[ CDM-243 ] [ CDM-245 ] Orcid Provider MFA Support & Token response mfa key

RELEASE_NOTES.md

@@ -2,6 +2,9 @@
 
 ## 0.7.2
 
+* Added MFA (Multi-Factor Authentication) status tracking for tokens
+* The `/api/V2/token` endpoint now returns an `mfa` field
+* ORCID provider updated to use OpenID Connect scope for MFA detection
 * BACKWARDS INCOMPATIBILITY: Repeated or trailing underscores are
   no longer allowed in usernames. Existing usernames are unaffected.
 * Fixed a bug where usernames with underscores would not be matched in username searches if an

src/main/java/us/kbase/auth2/lib/Authentication.java

@@ -77,6 +77,7 @@
 import us.kbase.auth2.lib.exceptions.UserExistsException;
 import us.kbase.auth2.lib.identity.IdentityProvider;
 import us.kbase.auth2.lib.identity.RemoteIdentity;
+import us.kbase.auth2.lib.identity.MfaStatus;
 import us.kbase.auth2.lib.identity.RemoteIdentityID;
 import us.kbase.auth2.lib.storage.AuthStorage;
 import us.kbase.auth2.lib.storage.exceptions.AuthStorageException;
@@ -745,13 +746,22 @@ public void forceResetAllPasswords(final IncomingToken token)
 
 	private NewToken login(final UserName userName, final TokenCreationContext tokenCtx)
 			throws AuthStorageException {
+		return login(userName, tokenCtx, MfaStatus.UNKNOWN);
+	}
+
+	private NewToken login(
+			final UserName userName,
+			final TokenCreationContext tokenCtx,
+			final MfaStatus mfa
+	) throws AuthStorageException {
 		final NewToken nt = new NewToken(StoredToken.getBuilder(
-					TokenType.LOGIN, randGen.randomUUID(), userName)
-				.withLifeTime(clock.instant(),
-						cfg.getAppConfig().getTokenLifetimeMS(TokenLifetimeType.LOGIN))
-				.withContext(tokenCtx)
-				.build(),
-				randGen.getToken());
+				TokenType.LOGIN, randGen.randomUUID(), userName)
+			.withLifeTime(clock.instant(),
+					cfg.getAppConfig().getTokenLifetimeMS(TokenLifetimeType.LOGIN))
+			.withContext(tokenCtx)
+			.withMfa(mfa)
+			.build(),
+			randGen.getToken());
 		storage.storeToken(nt.getStoredToken(), nt.getTokenHash());
 		setLastLogin(userName);
 		logInfo("Logged in user {} with token {}",
@@ -905,7 +915,8 @@ public NewToken createToken(
 		final NewToken nt = new NewToken(StoredToken.getBuilder(tokenType, id, au.getUserName())
 				.withLifeTime(clock.instant(), life)
 				.withContext(tokenCtx)
-				.withTokenName(tokenName).build(),
+				.withTokenName(tokenName)
+				.build(),
 				randGen.getToken());
 		storage.storeToken(nt.getStoredToken(), nt.getTokenHash());
 		logInfo("User {} created {} token {}", au.getUserName().getName(), tokenType, id);
@@ -1789,6 +1800,7 @@ public LoginToken login( // enough args here to start considering a builder
 		storage.deleteTemporarySessionData(token.getHashedToken());
 		final Set<RemoteIdentity> ris = idp.getIdentities(
 				authcode, tids.getPKCECodeVerifier().get(), false, environment);
+		final MfaStatus mfa = ris.iterator().next().getDetails().getMfa();
 		final LoginState lstate = getLoginState(ris, Instant.MIN);
 		final ProviderConfig pc = cfg.getAppConfig().getProviderConfig(idp.getProviderName());
 		final LoginToken loginToken;
@@ -1801,23 +1813,23 @@ public LoginToken login( // enough args here to start considering a builder
 			 * this call may be the result of a redirect from a 3rd party
 			 * provider. Any controllable error should be thrown when the process flow is back
 			 * under the control of the primary auth UI.
-			 * 
+			 *
 			 * There's a tiny chance here that the user could be made an admin, be enabled, or
 			 * non-admin login be enabled between this step and the getLoginState() step. The
 			 * consequence is that they'll have to choose from one account in the next step,
 			 * so who cares.
 			 */
 			if (!cfg.getAppConfig().isLoginAllowed() && !Role.isAdmin(user.getRoles())) {
-				loginToken = storeIdentitiesTemporarily(lstate);
+				loginToken = storeIdentitiesTemporarily(lstate, mfa);
 			} else if (user.isDisabled()) {
-				loginToken = storeIdentitiesTemporarily(lstate);
+				loginToken = storeIdentitiesTemporarily(lstate, mfa);
 			} else {
-				loginToken = new LoginToken(login(user.getUserName(), tokenCtx));
+				loginToken = new LoginToken(login(user.getUserName(), tokenCtx, mfa));
 			}
 		} else {
 			// store the identities so the user can create an account or choose from more than one
 			// account
-			loginToken = storeIdentitiesTemporarily(lstate);
+			loginToken = storeIdentitiesTemporarily(lstate, mfa);
 		}
 		return loginToken;
 	}
@@ -1831,13 +1843,13 @@ private void checkState(final TemporarySessionData tids, final String state)
 	}
 
