Merge branch 'fix-2fa-timeout-2757' into 'v2.0'

Add specific 2FA timeout (#2757) See merge request lemonldap-ng/lemonldap-ng!269
2022-06-16 12:33:19 +00:00 · 2022-06-16 12:33:19 +00:00 · cd41ba8872
parent d1661712ae 095f69cd49
commit cd41ba8872
24 changed files with 94 additions and 56 deletions
--- a/doc/sources/admin/parameterlist.rst
+++ b/doc/sources/admin/parameterlist.rst
@ -562,6 +562,7 @@ sfEngine                                                Second factor engine
 sfExtra                                                 Extra second factors                                                                 ✔
 sfManagerRule                                           Rule to display second factor Manager link                                           ✔
 sfOnlyUpgrade                                           Only trigger second factor on session upgrade                                        ✔
+sfLoginTimeout                                          Timeout for 2F login process                                                         ✔
 sfRegisterTimeout                                       Timeout for 2F registration process                                                  ✔
 sfRemovedMsgRule                                        Display a message if at leat one expired SF has been removed                         ✔
 sfRemovedNotifMsg                                       Notification message                                                                 ✔
--- a/doc/sources/admin/secondfactor.rst
+++ b/doc/sources/admin/secondfactor.rst
@ -76,10 +76,19 @@ of doing a complete reauthentication.

 .. |beta| image:: /documentation/beta.png

+Login timeout
+-------------
+
+Allowed time for the user to authenticate using their second factor. By default
+it is set to 2 minutes, but some complex second factor types (TOTP, email...)
+may require more time to be used.
+
 Registration timeout
 --------------------

-Allowed time to register a TOTP.
+Allowed time for the user to register their new second factor. By default it is
+set to 2 minutes, but some complex second factor types (TOTP...) may require
+more time to be registered.

