mirror of
https://github.com/discourse/discourse.git
synced 2024-11-26 10:13:45 +08:00
eb5a3cfded
Discourse has the Discourse Connect Provider protocol that makes it possible to use a Discourse instance as an identity provider for external sites. As a natural extension to this protocol, this PR adds a new feature that makes it possible to use Discourse as a 2FA provider as well as an identity provider. The rationale for this change is that it's very difficult to implement 2FA support in a website and if you have multiple websites that need to have 2FA, it's unrealistic to build and maintain a separate 2FA implementation for each one. But with this change, you can piggyback on Discourse to take care of all the 2FA details for you for as many sites as you wish. To use Discourse as a 2FA provider, you'll need to follow this guide: https://meta.discourse.org/t/-/32974. It walks you through what you need to implement on your end/site and how to configure your Discourse instance. Once you're done, there is only one additional thing you need to do which is to include `require_2fa=true` in the payload that you send to Discourse. When Discourse sees `require_2fa=true`, it'll prompt the user to confirm their 2FA using whatever methods they've enabled (TOTP or security keys), and once they confirm they'll be redirected back to the return URL you've configured and the payload will contain `confirmed_2fa=true`. If the user has no 2FA methods enabled however, the payload will not contain `confirmed_2fa`, but it will contain `no_2fa_methods=true`. You'll need to be careful to re-run all the security checks and ensure the user can still access the resource on your site after they return from Discourse. This is very important because there's nothing that guarantees the user that will come back from Discourse after they confirm 2FA is the same user that you've redirected to Discourse. Internal ticket: t62183.
267 lines
9.9 KiB
Ruby
267 lines
9.9 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
describe SecondFactor::AuthManager do
|
|
fab!(:user) { Fabricate(:user) }
|
|
fab!(:guardian) { Guardian.new(user) }
|
|
fab!(:user_totp) { Fabricate(:user_second_factor_totp, user: user) }
|
|
|
|
def create_request(request_method: "GET", path: "/")
|
|
ActionDispatch::TestRequest.create({
|
|
"REQUEST_METHOD" => request_method,
|
|
"PATH_INFO" => path
|
|
})
|
|
end
|
|
|
|
def create_manager(action)
|
|
SecondFactor::AuthManager.new(guardian, action)
|
|
end
|
|
|
|
def create_action(request = nil)
|
|
request ||= create_request
|
|
TestSecondFactorAction.new(guardian, request)
|
|
end
|
|
|
|
def stage_challenge(successful:)
|
|
request = create_request(
|
|
request_method: "POST",
|
|
path: "/abc/xyz"
|
|
)
|
|
action = create_action(request)
|
|
action.expects(:no_second_factors_enabled!).never
|
|
action
|
|
.expects(:second_factor_auth_required!)
|
|
.with({ random_param: 'hello' })
|
|
.returns({ callback_params: { call_me_back: 4314 } })
|
|
.once
|
|
manager = create_manager(action)
|
|
secure_session = {}
|
|
expect {
|
|
manager.run!(request, { random_param: 'hello' }, secure_session)
|
|
}.to raise_error(SecondFactor::AuthManager::SecondFactorRequired) do |ex|
|
|
expect(ex.nonce).to be_present
|
|
end
|
|
|
|
challenge = JSON
|
|
.parse(secure_session["current_second_factor_auth_challenge"])
|
|
.deep_symbolize_keys
|
|
|
|
if successful
|
|
challenge[:successful] = true
|
|
secure_session["current_second_factor_auth_challenge"] = challenge.to_json
|
|
end
|
|
[challenge[:nonce], secure_session]
|
|
end
|
|
|
|
describe '#allow_backup_codes!' do
|
|
it 'adds the backup codes method to the allowed methods set' do
|
|
manager = create_manager(create_action)
|
|
expect(manager.allowed_methods).not_to include(
|
|
UserSecondFactor.methods[:backup_codes]
|
|
)
|
|
manager.allow_backup_codes!
|
|
expect(manager.allowed_methods).to include(
|
|
UserSecondFactor.methods[:backup_codes]
|
|
)
|
|
end
|
|
end
|
|
|
|
describe '#run!' do
|
|
context 'when the user does not have a suitable 2FA method' do
|
|
before do
|
|
user_totp.destroy!