 	// ignores expiration date of login state
-	private LoginToken storeIdentitiesTemporarily(final LoginState ls)
+	private LoginToken storeIdentitiesTemporarily(final LoginState ls, final MfaStatus mfa)
 			throws AuthStorageException {
 		final Set<RemoteIdentity> store = new HashSet<>(ls.getIdentities());
 		ls.getUsers().stream().forEach(u -> store.addAll(ls.getIdentities(u)));
 		final TemporarySessionData data = TemporarySessionData.create(
 				randGen.randomUUID(), clock.instant(), LOGIN_TOKEN_LIFETIME_MS)
-				.login(store);
+				.login(store, mfa);
 		final TemporaryToken tt = storeTemporarySessionData(data);
 		logInfo("Stored temporary token {} with {} login identities", tt.getId(), store.size());
 		return new LoginToken(tt);
@@ -2033,16 +2045,19 @@ public NewToken createUser(
 	public NewToken testModeCreateToken(
 			final UserName userName,
 			final TokenName tokenName,
-			final TokenType tokenType)
+			final TokenType tokenType,
+			final MfaStatus mfa)
 			throws TestModeException, AuthStorageException, NoSuchUserException {
 		ensureTestMode();
 		requireNonNull(userName, "userName");
 		requireNonNull(tokenType, "tokenType");
+		requireNonNull(mfa, "mfa");
 		storage.testModeGetUser(userName); // ensure user exists
 		final UUID id = randGen.randomUUID();
 		final NewToken nt = new NewToken(StoredToken.getBuilder(tokenType, id, userName)
 				.withLifeTime(clock.instant(), TEST_MODE_DATA_LIFETIME_MS)
 				.withNullableTokenName(tokenName)
+				.withMfa(mfa)
 				.build(),
 				randGen.getToken());
 		storage.testModeStoreToken(nt.getStoredToken(), nt.getTokenHash());
@@ -2339,7 +2354,8 @@ public NewToken login(
 						linked, u.get().getUserName().getName());
 			}
 		}
-		return login(u.get().getUserName(), tokenCtx);
+		final MfaStatus mfaStatus = ri.get().getDetails().getMfa();
+		return login(u.get().getUserName(), tokenCtx, mfaStatus);
 	}
 
 	private Optional<RemoteIdentity> getIdentity(
@@ -3136,7 +3152,7 @@ public <T extends ExternalConfig> AuthConfigSetWithUpdateTime<T> getConfig(
 
