Skip to content

Commit 5d05973

Browse files
NipuniBhagyaNipuniBhagya
authored
Merge pull request #6837 from NipuniBhagya/master
Restrict adding second-factor authenticators in the initial login step
2 parents ab9b33d + 0cd3535 commit 5d05973

File tree

9 files changed

+110
-44
lines changed

9 files changed

+110
-44
lines changed

‎.changeset/early-toys-share.md

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
"@wso2is/myaccount": patch
3+
"@wso2is/theme": patch
4+
---
5+
6+
Add Duo logo in the theme

‎.changeset/friendly-carrots-own.md

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
"@wso2is/console": patch
3+
"@wso2is/features": patch
4+
"@wso2is/admin.applications.v1": patch
5+
"@wso2is/admin.authentication-flow-builder.v1": patch
6+
"@wso2is/admin.connections.v1": patch
7+
---
8+
9+
Restrict second-factor authenticators in the initial step of the login flow

‎features/admin.applications.v1/constants/application-management.ts

+3-1
Original file line numberDiff line numberDiff line change
@@ -347,7 +347,9 @@ export class ApplicationManagementConstants {
347347
LocalAuthenticatorConstants.AUTHENTICATOR_NAMES.TOTP_AUTHENTICATOR_NAME,
348348
LocalAuthenticatorConstants.AUTHENTICATOR_IDS.TOTP_AUTHENTICATOR_ID,
349349
FederatedAuthenticatorConstants.AUTHENTICATOR_NAMES.IPROOV_AUTHENTICATOR_NAME,
350-
FederatedAuthenticatorConstants.AUTHENTICATOR_IDS.IPROOV_AUTHENTICATOR_ID
350+
FederatedAuthenticatorConstants.AUTHENTICATOR_IDS.IPROOV_AUTHENTICATOR_ID,
351+
FederatedAuthenticatorConstants.AUTHENTICATOR_NAMES.DUO_AUTHENTICATOR_NAME,
352+
FederatedAuthenticatorConstants.AUTHENTICATOR_IDS.DUO_AUTHENTICATOR_ID
351353
];
352354

353355
// Known social authenticators.

‎features/admin.authentication-flow-builder.v1/providers/authentication-flow-provider.tsx

+9
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,15 @@ const AuthenticationFlowProvider = (props: PropsWithChildren<AuthenticationFlowP
211211
: ConnectionsManagementUtils
212212
.resolveConnectionResourcePath(connectionResourcesUrl, authenticator.image);
213213

214+
// Restrict the second factor authenticators being added in the first step.
215+
if (ApplicationManagementConstants.SECOND_FACTOR_AUTHENTICATORS?.includes(
216+
authenticator?.defaultAuthenticator?.authenticatorId)
217+
) {
218+
secondFactorAuthenticators?.push(authenticator);
219+
220+
return;
221+
}
222+
214223
if (
215224
ApplicationManagementConstants.SOCIAL_AUTHENTICATORS.includes(
216225
authenticator.defaultAuthenticator.authenticatorId

‎features/admin.connections.v1/constants/federated-authenticator-constants.ts

+46-42
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ export class FederatedAuthenticatorConstants {
2828