 Second factor expiration
 ------------------------
--- a/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Attributes.pm
+++ b/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Attributes.pm
@ -4026,6 +4026,9 @@ qr/(?:(?:https?):\/\/(?:(?:(?:(?:(?:(?:[a-zA-Z0-9][-a-zA-Z0-9]*)?[a-zA-Z0-9])[.]
            },
            'type' => 'sfExtraContainer'
        },
+        'sfLoginTimeout' => {
+            'type' => 'int'
+        },
        'sfManagerRule' => {
            'default' => 1,
            'type'    => 'boolOrExpr'
--- a/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Build/Attributes.pm
+++ b/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Build/Attributes.pm
@ -3374,6 +3374,10 @@ sub attributes {
            help          => 'secondfactor.html',
            documentation => 'Notification message',
        },
+        sfLoginTimeout => {
+            type          => 'int',
+            documentation => 'Timeout for 2F login process',
+        },
        sfRegisterTimeout => {
            type          => 'int',
            documentation => 'Timeout for 2F registration process',
--- a/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Build/Tree.pm
+++ b/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Build/Tree.pm
@ -886,6 +886,7 @@ sub tree {
                        'sfManagerRule',
                        'sfRequired',
                        'sfOnlyUpgrade',
+                        'sfLoginTimeout',
                        'sfRegisterTimeout',
                        {
                            title => 'utotp2f',
--- a/lemonldap-ng-manager/site/htdocs/static/languages/ar.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/ar.json
@ -1076,6 +1076,7 @@
 "session_s":"جلسة( أو جلسات )",
 "sessions":"الجلسات",
 "sfExtra":"Additional second factors",
+"sfLoginTimeout":"Login timeout",
 "sfManagerRule":"Display Manager link",
 "sfOnlyUpgrade":"Use 2FA for session upgrade",
 "sfRegisterTimeout":"Registration timeout",
--- a/lemonldap-ng-manager/site/htdocs/static/languages/en.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/en.json
@ -1076,6 +1076,7 @@
 "session_s":"session(s)",
 "sessions":"Sessions",
 "sfExtra":"Additional second factors",
+"sfLoginTimeout":"Login timeout",
 "sfManagerRule":"Display Manager link",
 "sfOnlyUpgrade":"Use 2FA for session upgrade",
 "sfRegisterTimeout":"Registration timeout",
--- a/lemonldap-ng-manager/site/htdocs/static/languages/es.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/es.json
@ -1076,6 +1076,7 @@
 "session_s":"sesión(es)",
 "sessions":"Sesiones",
 "sfExtra":"Segundos factores adicionales",
+"sfLoginTimeout":"Login timeout",
 "sfManagerRule":"Display Manager link",
 "sfOnlyUpgrade":"Use 2FA for session upgrade",
 "sfRegisterTimeout":"Registration timeout",
--- a/lemonldap-ng-manager/site/htdocs/static/languages/fr.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/fr.json
@ -1076,6 +1076,7 @@
 "session_s":"session(s)",
 "sessions":"Sessions",
 "sfExtra":"Seconds facteurs additionnels",
+"sfLoginTimeout":"Délai maximum d'authentification",
 "sfManagerRule":"Afficher le lien du Gestionnaire",
 "sfOnlyUpgrade":"Utiliser le SF pour augmenter le niveau d'authentification",
 "sfRegisterTimeout":"Délai d'expiration de l'enregistrement",
--- a/lemonldap-ng-manager/site/htdocs/static/languages/he.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/he.json
@ -1076,6 +1076,7 @@
 "session_s":"session(s)",
 "sessions":"הפעלות",
 "sfExtra":"Additional second factors",
+"sfLoginTimeout":"Login timeout",
 "sfManagerRule":"Display Manager link",
 "sfOnlyUpgrade":"Use 2FA for session upgrade",
 "sfRegisterTimeout":"Registration timeout",
--- a/lemonldap-ng-manager/site/htdocs/static/languages/it.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/it.json
@ -1076,6 +1076,7 @@
 "session_s":"sessione(i)",
 "sessions":"Sessioni",
 "sfExtra":"Additional second factors",
+"sfLoginTimeout":"Login timeout",
 "sfManagerRule":"Display Manager link",
 "sfOnlyUpgrade":"Use 2FA for session upgrade",
 "sfRegisterTimeout":"Registration timeout",
--- a/lemonldap-ng-manager/site/htdocs/static/languages/pl.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/pl.json
@ -1076,6 +1076,7 @@
 "session_s":"sesja/e",
 "sessions":"Sesje",
 "sfExtra":"Dodatkowe drugie czynniki",
+"sfLoginTimeout":"Login timeout",
