[PM-8107] Remove Duo SDK version 2 from server code #4837

ike-kottlowski · 2024-09-30T21:10:50Z

🎟️ Tracking

PM-8107

📔 Objective

We want to remove object references to the old Duo SDK version 2. This work accomplishes that task.

📸 Screenshots

Setting Duo for a User

Logging in with User Duo two factor

Setting Duo for Organization

Logging in using Organization Duo two factor

⏰ Reminders before review

Contributor guidelines followed
All formatters and local linters executed and passed
Written new unit and / or integration tests where applicable
Protected functional changes with optionality (feature flags)
Used internationalization (i18n) for all UI strings
CI builds passed
Communicated to DevOps any deployment requirements
Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

👍 (:+1:) or similar for great changes
📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
❓ (:question:) for questions
🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
🎨 (:art:) for suggestions / improvements
❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
⛏ (:pick:) for minor or nitpick changes

codecov · 2024-09-30T21:19:51Z

Codecov Report

Attention: Patch coverage is 43.93064% with 97 lines in your changes missing coverage. Please review.

Project coverage is 42.05%. Comparing base (c66879e) to head (8ed411e).
Report is 16 commits behind head on main.

Files with missing lines	Patch %	Lines
src/Core/Auth/Identity/DuoTokenProvider.cs	10.63%	42 Missing ⚠️
.../Identity/OrganizationDuoUniversalTokenProvider.cs	23.07%	28 Missing and 2 partials ⚠️
...rc/Core/Auth/Identity/DuoUniversalTokenProvider.cs	56.41%	16 Missing and 1 partial ⚠️
src/Api/Auth/Controllers/TwoFactorController.cs	86.66%	2 Missing ⚠️
...ls/Response/TwoFactor/TwoFactorDuoResponseModel.cs	71.42%	1 Missing and 1 partial ⚠️
src/Core/Auth/Utilities/DuoUtilities.cs	86.66%	0 Missing and 2 partials ⚠️
...rc/Identity/IdentityServer/BaseRequestValidator.cs	33.33%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4837      +/-   ##
==========================================
+ Coverage   41.72%   42.05%   +0.32%     
==========================================
  Files        1320     1323       +3     
  Lines       62569    62406     -163     
  Branches     5770     5736      -34     
==========================================
+ Hits        26106    26242     +136     
+ Misses      35254    34964     -290     
+ Partials     1209     1200       -9

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

github-actions · 2024-09-30T21:41:32Z

Checkmarx One – Scan Summary & Details – d569d1d5-6b27-4c33-91c6-ad303ea6f625

New Issues

Issue	Source File / Package	Checkmarx Insight
CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 366	Attack Vector
CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 238	Attack Vector
CSRF	/src/Api/Controllers/CollectionsController.cs: 247	Attack Vector
Privacy_Violation	/src/Api/Vault/Models/Request/CipherRequestModel.cs: 198	Attack Vector
SSL_Verification_Bypass	/src/Api/Auth/Models/Request/OrganizationSsoRequestModel.cs: 146	Attack Vector
SSL_Verification_Bypass	/bitwarden_license/src/Sso/Utilities/DynamicAuthenticationSchemeProvider.cs: 405	Attack Vector
SSL_Verification_Bypass	/src/Core/Utilities/CoreHelpers.cs: 105	Attack Vector
SSL_Verification_Bypass	/src/Core/Utilities/CoreHelpers.cs: 115	Attack Vector
SSL_Verification_Bypass	/src/Core/Utilities/CoreHelpers.cs: 140	Attack Vector
SSL_Verification_Bypass	/src/Core/Utilities/CoreHelpers.cs: 93	Attack Vector
Log_Forging	/src/Notifications/Controllers/SendController.cs: 27	Attack Vector
Log_Forging	/src/Api/Vault/Controllers/CiphersController.cs: 574	Attack Vector
Log_Forging	/src/Api/Vault/Controllers/CiphersController.cs: 553	Attack Vector
Log_Forging	/src/Api/Vault/Controllers/CiphersController.cs: 603	Attack Vector
Log_Forging	/src/Api/Vault/Controllers/CiphersController.cs: 530	Attack Vector
Log_Forging	/bitwarden_license/src/Scim/Controllers/v2/GroupsController.cs: 98	Attack Vector
Open_Redirect	/src/Admin/Controllers/ToolsController.cs: 490	Attack Vector
Open_Redirect	/bitwarden_license/src/Sso/Controllers/AccountController.cs: 167	Attack Vector