2929
public static readonly AUTHENTICATOR_IDS: {
3030
APPLE_AUTHENTICATOR_ID: string;
31+
DUO_AUTHENTICATOR_ID: string;
3132
EMAIL_OTP_AUTHENTICATOR_ID: string;
3233
FACEBOOK_AUTHENTICATOR_ID: string;
3334
GITHUB_AUTHENTICATOR_ID: string;
@@ -46,28 +47,30 @@ export class FederatedAuthenticatorConstants {
4647
TWITTER_AUTHENTICATOR_ID: string;
4748
YAHOO_AUTHENTICATOR_ID: string;
4849
} = {
49-
APPLE_AUTHENTICATOR_ID: "QXBwbGVPSURDQXV0aGVudGljYXRvcg",
50-
EMAIL_OTP_AUTHENTICATOR_ID: "RW1haWxPVFA",
51-
FACEBOOK_AUTHENTICATOR_ID: "RmFjZWJvb2tBdXRoZW50aWNhdG9y",
52-
GITHUB_AUTHENTICATOR_ID: "R2l0aHViQXV0aGVudGljYXRvcg",
53-
GOOGLE_OIDC_AUTHENTICATOR_ID: "R29vZ2xlT0lEQ0F1dGhlbnRpY2F0b3I",
54-
HYPR_AUTHENTICATOR_ID: "SFlQUkF1dGhlbnRpY2F0b3I",
55-
IPROOV_AUTHENTICATOR_ID: "SXByb292QXV0aGVudGljYXRvcg",
56-
IWA_KERBEROS_AUTHENTICATOR_ID: "SVdBS2VyYmVyb3NBdXRoZW50aWNhdG9y",
57-
MICROSOFT_AUTHENTICATOR_ID: "T3BlbklEQ29ubmVjdEF1dGhlbnRpY2F0b3I",
58-
MS_LIVE_AUTHENTICATOR_ID: "TWljcm9zb2Z0V2luZG93c0xpdmVBdXRoZW50aWNhdG9y",
59-
OFFICE_365_AUTHENTICATOR_ID: "T2ZmaWNlMzY1QXV0aGVudGljYXRvcg",
60-
OIDC_AUTHENTICATOR_ID: "T3BlbklEQ29ubmVjdEF1dGhlbnRpY2F0b3I",
61-
ORGANIZATION_ENTERPRISE_AUTHENTICATOR_ID: "T3JnYW5pemF0aW9uQXV0aGVudGljYXRvcg",
62-
SAML_AUTHENTICATOR_ID: "U0FNTFNTT0F1dGhlbnRpY2F0b3I",
63-
SIWE_AUTHENTICATOR_ID: "T3BlbklEQ29ubmVjdEF1dGhlbnRpY2F0b3I",
64-
SMS_OTP_AUTHENTICATOR_ID: "U01TT1RQ",
65-
TWITTER_AUTHENTICATOR_ID: "VHdpdHRlckF1dGhlbnRpY2F0b3I",
66-
YAHOO_AUTHENTICATOR_ID: "WWFob29PQXV0aDJBdXRoZW50aWNhdG9y"
67-
};
50+
APPLE_AUTHENTICATOR_ID: "QXBwbGVPSURDQXV0aGVudGljYXRvcg",
51+
DUO_AUTHENTICATOR_ID: "RHVvQXV0aGVudGljYXRvcg",
52+
EMAIL_OTP_AUTHENTICATOR_ID: "RW1haWxPVFA",
53+
FACEBOOK_AUTHENTICATOR_ID: "RmFjZWJvb2tBdXRoZW50aWNhdG9y",
54+
GITHUB_AUTHENTICATOR_ID: "R2l0aHViQXV0aGVudGljYXRvcg",
55+
GOOGLE_OIDC_AUTHENTICATOR_ID: "R29vZ2xlT0lEQ0F1dGhlbnRpY2F0b3I",
56+
HYPR_AUTHENTICATOR_ID: "SFlQUkF1dGhlbnRpY2F0b3I",
57+
IPROOV_AUTHENTICATOR_ID: "SXByb292QXV0aGVudGljYXRvcg",
58+
IWA_KERBEROS_AUTHENTICATOR_ID: "SVdBS2VyYmVyb3NBdXRoZW50aWNhdG9y",
59+
MICROSOFT_AUTHENTICATOR_ID: "T3BlbklEQ29ubmVjdEF1dGhlbnRpY2F0b3I",
60+
MS_LIVE_AUTHENTICATOR_ID: "TWljcm9zb2Z0V2luZG93c0xpdmVBdXRoZW50aWNhdG9y",
61+
OFFICE_365_AUTHENTICATOR_ID: "T2ZmaWNlMzY1QXV0aGVudGljYXRvcg",
62+
OIDC_AUTHENTICATOR_ID: "T3BlbklEQ29ubmVjdEF1dGhlbnRpY2F0b3I",
63+
ORGANIZATION_ENTERPRISE_AUTHENTICATOR_ID: "T3JnYW5pemF0aW9uQXV0aGVudGljYXRvcg",
64+
SAML_AUTHENTICATOR_ID: "U0FNTFNTT0F1dGhlbnRpY2F0b3I",
65+
SIWE_AUTHENTICATOR_ID: "T3BlbklEQ29ubmVjdEF1dGhlbnRpY2F0b3I",
66+
SMS_OTP_AUTHENTICATOR_ID: "U01TT1RQ",
67+
TWITTER_AUTHENTICATOR_ID: "VHdpdHRlckF1dGhlbnRpY2F0b3I",
68+
YAHOO_AUTHENTICATOR_ID: "WWFob29PQXV0aDJBdXRoZW50aWNhdG9y"
69+
};
6870