 "sfManagerRule":"Link do Menedżera wyświetlania",
 "sfOnlyUpgrade":"Użyj 2FA do aktualizacji sesji",
 "sfRegisterTimeout":"Registration timeout",
--- a/lemonldap-ng-manager/site/htdocs/static/languages/tr.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/tr.json
@ -1076,6 +1076,7 @@
 "session_s":"oturum(lar)",
 "sessions":"Oturumlar",
 "sfExtra":"Ek ikinci faktörler",
+"sfLoginTimeout":"Login timeout",
 "sfManagerRule":"Yönetici bağlantısını görüntüle",
 "sfOnlyUpgrade":"Oturum yükseltme için 2FA kullan",
 "sfRegisterTimeout":"Kayıtlanma zaman aşımı",
--- a/lemonldap-ng-manager/site/htdocs/static/languages/vi.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/vi.json
@ -1076,6 +1076,7 @@
 "session_s":"session (s)",
 "sessions":"Phiên",
 "sfExtra":"Additional second factors",
+"sfLoginTimeout":"Login timeout",
 "sfManagerRule":"Display Manager link",
 "sfOnlyUpgrade":"Use 2FA for session upgrade",
 "sfRegisterTimeout":"Registration timeout",
--- a/lemonldap-ng-manager/site/htdocs/static/languages/zh.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/zh.json
@ -1076,6 +1076,7 @@
 "session_s":"工作階段",
 "sessions":"工作階段",
 "sfExtra":"額外的第二因素",
+"sfLoginTimeout":"Login timeout",
 "sfManagerRule":"顯示管理程式連結",
 "sfOnlyUpgrade":"使用 2FA 進行工作階段升級",
 "sfRegisterTimeout":"Registration timeout",
--- a/lemonldap-ng-manager/site/htdocs/static/languages/zh_TW.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/zh_TW.json
@ -1076,6 +1076,7 @@
 "session_s":"工作階段",
 "sessions":"工作階段",
 "sfExtra":"額外的第二因素",
+"sfLoginTimeout":"Login timeout",
 "sfManagerRule":"顯示管理程式連結",
 "sfOnlyUpgrade":"使用 2FA 進行工作階段升級",
 "sfRegisterTimeout":"Registration timeout",
--- a/lemonldap-ng-manager/site/htdocs/static/reverseTree.json
+++ b/lemonldap-ng-manager/site/htdocs/static/reverseTree.json
--- a/lemonldap-ng-manager/site/htdocs/static/struct.json
+++ b/lemonldap-ng-manager/site/htdocs/static/struct.json
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/2F/Engines/Default.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/2F/Engines/Default.pm
@ -41,7 +41,8 @@ has ott => (
    default => sub {
        my $ott =
          $_[0]->{p}->loadModule('Lemonldap::NG::Portal::Lib::OneTimeToken');
-        $ott->timeout( $_[0]->{conf}->{formTimeout} );
+        $ott->timeout( $_[0]->{conf}->{sfLoginTimeout}
+              || $_[0]->{conf}->{formTimeout} );
        return $ott;
    }
 );
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/2F/Mail2F.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/2F/Mail2F.pm
@ -35,6 +35,7 @@ has ott => (
        my $ott =
          $_[0]->{p}->loadModule('Lemonldap::NG::Portal::Lib::OneTimeToken');
        $ott->timeout( $_[0]->{conf}->{mail2fTimeout}
+              || $_[0]->{conf}->{sfLoginTimeout}
              || $_[0]->{conf}->{formTimeout} );
        return $ott;
    }
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Main/SecondFactor.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Main/SecondFactor.pm
@ -25,7 +25,8 @@ has ott => (
    default => sub {
        my $ott =
          $_[0]->{p}->loadModule('Lemonldap::NG::Portal::Lib::OneTimeToken');
-        $ott->timeout( $_[0]->{conf}->{formTimeout} );
+        $ott->timeout( $_[0]->{conf}->{sfLoginTimeout}
+              || $_[0]->{conf}->{formTimeout} );
        return $ott;
    }
 );
--- a/lemonldap-ng-portal/t/74-2F-Required-Issuer-Timeouts.t
+++ b/lemonldap-ng-portal/t/74-2F-Required-Issuer-Timeouts.t
@ -19,9 +19,10 @@ SKIP: {
                totp2fActivation       => 1,
                sfRequired             => 1,
                sfRegisterTimeout      => 600,
+                sfLoginTimeout         => 600,
                tokenUseGlobalStorage  => 1,
                issuerDBCASActivation  => 1,
-                issuersTimeout         => 600,
+                issuersTimeout         => 1200,
            }
        }
    );
@ -128,9 +129,14 @@ SKIP: {
    $pdata = 'lemonldappdata=' . expectCookie( $res, 'lemonldappdata' );
    my ( $host, $url, $query ) =
      expectForm( $res, undef, '/totp2fcheck', 'token' );
+
+    # Test Login timeout
+    Time::Fake->offset("+10m");
+
    ok( $code = Lemonldap::NG::Common::TOTP::_code( undef, $key, 0, 30, 6 ),
        'Code' );
    $query =~ s/code=/code=$code/;
+
    ok(
        $res = $client->_post(
            '/totp2fcheck', IO::String->new($query),