Auth/pm 17129/login with 2fa recovery code #5383
Open
+164
−72
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
… still working on the feature.
LaunchDarkly flag references🔍 1 flag added or modified
|
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #5383 +/- ##
==========================================
+ Coverage 44.27% 44.31% +0.03%
==========================================
Files 1501 1498 -3
Lines 69218 69235 +17
Branches 6249 6240 -9
==========================================
+ Hits 30648 30681 +33
+ Misses 37242 37232 -10
+ Partials 1328 1322 -6 ☔ View full report in Codecov by Sentry. |
|
New Issues (21)Checkmarx found the following issues in this Pull Request
Fixed Issues (9)Great job! The following issues were fixed in this Pull Request
|
…ery Code working.
…e flagging and touched up a function.
… be more readable.
src/Core/Auth/Identity/TokenProviders/RecoveryCodeTokenProvider.cs
Outdated
Show resolved
Hide resolved
src/Identity/IdentityServer/RequestValidators/BaseRequestValidator.cs
Outdated
Show resolved
Hide resolved
… endpoint to maintain fallback ability.
src/Identity/IdentityServer/RequestValidators/TwoFactorAuthenticationValidator.cs
Outdated
Show resolved
Hide resolved
…ic/private in userservice.
|
ike-kottlowski
requested changes
Feb 11, 2025
src/Core/Services/IUserService.cs
Outdated
| /// their 2fa status, they need to comply with their organizations policies. | ||
| /// </summary> | ||
| /// <param name="user">The user to refresh the 2FA and Recovery Code on.</param> | ||
| Task RefreshUser2FaAndRecoveryCodeAsync(User user); |
There was a problem hiding this comment.
💡 : I think this might be a good candidate for a command since it spans multiple domains: User modification and Organization modification.
| // to disable their other 2FAs just like as if they were using | ||
| // their recovery code because they no longer have access to their | ||
| // 2FA device. | ||
| if (FeatureService.IsEnabled(FeatureFlagKeys.RecoveryCodeLogin)) |
There was a problem hiding this comment.
🎨 : I think I would like this to live in the TwoFactorAuthenticationValidator. Adding it to the here increases tech debt on the BaseRequestValidator.
I think it should live in the TwoFactorAuthenticationValidator.ValidateTwoFactorAsync() flow.
| @@ -154,24 +154,30 @@ public async Task<bool> VerifyTwoFactor( | |||
| return false; | |||
| } | |||
|
|
|||
There was a problem hiding this comment.
🎨 : We could check for the recovery code type here and act on it.
There was a problem hiding this comment.
💭 : I don't think we need this whole Token Provider implementation since we aren't really generating a token. We just use the TwoFactorProviderType to control how we validate the user.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
🎟️ Tracking
https://bitwarden.atlassian.net/browse/PM-17128
📔 Objective
We are utilizing the 2FA Token Provider flow to treat Recovery Codes as a special case of 2FA. We have added a new
TwoFactorProviderTypecalledRecoveryCodethat when provided the correct value will drop the user's 2FA and allow them to login.Other changes:
📸 Screenshots
Screen.Recording.2025-02-06.at.9.28.48.PM.mov
⏰ Reminders before review
🦮 Reviewer guidelines
:+1:) or similar for great changes:memo:) or ℹ️ (:information_source:) for notes or general info:question:) for questions:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion:art:) for suggestions / improvements:x:) or:warning:) for more significant problems or concerns needing attention:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt:pick:) for minor or nitpick changes