habsi/authentik
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

outpost: improved set secret answers for flow execution (#8013)

Browse Source 
* outpost/radius: set mfa answer for noncode-based mfa

* refactor CheckPasswordInlineMFA to SetSecrets

* small style changes

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

---------

Signed-off-by: Jens Langhammer <jens@goauthentik.io>
Co-authored-by: Jens Langhammer <jens@goauthentik.io>
This commit is contained in:
Matthias G
2024-03-15 18:05:44 +01:00
committed by GitHub
parent cf6bbbae70
commit 3f43ff22a8
3 changed files with 13 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
internal/outpost/flow/solvers_mfa.go
View File

@ -10,12 +10,17 @@ const CodePasswordSeparator = ";"
var alphaNum = regexp.MustCompile(`^[a-zA-Z0-9]*$`)
// CheckPasswordInlineMFA For protocols that only support username/password, check if the password
// contains the TOTP code
func (fe *FlowExecutor) CheckPasswordInlineMFA() {
password := fe.Answers[StagePassword]
// We already have an authenticator answer
if fe.Answers[StageAuthenticatorValidate] != "" {
// Sets the secret answers for the flow executor for protocols that only support username/password
// according to used options
func (fe *FlowExecutor) SetSecrets(password string, mfaCodeBased bool) {
if fe.Answers[StageAuthenticatorValidate] != "" || fe.Answers[StagePassword] != "" {
return
}
fe.Answers[StagePassword] = password
if !mfaCodeBased {
// If code-based MFA is disabled StageAuthenticatorValidate answer is set to password.
// This allows flows with a mfa stage only.
fe.Answers[StageAuthenticatorValidate] = password
return
}
// password doesn't contain the separator