 	/** Returns the suggested cache time for tokens in milliseconds.
 	 * @return the suggested cache time.
-	 * @throws AuthStorageException if an error occurred accessing the storage system. 
+	 * @throws AuthStorageException if an error occurred accessing the storage system.
 	 */
 	public long getSuggestedTokenCacheTime() throws AuthStorageException {
 		return cfg.getAppConfig().getTokenLifetimeMS(TokenLifetimeType.EXT_CACHE);

src/main/java/us/kbase/auth2/lib/TemporarySessionData.java

@@ -14,6 +14,7 @@
 import java.util.UUID;
 
 import us.kbase.auth2.lib.exceptions.ErrorType;
+import us.kbase.auth2.lib.identity.MfaStatus;
 import us.kbase.auth2.lib.identity.RemoteIdentity;
 
 /** Temporary session data that may include a set of temporary identities and / or an associated
@@ -33,6 +34,7 @@ public class TemporarySessionData {
 	private final String error;
 	private final ErrorType errorType;
 	private final UserName user;
+	private final MfaStatus mfa;
 
 	private TemporarySessionData(
 			final Operation op,
@@ -44,7 +46,8 @@ private TemporarySessionData(
 			final Set<RemoteIdentity> identities,
 			final UserName user,
 			final String error,
-			final ErrorType errorType) {
+			final ErrorType errorType,
+			final MfaStatus mfa) {
 		this.op = op;
 		this.id = id;
 		this.created = created;
@@ -55,6 +58,7 @@ private TemporarySessionData(
 		this.user = user;
 		this.error = error;
 		this.errorType = errorType;
+		this.mfa = requireNonNull(mfa, "mfa");
 	}
 
 	/** Get the operation this temporary session data supports.
@@ -137,10 +141,17 @@ public boolean hasError() {
 		return error != null;
 	}
 
+	/** Get the multi-factor authentication status.
+	 * @return the MFA status.
+	 */
+	public MfaStatus getMfa() {
+		return mfa;
+	}
+
 	@Override
 	public int hashCode() {
-		return Objects.hash(created, error, errorType, expires, id, identities, oauth2State, op, pkceCodeVerifier,
-				user);
+		return Objects.hash(created, error, errorType, expires, id, identities, mfa, oauth2State, op,
+				pkceCodeVerifier, user);
 	}
 
 	@Override
@@ -158,7 +169,7 @@ public boolean equals(Object obj) {
 		return Objects.equals(created, other.created) && Objects.equals(error, other.error)
 				&& errorType == other.errorType && Objects.equals(expires, other.expires)
 				&& Objects.equals(id, other.id) && Objects.equals(identities, other.identities)
-				&& Objects.equals(oauth2State, other.oauth2State) && op == other.op
+				&& mfa == other.mfa && Objects.equals(oauth2State, other.oauth2State) && op == other.op
 				&& Objects.equals(pkceCodeVerifier, other.pkceCodeVerifier) && Objects.equals(user, other.user);
 	}
 
@@ -242,7 +253,7 @@ public TemporarySessionData error(final String error, final ErrorType errorType)
 			requireNonNull(errorType, "errorType");
 			return new TemporarySessionData(
 					Operation.ERROR, id, created, expires,
-					null, null, null, null, error, errorType);
+					null, null, null, null, error, errorType, MfaStatus.UNKNOWN);
 		}
 
 		/** Create temporary session data for the start of a login operation.
@@ -258,7 +269,7 @@ public TemporarySessionData login(
 			checkStringNoCheckedException(pkceCodeVerifier, "pkceCodeVerifier");
 			return new TemporarySessionData(
 					Operation.LOGINSTART, id, created, expires,
-					oauth2State, pkceCodeVerifier, null, null, null, null);
+					oauth2State, pkceCodeVerifier, null, null, null, null, MfaStatus.UNKNOWN);
 		}
 
