Revert "stages/authenticator_*: directly save devices into db instead of session to prevent race conditions"
closes #4008
This reverts commit 538c2ca4d3
.
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
# Conflicts:
# authentik/stages/authenticator_static/stage.py
# authentik/stages/authenticator_totp/stage.py
This commit is contained in:
parent
3abf3de596
commit
9bde7ef59e
|
@ -4,9 +4,13 @@ from django_otp.plugins.otp_static.models import StaticDevice, StaticToken
|
||||||
from rest_framework.fields import CharField, ListField
|
from rest_framework.fields import CharField, ListField
|
||||||
|
|
||||||
from authentik.flows.challenge import ChallengeResponse, ChallengeTypes, WithUserInfoChallenge
|
from authentik.flows.challenge import ChallengeResponse, ChallengeTypes, WithUserInfoChallenge
|
||||||
|
from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER
|
||||||
from authentik.flows.stage import ChallengeStageView
|
from authentik.flows.stage import ChallengeStageView
|
||||||
from authentik.stages.authenticator_static.models import AuthenticatorStaticStage
|
from authentik.stages.authenticator_static.models import AuthenticatorStaticStage
|
||||||
|
|
||||||
|
SESSION_STATIC_DEVICE = "static_device"
|
||||||
|
SESSION_STATIC_TOKENS = "static_device_tokens"
|
||||||
|
|
||||||
|
|
||||||
class AuthenticatorStaticChallenge(WithUserInfoChallenge):
|
class AuthenticatorStaticChallenge(WithUserInfoChallenge):
|
||||||
"""Static authenticator challenge"""
|
"""Static authenticator challenge"""
|
||||||
|
@ -27,8 +31,7 @@ class AuthenticatorStaticStageView(ChallengeStageView):
|
||||||
response_class = AuthenticatorStaticChallengeResponse
|
response_class = AuthenticatorStaticChallengeResponse
|
||||||
|
|
||||||
def get_challenge(self, *args, **kwargs) -> AuthenticatorStaticChallenge:
|
def get_challenge(self, *args, **kwargs) -> AuthenticatorStaticChallenge:
|
||||||
user = self.get_pending_user()
|
tokens: list[StaticToken] = self.request.session[SESSION_STATIC_TOKENS]
|
||||||
tokens: list[StaticToken] = StaticToken.objects.filter(device__user=user)
|
|
||||||
return AuthenticatorStaticChallenge(
|
return AuthenticatorStaticChallenge(
|
||||||
data={
|
data={
|
||||||
"type": ChallengeTypes.NATIVE.value,
|
"type": ChallengeTypes.NATIVE.value,
|
||||||
|
@ -44,25 +47,22 @@ class AuthenticatorStaticStageView(ChallengeStageView):
|
||||||
|
|
||||||
stage: AuthenticatorStaticStage = self.executor.current_stage
|
stage: AuthenticatorStaticStage = self.executor.current_stage
|
||||||
|
|
||||||
devices = StaticDevice.objects.filter(user=user)
|
if SESSION_STATIC_DEVICE not in self.request.session:
|
||||||
# Currently, this stage only supports one device per user. If the user already
|
device = StaticDevice(user=user, confirmed=False, name="Static Token")
|
||||||
# has a device, just skip to the next stage
|
tokens = []
|
||||||
if devices.exists():
|
for _ in range(0, stage.token_count):
|
||||||
if not any(x.confirmed for x in devices):
|
tokens.append(StaticToken(device=device, token=StaticToken.random_token()))
|
||||||
return super().get(request, *args, **kwargs)
|
self.request.session[SESSION_STATIC_DEVICE] = device
|
||||||
return self.executor.stage_ok()
|
self.request.session[SESSION_STATIC_TOKENS] = tokens
|
||||||
|
|
||||||
device = StaticDevice.objects.create(user=user, confirmed=False, name="Static Token")
|
|
||||||
for _ in range(0, stage.token_count):
|
|
||||||
StaticToken.objects.create(device=device, token=StaticToken.random_token())
|
|
||||||
return super().get(request, *args, **kwargs)
|
return super().get(request, *args, **kwargs)
|
||||||
|
|
||||||
def challenge_valid(self, response: ChallengeResponse) -> HttpResponse:
|
def challenge_valid(self, response: ChallengeResponse) -> HttpResponse:
|
||||||
"""Verify OTP Token"""
|
"""Verify OTP Token"""
|
||||||
user = self.get_pending_user()
|
device: StaticDevice = self.request.session[SESSION_STATIC_DEVICE]
|
||||||
device: StaticDevice = StaticDevice.objects.filter(user=user).first()
|
|
||||||
if not device:
|
|
||||||
return self.executor.stage_invalid()
|
|
||||||
device.confirmed = True
|
device.confirmed = True
|
||||||