|
|
end
|
|
|
|
it 'calls the no_second_factors_enabled! method of the action' do
|
|
action = create_action
|
|
action.expects(:no_second_factors_enabled!).with({ hello_world: 331 }).once
|
|
action.expects(:second_factor_auth_required!).never
|
|
action.expects(:second_factor_auth_completed!).never
|
|
manager = create_manager(action)
|
|
manager.run!(create_request, { hello_world: 331 }, {})
|
|
end
|
|
end
|
|
|
|
it "initiates the 2FA process and stages a challenge in secure session when there is no nonce in params" do
|
|
request = create_request(
|
|
request_method: "POST",
|
|
path: "/abc/xyz"
|
|
)
|
|
action = create_action(request)
|
|
action.expects(:no_second_factors_enabled!).never
|
|
action
|
|
.expects(:second_factor_auth_required!)
|
|
.with({ expect_me: 131 })
|
|
.returns(
|
|
callback_params: { call_me_back: 4314 },
|
|
redirect_url: "/gg",
|
|
description: "hello world!"
|
|
)
|
|
.once
|
|
action.expects(:second_factor_auth_completed!).never
|
|
manager = create_manager(action)
|
|
secure_session = {}
|
|
expect {
|
|
manager.run!(request, { expect_me: 131 }, secure_session)
|
|
}.to raise_error(SecondFactor::AuthManager::SecondFactorRequired)
|
|
json = secure_session["current_second_factor_auth_challenge"]
|
|
challenge = JSON.parse(json).deep_symbolize_keys
|
|
expect(challenge[:nonce]).to be_present
|
|
expect(challenge[:callback_method]).to eq("POST")
|
|
expect(challenge[:callback_path]).to eq("/abc/xyz")
|
|
expect(challenge[:redirect_url]).to eq("/gg")
|
|
expect(challenge[:allowed_methods]).to eq(manager.allowed_methods.to_a)
|
|
expect(challenge[:callback_params]).to eq({ call_me_back: 4314 })
|
|
expect(challenge[:description]).to eq("hello world!")
|
|
end
|
|
|
|
it "prefers callback_method and callback_path from the output of the action's second_factor_auth_required! method if they're present" do
|
|
request = create_request(
|
|
request_method: "POST",
|
|
path: "/abc/xyz"
|
|
)
|
|
action = create_action(request)
|
|
action
|
|
.expects(:second_factor_auth_required!)
|
|
.with({})
|
|
.returns(
|
|
callback_params: { call_me_back: 4314 },
|
|
callback_method: "PUT",
|
|
callback_path: "/test/443"
|
|
)
|
|
.once
|
|
manager = create_manager(action)
|
|
secure_session = {}
|
|
expect {
|
|
manager.run!(request, {}, secure_session)
|
|
}.to raise_error(SecondFactor::AuthManager::SecondFactorRequired)
|
|
json = secure_session["current_second_factor_auth_challenge"]
|
|
challenge = JSON.parse(json).deep_symbolize_keys
|
|
expect(challenge[:callback_method]).to eq("PUT")
|
|
expect(challenge[:callback_path]).to eq("/test/443")
|
|
end
|
|
|
|
it "calls the second_factor_auth_completed! method of the action if the challenge is successful and not expired" do
|
|
nonce, secure_session = stage_challenge(successful: true)
|
|
|
|
request = create_request(
|
|
request_method: "POST",
|
|
path: "/abc/xyz"
|
|
)
|
|
action = create_action(request)
|
|
|
|
action.expects(:no_second_factors_enabled!).never
|
|
action.expects(:second_factor_auth_required!).never
|
|
action
|
|
.expects(:second_factor_auth_completed!)