6971
public static readonly AUTHENTICATOR_NAMES: {
7072
APPLE_AUTHENTICATOR_NAME: string;
73+
DUO_AUTHENTICATOR_NAME: string;
7174
EMAIL_OTP_AUTHENTICATOR_NAME: string;
7275
FACEBOOK_AUTHENTICATOR_NAME: string;
7376
GITHUB_AUTHENTICATOR_NAME: string;
@@ -84,23 +87,24 @@ export class FederatedAuthenticatorConstants {
8487
ORGANIZATION_ENTERPRISE_AUTHENTICATOR_NAME: string;
8588
YAHOO_AUTHENTICATOR_NAME: string;
8689
} = {
87-
APPLE_AUTHENTICATOR_NAME: "AppleOIDCAuthenticator",
88-
EMAIL_OTP_AUTHENTICATOR_NAME: "EmailOTP",
89-
FACEBOOK_AUTHENTICATOR_NAME: "FacebookAuthenticator",
90-
GITHUB_AUTHENTICATOR_NAME: "GithubAuthenticator",
91-
GOOGLE_OIDC_AUTHENTICATOR_NAME: "GoogleOIDCAuthenticator",
92-
IPROOV_AUTHENTICATOR_NAME: "IproovAuthenticator",
93-
IWA_KERBEROS_AUTHENTICATOR_NAME: "IWAKerberosAuthenticator",
94-
MICROSOFT_AUTHENTICATOR_NAME: "MicrosoftAuthenticator",
95-
MS_LIVE_AUTHENTICATOR_NAME: "MicrosoftWindowsLiveAuthenticator",
96-
OFFICE_365_AUTHENTICATOR_NAME: "Office365Authenticator",
97-
OIDC_AUTHENTICATOR_NAME: "OpenIDConnectAuthenticator",
98-
ORGANIZATION_ENTERPRISE_AUTHENTICATOR_NAME: "OrganizationAuthenticator",
99-
SAML_AUTHENTICATOR_NAME: "SAMLSSOAuthenticator",
100-
SMS_OTP_AUTHENTICATOR_NAME: "SMSOTP",
101-
TWITTER_AUTHENTICATOR_NAME: "TwitterAuthenticator",
102-
YAHOO_AUTHENTICATOR_NAME: "YahooOAuth2Authenticator"
103-
};
90+
APPLE_AUTHENTICATOR_NAME: "AppleOIDCAuthenticator",
91+
DUO_AUTHENTICATOR_NAME: "DuoAuthenticator",
92+
EMAIL_OTP_AUTHENTICATOR_NAME: "EmailOTP",
93+
FACEBOOK_AUTHENTICATOR_NAME: "FacebookAuthenticator",
94+
GITHUB_AUTHENTICATOR_NAME: "GithubAuthenticator",
95+
GOOGLE_OIDC_AUTHENTICATOR_NAME: "GoogleOIDCAuthenticator",
96+
IPROOV_AUTHENTICATOR_NAME: "IproovAuthenticator",
97+
IWA_KERBEROS_AUTHENTICATOR_NAME: "IWAKerberosAuthenticator",
98+
MICROSOFT_AUTHENTICATOR_NAME: "MicrosoftAuthenticator",
99+
MS_LIVE_AUTHENTICATOR_NAME: "MicrosoftWindowsLiveAuthenticator",
100+
OFFICE_365_AUTHENTICATOR_NAME: "Office365Authenticator",
101+
OIDC_AUTHENTICATOR_NAME: "OpenIDConnectAuthenticator",
102+
ORGANIZATION_ENTERPRISE_AUTHENTICATOR_NAME: "OrganizationAuthenticator",
103+
SAML_AUTHENTICATOR_NAME: "SAMLSSOAuthenticator",
104+
SMS_OTP_AUTHENTICATOR_NAME: "SMSOTP",
105+
TWITTER_AUTHENTICATOR_NAME: "TwitterAuthenticator",
106+
YAHOO_AUTHENTICATOR_NAME: "YahooOAuth2Authenticator"
107+
};
104108

105109
public static readonly AUTHENTICATOR_DISPLAY_NAMES: {
106110
APPLE_AUTHENTICATOR_DISPLAY_NAME: string;
@@ -109,12 +113,12 @@ export class FederatedAuthenticatorConstants {
109113
GOOGLE_OIDC_AUTHENTICATOR_DISPLAY_NAME: string;
110114
MICROSOFT_AUTHENTICATOR_DISPLAY_NAME: string;
111115
} = {
112-
APPLE_AUTHENTICATOR_DISPLAY_NAME: "Apple",
113-
FACEBOOK_AUTHENTICATOR_DISPLAY_NAME: "Facebook",
114-
GITHUB_AUTHENTICATOR_DISPLAY_NAME: "GitHub",
115-
GOOGLE_OIDC_AUTHENTICATOR_DISPLAY_NAME: "Google",
116-
MICROSOFT_AUTHENTICATOR_DISPLAY_NAME: "Microsoft"
117-
};
116+
APPLE_AUTHENTICATOR_DISPLAY_NAME: "Apple",
117+
FACEBOOK_AUTHENTICATOR_DISPLAY_NAME: "Facebook",
118+
GITHUB_AUTHENTICATOR_DISPLAY_NAME: "GitHub",
119+
GOOGLE_OIDC_AUTHENTICATOR_DISPLAY_NAME: "Google",
120+
MICROSOFT_AUTHENTICATOR_DISPLAY_NAME: "Microsoft"
121+
};
118122

119123
/**
120124
* Google One Tap enabling request parameter.

‎features/admin.connections.v1/resources/guides/duo/assets/build-login-flow.png

-51.6 KB
Binary file not shown.

‎features/admin.connections.v1/resources/guides/duo/assets/customize-steps.png

-17.7 KB
Binary file not shown.

‎identity-apps-core/apps/authentication-portal/src/main/webapp/login.jsp

+1-1
Original file line numberDiff line numberDiff line change
@@ -693,7 +693,7 @@
693693
</div>
694694
</div>
695695
<br>
696-
<%} else if (isGoogleIdp) { %>
696+
<% } else if (isGoogleIdp) { %>
697697
<div class="social-login blurring social-dimmer">
698698
<div
699699
class="ui basic segment google-one-tap-loader"

‎modules/theme/src/themes/default/assets/images/identity-providers/duo.svg

+36
Loading

0 commit comments

Comments
 (0)