device.save()
|
device.save()
|
||||||
|
for token in self.request.session[SESSION_STATIC_TOKENS]:
|
||||||
|
token.save()
|
||||||
|
del self.request.session[SESSION_STATIC_DEVICE]
|
||||||
|
del self.request.session[SESSION_STATIC_TOKENS]
|
||||||
return self.executor.stage_ok()
|
return self.executor.stage_ok()
|
||||||
|
|
|
@ -13,10 +13,13 @@ from authentik.flows.challenge import (
|
||||||
ChallengeTypes,
|
ChallengeTypes,
|
||||||
WithUserInfoChallenge,
|
WithUserInfoChallenge,
|
||||||
)
|
)
|
||||||
|
from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER
|
||||||
from authentik.flows.stage import ChallengeStageView
|
from authentik.flows.stage import ChallengeStageView
|
||||||
from authentik.stages.authenticator_totp.models import AuthenticatorTOTPStage
|
from authentik.stages.authenticator_totp.models import AuthenticatorTOTPStage
|
||||||
from authentik.stages.authenticator_totp.settings import OTP_TOTP_ISSUER
|
from authentik.stages.authenticator_totp.settings import OTP_TOTP_ISSUER
|
||||||
|
|
||||||
|
SESSION_TOTP_DEVICE = "totp_device"
|
||||||
|
|
||||||
|
|
||||||
class AuthenticatorTOTPChallenge(WithUserInfoChallenge):
|
class AuthenticatorTOTPChallenge(WithUserInfoChallenge):
|
||||||
"""TOTP Setup challenge"""
|
"""TOTP Setup challenge"""
|
||||||
|
@ -49,8 +52,7 @@ class AuthenticatorTOTPStageView(ChallengeStageView):
|
||||||
response_class = AuthenticatorTOTPChallengeResponse
|
response_class = AuthenticatorTOTPChallengeResponse
|
||||||
|
|
||||||
def get_challenge(self, *args, **kwargs) -> Challenge:
|
def get_challenge(self, *args, **kwargs) -> Challenge:
|
||||||
user = self.get_pending_user()
|
device: TOTPDevice = self.request.session[SESSION_TOTP_DEVICE]
|
||||||
device: TOTPDevice = TOTPDevice.objects.filter(user=user).first()
|
|
||||||
return AuthenticatorTOTPChallenge(
|
return AuthenticatorTOTPChallenge(
|
||||||
data={
|
data={
|
||||||
"type": ChallengeTypes.NATIVE.value,
|
"type": ChallengeTypes.NATIVE.value,
|
||||||
|
@ -62,8 +64,7 @@ class AuthenticatorTOTPStageView(ChallengeStageView):
|
||||||
|
|
||||||
def get_response_instance(self, data: QueryDict) -> ChallengeResponse:
|
def get_response_instance(self, data: QueryDict) -> ChallengeResponse:
|
||||||
response = super().get_response_instance(data)
|
response = super().get_response_instance(data)
|
||||||
user = self.get_pending_user()
|
response.device = self.request.session.get(SESSION_TOTP_DEVICE)
|
||||||
response.device = TOTPDevice.objects.filter(user=user).first()
|
|
||||||
return response
|
return response
|
||||||
|
|
||||||
def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
|
def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
|
||||||
|
@ -74,17 +75,18 @@ class AuthenticatorTOTPStageView(ChallengeStageView):
|
||||||
|
|
||||||
stage: AuthenticatorTOTPStage = self.executor.current_stage
|
stage: AuthenticatorTOTPStage = self.executor.current_stage
|
||||||
|
|
||||||
TOTPDevice.objects.create(
|
if SESSION_TOTP_DEVICE not in self.request.session:
|
||||||
user=user, confirmed=False, digits=stage.digits, name="TOTP Authenticator"
|
device = TOTPDevice(
|
||||||
)
|
user=user, confirmed=False, digits=stage.digits, name="TOTP Authenticator"
|
||||||
|
)
|
||||||
|
|
||||||
|
self.request.session[SESSION_TOTP_DEVICE] = device
|
||||||
return super().get(request, *args, **kwargs)
|
return super().get(request, *args, **kwargs)
|
||||||
|
|
||||||
def challenge_valid(self, response: ChallengeResponse) -> HttpResponse:
|
def challenge_valid(self, response: ChallengeResponse) -> HttpResponse:
|
||||||
"""TOTP Token is validated by challenge"""
|
"""TOTP Token is validated by challenge"""
|
||||||
user = self.get_pending_user()
|
device: TOTPDevice = self.request.session[SESSION_TOTP_DEVICE]
|
||||||
device: TOTPDevice = TOTPDevice.objects.filter(user=user).first()
|
|
||||||
if not device:
|
|
||||||
return self.executor.stage_invalid()
|
|
||||||
device.confirmed = True
|
device.confirmed = True
|
||||||
device.save()
|
device.save()
|
||||||
|
del self.request.session[SESSION_TOTP_DEVICE]
|
||||||
return self.executor.stage_ok()
|
return self.executor.stage_ok()
|
||||||
|
|
Reference in New Issue