 		/** Create temporary session data for a login operation where remote identities are
@@ -267,9 +278,20 @@ public TemporarySessionData login(
 		 * @return the temporary session data.
 		 */
 		public TemporarySessionData login(final Set<RemoteIdentity> identities) {
+			return login(identities, MfaStatus.UNKNOWN);
+		}
+
+		/** Create temporary session data for a login operation where remote identities are
+		 * involved.
+		 * @param identities the remote identities involved in the login.
+		 * @param mfa the multi-factor authentication status.
+		 * @return the temporary session data.
+		 */
+		public TemporarySessionData login(final Set<RemoteIdentity> identities, final MfaStatus mfa) {
+			requireNonNull(mfa, "mfa");
 			return new TemporarySessionData(
 					Operation.LOGINIDENTS, id, created, expires,
-					null, null, checkIdents(identities), null, null, null);
+					null, null, checkIdents(identities), null, null, null, mfa);
 		}
 
 		private Set<RemoteIdentity> checkIdents(final Set<RemoteIdentity> identities) {
@@ -299,7 +321,7 @@ public TemporarySessionData link(
 			requireNonNull(userName, "userName");
 			return new TemporarySessionData(
 					Operation.LINKSTART, id, created, expires,
-					oauth2State, pkceCodeVerifier, null, userName, null, null);
+					oauth2State, pkceCodeVerifier, null, userName, null, null, MfaStatus.UNKNOWN);
 		}
 
 		/** Create temporary session data for a linking operation when remote identities are
@@ -314,7 +336,7 @@ public TemporarySessionData link(
 			requireNonNull(userName, "userName");
 			return new TemporarySessionData(
 					Operation.LINKIDENTS, id, created, expires,
-					null, null, checkIdents(identities), userName, null, null);
+					null, null, checkIdents(identities), userName, null, null, MfaStatus.UNKNOWN);
 		}
 	}
 }

src/main/java/us/kbase/auth2/lib/identity/MfaStatus.java

@@ -0,0 +1,65 @@
+package us.kbase.auth2.lib.identity;
+// TODO CODE move to lib/token
+import java.util.HashMap;
+import java.util.Map;
+
+import com.fasterxml.jackson.annotation.JsonValue;
+
+/** An enumeration representing the multi-factor authentication status of a user's login.
+ * @author dlyon@lbl.gov
+ *
+ */
+public enum MfaStatus {
+
+	/* first arg is ID, second arg is description. ID CANNOT change
+	 * since that field is stored in the DB.
+	 */
+	/** User authenticated with MFA during token creation. */
+	USED			("Used", "MFA used"),
+	/** User explicitly chose not to use MFA when available. */
+	NOT_USED		("NotUsed", "MFA not used"),
+	/** MFA status unknown or not applicable to authentication method. */
+	UNKNOWN			("Unknown", "MFA status unknown");
+
+	private static final Map<String, MfaStatus> STATUS_MAP = new HashMap<>();
+	static {
+		for (final MfaStatus status: MfaStatus.values()) {
+			STATUS_MAP.put(status.getID(), status);
+		}
+	}
+
+	private final String id;
+	private final String description;
+
+	private MfaStatus(final String id, final String description) {
+		this.id = id;
+		this.description = description;
+	}
+
+	/** Get the ID of this MFA status.
+	 * @return the ID.
+	 */
+	@JsonValue
+	public String getID() {
+		return id;
+	}
+
+	/** Get the description of this MFA status.
+	 * @return the description.
+	 */
+	public String getDescription() {
+		return description;
+	}
+
+	/** Get an MFA status from its ID.
+	 * @param id the ID of the MFA status.
+	 * @return the MFA status.
+	 * @throws IllegalArgumentException if there is no MFA status matching the ID.
+	 */
+	public static MfaStatus fromID(final String id) {
+		if (!STATUS_MAP.containsKey(id)) {
+			throw new IllegalArgumentException("Invalid MFA status: " + id);
+		}
+		return STATUS_MAP.get(id);
+	}
+}