View file

@ -1,5 +1,4 @@
import { CertificateGenerationRequest, CryptoApi } from "authentik-api"; import { CertificateGenerationRequest, CertificateKeyPair, CryptoApi } from "authentik-api";
import { CertificateKeyPair } from "authentik-api/src";
import { t } from "@lingui/macro"; import { t } from "@lingui/macro";
import { customElement } from "lit-element"; import { customElement } from "lit-element";
import { html, TemplateResult } from "lit-html"; import { html, TemplateResult } from "lit-html";

View file

@ -74,7 +74,7 @@ export class FlowViewPage extends LitElement {
new FlowsApi(DEFAULT_CONFIG).flowsInstancesExecuteRetrieve({ new FlowsApi(DEFAULT_CONFIG).flowsInstancesExecuteRetrieve({
slug: this.flow.slug slug: this.flow.slug
}).then(link => { }).then(link => {
const finalURL = `${link.link}?next=/%23${window.location.href}`; const finalURL = `${link.link}?next=/%23${window.location.hash}`;
window.open(finalURL, "_blank"); window.open(finalURL, "_blank");
}); });
}}> }}>

View file

@ -13,7 +13,6 @@ import "../../../elements/forms/FormGroup";
export class SAMLProviderFormPage extends ModelForm<SAMLProvider, number> { export class SAMLProviderFormPage extends ModelForm<SAMLProvider, number> {
loadInstance(pk: number): Promise<SAMLProvider> { loadInstance(pk: number): Promise<SAMLProvider> {
console.log("reading saml provider");
return new ProvidersApi(DEFAULT_CONFIG).providersSamlRetrieve({ return new ProvidersApi(DEFAULT_CONFIG).providersSamlRetrieve({
id: pk, id: pk,
}); });

View file

@ -15,6 +15,7 @@ import { Stage, StagesApi } from "authentik-api";
import { DEFAULT_CONFIG } from "../../api/Config"; import { DEFAULT_CONFIG } from "../../api/Config";
import { ifDefined } from "lit-html/directives/if-defined"; import { ifDefined } from "lit-html/directives/if-defined";
import "./authenticator_duo/AuthenticatorDuoStageForm.ts";
import "./authenticator_static/AuthenticatorStaticStageForm.ts"; import "./authenticator_static/AuthenticatorStaticStageForm.ts";
import "./authenticator_totp/AuthenticatorTOTPStageForm.ts"; import "./authenticator_totp/AuthenticatorTOTPStageForm.ts";
import "./authenticator_validate/AuthenticatorValidateStageForm.ts"; import "./authenticator_validate/AuthenticatorValidateStageForm.ts";

View file

@ -0,0 +1,105 @@
import { FlowsApi, AuthenticatorDuoStage, StagesApi, FlowsInstancesListDesignationEnum, AuthenticatorDuoStageRequest } from "authentik-api";
import { t } from "@lingui/macro";
import { customElement } from "lit-element";
import { html, TemplateResult } from "lit-html";
import { DEFAULT_CONFIG } from "../../../api/Config";
import { ifDefined } from "lit-html/directives/if-defined";
import "../../../elements/forms/HorizontalFormElement";
import "../../../elements/forms/FormGroup";
import { until } from "lit-html/directives/until";
import { first } from "../../../utils";
import { ModelForm } from "../../../elements/forms/ModelForm";
@customElement("ak-stage-authenticator-duo-form")
export class AuthenticatorDuoStageForm extends ModelForm<AuthenticatorDuoStage, string> {
loadInstance(pk: string): Promise<AuthenticatorDuoStage> {
return new StagesApi(DEFAULT_CONFIG).stagesAuthenticatorDuoRetrieve({
stageUuid: pk,
});
}
getSuccessMessage(): string {
if (this.instance) {
return t`Successfully updated stage.`;
} else {
return t`Successfully created stage.`;
}
}
send = (data: AuthenticatorDuoStage): Promise<AuthenticatorDuoStage> => {
if (this.instance) {
return new StagesApi(DEFAULT_CONFIG).stagesAuthenticatorDuoPartialUpdate({
stageUuid: this.instance.pk || "",
patchedAuthenticatorDuoStageRequest: data
});
} else {
return new StagesApi(DEFAULT_CONFIG).stagesAuthenticatorDuoCreate({
authenticatorDuoStageRequest: data as unknown as AuthenticatorDuoStageRequest
});
}
};
renderForm(): TemplateResult {
return html`<form class="pf-c-form pf-m-horizontal">
<div class="form-help-text">
${t`Stage used to configure a duo-based authenticator. This stage should be used for configuration flows.`}
</div>
<ak-form-element-horizontal
label=${t`Name`}
?required=${true}
name="name">
<input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
</ak-form-element-horizontal>
<ak-form-group .expanded=${true}>
<span slot="header">
${t`Stage-specific settings`}
</span>
<div slot="body" class="pf-c-form">
<ak-form-element-horizontal
label=${t`Integration key`}
?required=${true}
name="clientId">
<input type="text" value="${first(this.instance?.clientId, "")}" class="pf-c-form-control" required>
</ak-form-element-horizontal>
<ak-form-element-horizontal
label=${t`Secret key`}
?required=${true}
?writeOnly=${this.instance !== undefined}
name="clientSecret">
<input type="text" value="" class="pf-c-form-control" required>
</ak-form-element-horizontal>
<ak-form-element-horizontal
label=${t`API Hostname`}
?required=${true}
name="apiHostname">
<input type="text" value="${first(this.instance?.apiHostname, "")}" class="pf-c-form-control" required>
</ak-form-element-horizontal>
<ak-form-element-horizontal
label=${t`Configuration flow`}
name="configureFlow">
<select class="pf-c-form-control">
<option value="" ?selected=${this.instance?.configureFlow === undefined}>---------</option>
${until(new FlowsApi(DEFAULT_CONFIG).flowsInstancesList({
ordering: "pk",
designation: FlowsInstancesListDesignationEnum.StageConfiguration,
}).then(flows => {
return flows.results.map(flow => {
let selected = this.instance?.configureFlow === flow.pk;
if (!this.instance?.pk && !this.instance?.configureFlow && flow.slug === "default-otp-time-configure") {
selected = true;
}
return html`<option value=${ifDefined(flow.pk)} ?selected=${selected}>${flow.name} (${flow.slug})</option>`;
});
}), html`<option>${t`Loading...`}</option>`)}
</select>
<p class="pf-c-form__helper-text">
${t`Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.`}
</p>
</ak-form-element-horizontal>
</div>
</ak-form-group>
</form>`;
}
}

Some files were not shown because too many files have changed in this diff Show more