Add ability to force MFA on OIDC Logins #971

s3n-w6i · 2024-05-09T15:57:26Z

This PR implements the ability to force users logging in through OIDC to have Multi-factor authentication enabled. It does this by looking at the amr claim provided by the IDP. This claim must contain the mfa value. Make sure that the IDP returns the amr claim correctly, otherwise authentication will fail.

Two new env vars have been added:

GRIST_OIDC_SP_FORCE_MFA
If set to "true", the user will be forced to have multi-factor authentication enabled.
GRIST_OIDC_SP_MFA_SETTINGS_URL
This is needed when GRIST_OIDC_SP_FORCE_MFA is set to true. Enter the URL where the user will be able to configure Multi-factor authentication on their account. This will be shown in the UI if the user does not have MFA enabled.

How to test:

Using Keycloak, it's fairly hard to add the amr claim, but Zitadel returns it by default. To test, create a new account on their cloud offering, hook it up to Grist and set GRIST_OIDC_SP_FORCE_MFA to true.
Log in without MFA enabled and get an error page.

fflorent

Thanks for this enhancement!

For what it is worth, I am a contributor but not part of Grist Labs, my review is advisory and the merge has to be done by an employee. I proposed some comments with the hope they may be useful.

I will try using deploying OIDC + MFA to test your PR.

app/server/lib/OIDCConfig.ts

fflorent · 2024-05-23T20:02:22Z

app/client/ui/errorPages.ts

+    cssErrorText(t("Multi-factor-authentication is required for accessing this site, but it is not set up on your \
+account. Please enable it and try again.")),


I'd suggest avoiding the \ at the end of a string, it is not standard JS (or is it required for the translation key collection?).

Suggested change

cssErrorText(t("Multi-factor-authentication is required for accessing this site, but it is not set up on your \

account. Please enable it and try again.")),

cssErrorText(t("Multi-factor-authentication is required for accessing this site, but it is not set up on your " +

"account. Please enable it and try again.")),

The plus should work as well, you're right. I'll test it later this week.

fflorent · 2024-06-04T12:46:09Z

static/locales/de.client.json

+        "Multi-factor authentication required{{suffix}}": "Multi-Faktor-Authentifizierung nötig{{suffix}}",
+        "Multi-factor-authentication is required for accessing this site, but it is not set up on your account. Please enable it and try again.": "Für den Zugriff auf diese Website ist Multi-Faktor-Authentifizierung erforderlich. Diese ist nicht in Ihrem Konto eingerichtet. Bitte richten Sie sie ein und versuchen Sie es erneut.",
+        "Set up Multi-factor authentication": "Multi-Faktor-Authentifizierung einrichten",
+        "Try again": "Erneut versuchen"


Thanks for the localization, but could you do them through Weblate instead, please:
https://github.com/gristlabs/grist-core/blob/main/documentation/translations.md

Co-authored-by: Florent <[email protected]>

fflorent · 2024-06-06T15:07:16Z

app/client/ui/errorPages.ts

+    cssButtonWrap(bigPrimaryButtonLink(
+      t("Set up Multi-factor authentication"),
+      {href: getGristConfig().mfaSettingsUrl, target: '_blank'},
+      testId('error-setup-mfa')
+    )),


What do you think of showing that property only when getGristConfig().mfaSettingsUrl is filled with some value? This way, GRIST_OIDC_SP_MFA_SETTINGS_URL would be optional even when GRIST_OIDC_SP_FORCE_MFA is set.

Suggested change

cssButtonWrap(bigPrimaryButtonLink(

t("Set up Multi-factor authentication"),

{href: getGristConfig().mfaSettingsUrl, target: '_blank'},

testId('error-setup-mfa')

)),

getGristConfig().mfaSettingsUrl ? cssButtonWrap(bigPrimaryButtonLink(

t("Set up Multi-factor authentication"),

{href: getGristConfig().mfaSettingsUrl, target: '_blank'},

testId('error-setup-mfa')

)) : null,

fflorent · 2024-06-06T15:09:32Z

app/client/ui/errorPages.ts

+    suffix: getPageTitleSuffix(getGristConfig())
+  });
+
+  const searchParams = new URL(location.href).searchParams;


Nitpicking: you can otherwise use the URLSearchParams class:

Suggested change

const searchParams = new URL(location.href).searchParams;

const searchParams = new URLSearchParams(location.search);

fflorent · 2024-06-06T15:21:39Z

app/server/lib/OIDCConfig.ts

+          }
+
+          res.redirect(`/login/error/mfa-not-enabled?next=${targetUrlRelative}`);
+          return;


In another PR, I made something that may be of some help :

the changes in the backend: https://github.com/gristlabs/grist-core/pull/883/files#diff-ee4d5464063d6cfc9dc24b7b63d8858ff7b978dbe767ad2a712c93fe52f7ca1dR229-R248

the changes in the frontend (you can see how I made the button to allow the user to login again, no need to retrieve particular data from the backend, so you would not need to pass the next param): https://github.com/gristlabs/grist-core/pull/883/files#diff-6d05e89e392b7fe826b41130d739c6b32c40abe5bb59f4e31a6404bd1faba0c3R102

I hope my PR will be merged soon and that you could benefit from the changes.

