[java-idp-plugin-webauthn] branch main updated: Add more flow tests for 2fa mode

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=6601f6000194d47cc00a3d63ad1fb3308cf1ed81

The following commit(s) were added to refs/heads/main by this push:
     new 6601f60  Add more flow tests for 2fa mode
6601f60 is described below

commit 6601f6000194d47cc00a3d63ad1fb3308cf1ed81
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Aug 7 09:28:52 2024 +0100

    Add more flow tests for 2fa mode
---
 .../webauthn/context/logic/IsSecondFactor.java     |  7 ++---
 .../authn/webauthn/flow/TestSecondFactorFlow.java  | 34 +++++++++++++++++++---
 2 files changed, 33 insertions(+), 8 deletions(-)

diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/logic/IsSecondFactor.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/logic/IsSecondFactor.java
index 1071a70..ba05c17 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/logic/IsSecondFactor.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/logic/IsSecondFactor.java
@@ -41,14 +41,13 @@ import net.shibboleth.shared.primitive.StringSupport;
  * A predicate that determines if the authentication flow is being used as a second factor of authentication, and not
  * a first (and possibly only) factor. Returns true if second factor use, or false if passwordless or first factor.
  */
-//FIXME this class is not clear, but I think I need something like it
-//FIXME enabled and forced2fa is confusing
+//FIXME this class is not clear
 public class IsSecondFactor extends AbstractInitializableComponent implements Predicate<ProfileRequestContext> {
     
     /** Class logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(IsSecondFactor.class);
     
-    /** If true, set isSecondFactor is true irrespective of the conventional logic.*/
+    /** If true, set isSecondFactor to true irrespective of the conventional logic.*/
     @Nonnull private Predicate<ProfileRequestContext> secondFactorOverride;
     
     /** 
@@ -185,7 +184,7 @@ public class IsSecondFactor extends AbstractInitializableComponent implements Pr
                     foundFactor.get());
             return true;
         } else {
-            log.debug("Request did not contain an previous factor, assuming first factor usage");
+            log.debug("Request did not contain an acceptable previous factor, assuming first factor usage");
             return false;
         }
 
diff --git a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestSecondFactorFlow.java b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestSecondFactorFlow.java
index 382f238..ee5e10f 100644
--- a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestSecondFactorFlow.java
+++ b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestSecondFactorFlow.java
@@ -67,14 +67,14 @@ public class TestSecondFactorFlow extends AbstractWebAuthnFlowTest{
     
     @SuppressWarnings("null")
     @Test
-    public void testSecondFactorFlow_ToWebAuthnView() throws Exception {
+    public void testSecondFactorFlow() throws Exception {
         //Register a credential for use.
         final CredentialRegistration registration = 
                 createCredentialRegistration(USERNAME, DISPLAY_NAME, USER_HANDLE_B64);
         credentialRepo.addRegistrationByUsername(USERNAME, registration);
         
         final var prc = buildProfileRequestContext(false, false, USERNAME);
-        buildMfaContext(prc.ensureSubcontext(AuthenticationContext.class));
+        buildMfaContext(prc.ensureSubcontext(AuthenticationContext.class), "authn/Password");
 
         final Pair<FlowExecutionResult, FlowExecutionImpl> result = launchExecution(FLOW_ID, null, externalContext, 
                 addToConversationScopeMap(Map.of("opensamlProfileRequestContext", prc)));
@@ -110,12 +110,38 @@ public class TestSecondFactorFlow extends AbstractWebAuthnFlowTest{
         
     }
     
-    private void buildMfaContext(final AuthenticationContext ac) {
+    /* 
+     * The flow will proceed as if first factor passwordless, as no acceptable previous result. So we will end up on the 
+     * CollectUsernameView instead of DisplayWebAuthnView.
+     */
+    @SuppressWarnings("null")
+    @Test
+    public void testSecondFactorFlow_WrongPreviousResult() throws Exception {
+        //Register a credential for use.
+        final CredentialRegistration registration = 
+                createCredentialRegistration(USERNAME, DISPLAY_NAME, USER_HANDLE_B64);
+        credentialRepo.addRegistrationByUsername(USERNAME, registration);
+        
+        final var prc = buildProfileRequestContext(false, false, USERNAME);
+        buildMfaContext(prc.ensureSubcontext(AuthenticationContext.class), "authn/Wrong");
+
+        final Pair<FlowExecutionResult, FlowExecutionImpl> result = launchExecution(FLOW_ID, null, externalContext, 
+                addToConversationScopeMap(Map.of("opensamlProfileRequestContext", prc)));
+
+        assertFlowExecutionActive(result.getSecond());
+        // Stop here, because we are not testing the passwordless flow that we are now in.
+        assertCurrentStateEquals("CollectUsernameView", result.getSecond());
+        
+        
+        
+    }
+    
+    private void buildMfaContext(final AuthenticationContext ac, final String previousFlow) {
         
         final MultiFactorAuthenticationContext mfaCtx = new MultiFactorAuthenticationContext();
         // Create a fake password flow result
         final AuthenticationResult result = new AuthenticationResult("password", new Subject());        
-        mfaCtx.getActiveResults().put("authn/Password", result);
+        mfaCtx.getActiveResults().put(previousFlow, result);
         ac.addSubcontext(mfaCtx);
     }
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.