|
|
.with({ call_me_back: 4314 })
|
|
.once
|
|
manager = create_manager(action)
|
|
manager.run!(request, { second_factor_nonce: nonce }, secure_session)
|
|
end
|
|
|
|
it "does not call the second_factor_auth_completed! method of the action if the challenge is not marked successful" do
|
|
nonce, secure_session = stage_challenge(successful: false)
|
|
|
|
request = create_request(
|
|
request_method: "POST",
|
|
path: "/abc/xyz"
|
|
)
|
|
action = create_action(request)
|
|
action.expects(:no_second_factors_enabled!).never
|
|
action.expects(:second_factor_auth_required!).never
|
|
action.expects(:second_factor_auth_completed!).never
|
|
manager = create_manager(action)
|
|
expect {
|
|
manager.run!(request, { second_factor_nonce: nonce }, secure_session)
|
|
}.to raise_error(SecondFactor::BadChallenge) do |ex|
|
|
expect(ex.error_translation_key).to eq("second_factor_auth.challenge_not_completed")
|
|
end
|
|
end
|
|
|
|
it "does not call the second_factor_auth_completed! method of the action if the challenge is expired" do
|
|
nonce, secure_session = stage_challenge(successful: true)
|
|
|
|
request = create_request(
|
|
request_method: "POST",
|
|
path: "/abc/xyz"
|
|
)
|
|
action = create_action(request)
|
|
action.expects(:no_second_factors_enabled!).never
|
|
action.expects(:second_factor_auth_required!).never
|
|
action.expects(:second_factor_auth_completed!).never
|
|
manager = create_manager(action)
|
|
|
|
freeze_time (SecondFactor::AuthManager::MAX_CHALLENGE_AGE + 1.minute).from_now
|
|
expect {
|
|
manager.run!(request, { second_factor_nonce: nonce }, secure_session)
|
|
}.to raise_error(SecondFactor::BadChallenge) do |ex|
|
|
expect(ex.error_translation_key).to eq("second_factor_auth.challenge_expired")
|
|
end
|
|
end
|
|
|
|
it "calls second_factor_auth_skipped! if skip_second_factor_auth? return true" do
|
|
action = create_action
|
|
params = { a: 1 }
|
|
action.expects(:skip_second_factor_auth?).with(params).returns(true).once
|
|
action.expects(:second_factor_auth_skipped!).with(params).once
|
|
action.expects(:no_second_factors_enabled!).never
|
|
action.expects(:second_factor_auth_required!).never
|
|
action.expects(:second_factor_auth_completed!).never
|
|
manager = create_manager(action)
|
|
manager.run!(action.request, params, {})
|
|
end
|
|
|
|
it "doesn't call second_factor_auth_skipped! if skip_second_factor_auth? return false" do
|
|
action = create_action
|
|
params = { a: 1 }
|
|
action.expects(:skip_second_factor_auth?).with(params).returns(false).once
|
|
action.expects(:second_factor_auth_skipped!).never
|
|
action.expects(:no_second_factors_enabled!).never
|
|
action.expects(:second_factor_auth_required!).with(params).returns({}).once
|
|
action.expects(:second_factor_auth_completed!).never
|
|
manager = create_manager(action)
|
|
expect {
|
|
manager.run!(action.request, params, {})
|
|
}.to raise_error(SecondFactor::AuthManager::SecondFactorRequired) do |ex|
|
|
expect(ex.nonce).to be_present
|
|
end
|
|
end
|
|
|
|
context "returned results object" do
|
|
it "has the correct status and contains the return value of the action hook that's called" do
|
|
action = create_action
|
|
action.expects(:skip_second_factor_auth?).with({}).returns(true).once
|
|
action.expects(:second_factor_auth_skipped!).with({}).returns("yeah whatever").once
|
|
manager = create_manager(action)
|
|
results = manager.run!(action.request, {}, {})
|
|
expect(results.data).to eq("yeah whatever")
|
|
expect(results.second_factor_auth_skipped?).to eq(true)
|
|
|
|
nonce, secure_session = stage_challenge(successful: true)
|
|
request = create_request(
|
|
request_method: "POST",
|
|
path: "/abc/xyz"
|
|
)
|
|
action = create_action(request)
|
|
action
|
|
.expects(:second_factor_auth_completed!)
|
|
.with({ call_me_back: 4314 })
|
|
.returns({ eviltrout: "goodbye :(" })
|
|
.once
|
|
manager = create_manager(action)
|
|
results = manager.run!(request, { second_factor_nonce: nonce }, secure_session)
|
|
expect(results.data).to eq({ eviltrout: "goodbye :(" })
|
|
expect(results.second_factor_auth_completed?).to eq(true)
|
|
|
|
user_totp.destroy!
|
|
action = create_action
|
|
action.expects(:no_second_factors_enabled!).with({}).returns("NOTHING WORKS").once
|
|
manager = create_manager(action)
|
|
results = manager.run!(action.request, {}, {})
|
|
expect(results.data).to eq("NOTHING WORKS")
|
|
expect(results.no_second_factors_enabled?).to eq(true)
|
|
end
|
|
end
|
|
end
|
|
end
|