You could still create another error page specifically for MFA.

However, I do not take advantage of the next param, and I do not see yet how to pass it using _sendAppPage. Is it something we would like to have absolutely? I tend to think it does not probably bring much discomfort (at least compared to the error itself).

fflorent

I tested your work, it works fine, thanks. Still some changes I suggest regarding your PR, with the hope that my suggestions are clear, relevant and may help.

fflorent · 2024-06-06T16:36:39Z

app/server/lib/OIDCConfig.ts

+ *        be determined by OIDC's amr claim: It must include "mfa". Make sure that the IDP returns the amr claim
+ *        correctly, otherwise authentication will fail.
+ *    env GRIST_OIDC_SP_MFA_SETTINGS_URL
+ *        This is needed when GRIST_OIDC_SP_FORCE_MFA is set to true. Enter the URL where the user will be able to


If you agree with my suggestion above, don't forget to adapt the comment here :).

fflorent · 2024-08-24T09:15:12Z

@pr0gr8mm3r I have my PR #883 merged, your PR has some conflicts.

I would be glad to help, don't hesitate to ask if you need!

fflorent · 2024-10-15T07:28:35Z

@pr0gr8mm3r Any news on this work? If you need help, please don't hesitate.

s3n-w6i · 2024-11-11T21:40:21Z

Hey @fflorent, been quite busy recently, and I currently don't have time to look. Please excuse my late reply. If you want to keep the PRs-list clean, feel free to close it. I'll open another one once I've gotten time to work on it again.

fflorent · 2024-11-11T21:42:31Z

@pr0gr8mm3r No worry, thanks for your reply!

Do you want me to resume your work? (Keeping crediting you for the first commits)

I am OK with both options: waiting or resuming your work.

s3n-w6i · 2024-11-12T12:18:37Z

If you have time, that'd be great! Feel free to continue :)

uowis added 9 commits May 9, 2024 16:04

Implement forcing mfa from OIDC IDP

39bf909

Introduce user facing error page for enabling mfa

cdd0a5d

add german translation

b51bfe2

fix german translation, add english "translation"

7f2e3ed

add documentation on new env vars

1d5383e

fix linting issue

95b387f

fix linting warning

a113681

add missing semicolon

41806e3

fix overly long lines

d165e36

fflorent reviewed Jun 4, 2024

View reviewed changes

Simplify if-statement

273cad5

Co-authored-by: Florent <[email protected]>

fflorent suggested changes Jun 6, 2024

View reviewed changes

fflorent reviewed Jun 6, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add ability to force MFA on OIDC Logins #971

Add ability to force MFA on OIDC Logins #971

s3n-w6i commented May 9, 2024

fflorent left a comment

fflorent May 23, 2024

s3n-w6i Jun 4, 2024

fflorent Jun 4, 2024

fflorent Jun 6, 2024

fflorent Jun 6, 2024

fflorent Jun 6, 2024

fflorent left a comment

fflorent Jun 6, 2024

fflorent commented Aug 24, 2024

fflorent commented Oct 15, 2024

s3n-w6i commented Nov 11, 2024

fflorent commented Nov 11, 2024 •

edited

Loading

s3n-w6i commented Nov 12, 2024

		cssErrorText(t("Multi-factor-authentication is required for accessing this site, but it is not set up on your \
		account. Please enable it and try again.")),

	const searchParams = new URL(location.href).searchParams;
	const searchParams = new URLSearchParams(location.search);

Add ability to force MFA on OIDC Logins #971

Are you sure you want to change the base?

Add ability to force MFA on OIDC Logins #971

Conversation

s3n-w6i commented May 9, 2024

fflorent left a comment

Choose a reason for hiding this comment

fflorent May 23, 2024

Choose a reason for hiding this comment

s3n-w6i Jun 4, 2024

Choose a reason for hiding this comment

fflorent Jun 4, 2024

Choose a reason for hiding this comment

fflorent Jun 6, 2024

Choose a reason for hiding this comment

fflorent Jun 6, 2024

Choose a reason for hiding this comment

fflorent Jun 6, 2024

Choose a reason for hiding this comment

fflorent left a comment

Choose a reason for hiding this comment

fflorent Jun 6, 2024

Choose a reason for hiding this comment

fflorent commented Aug 24, 2024

fflorent commented Oct 15, 2024

s3n-w6i commented Nov 11, 2024

fflorent commented Nov 11, 2024 • edited Loading

s3n-w6i commented Nov 12, 2024

fflorent commented Nov 11, 2024 •

edited

Loading