Fixed Issues

Severity	Issue	Source File / Package
	CSRF	/src/Billing/Controllers/RecoveryController.cs: 38
	CSRF	/src/Api/Billing/Controllers/OrganizationsController.cs: 105
	CSRF	/src/Api/Billing/Controllers/OrganizationsController.cs: 49
	CSRF	/src/Api/AdminConsole/Controllers/PoliciesController.cs: 78
	CSRF	/src/Api/AdminConsole/Controllers/PoliciesController.cs: 61
	CSRF	/src/Billing/Controllers/StripeController.cs: 164
	CSRF	/src/Api/AdminConsole/Public/Controllers/MembersController.cs: 93
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 224
	CSRF	/src/Api/AdminConsole/Controllers/PoliciesController.cs: 78
	CSRF	/src/Api/AdminConsole/Controllers/PoliciesController.cs: 61
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 348
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 331
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 250
	CSRF	/src/Api/AdminConsole/Public/Controllers/PoliciesController.cs: 46
	CSRF	/src/Api/AdminConsole/Public/Controllers/PoliciesController.cs: 66
	CSRF	/src/Api/SecretsManager/Controllers/SecretsController.cs: 79
	CSRF	/src/Api/SecretsManager/Controllers/SecretsController.cs: 128
	CSRF	/src/Api/SecretsManager/Controllers/SecretsTrashController.cs: 32
	Privacy_Violation	/src/Api/Auth/Models/Request/Accounts/SetPasswordRequestModel.cs: 28
	Heap_Inspection	/src/Core/Vault/Services/Implementations/LocalAttachmentStorageService.cs: 34
	Heap_Inspection	/src/Api/Vault/Controllers/CiphersController.cs: 1125
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Api/AdminConsole/Controllers/ProvidersController.cs: 72
	Log_Forging	/src/Api/AdminConsole/Controllers/ProvidersController.cs: 72
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/StripeController.cs: 164
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/StripeController.cs: 164
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Identity/Billing/Controller/AccountsController.cs: 23
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/StripeController.cs: 164
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/StripeController.cs: 164
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Billing/Controllers/RecoveryController.cs: 38
	Log_Forging	/src/Api/Billing/Controllers/ProviderBillingController.cs: 52
	Log_Forging	/src/Api/Auth/Controllers/AccountsController.cs: 898
	Log_Forging	/src/Api/Auth/Controllers/AccountsController.cs: 366
	Log_Forging	/src/Api/Auth/Controllers/AccountsController.cs: 246

…thub.com/bitwarden/server into auth/pm-6666/twofactorvalidator-refactor

ike-kottlowski added 5 commits September 27, 2024 12:06

replace duo token provider

cd3ae73

removed last bits and replaced validation

a917097

fixed tests

34b4a12

Testing Duo two factor implementation

966fe5f

Formatting

55105fe

ike-kottlowski added 22 commits September 30, 2024 14:50

formatting

8ed411e

initial device removal

ed66e44

Unit Testing

5b027ed

Finalized tests

07264af

initial commit refactoring two factor

7430802

initial tests

b994eea

Unit Tests

4c0871a

initial device removal

db2e3fd

Unit Testing

d127e6f

Finalized tests

7ef6c0b

initial commit refactoring two factor

3b5ec21

initial tests

784cfbd

Unit Tests

e6b0a80

Merge branch 'auth/pm-6666/twofactorvalidator-refactor' of https://gi…

baa9125

…thub.com/bitwarden/server into auth/pm-6666/twofactorvalidator-refactor

Fixing some tests

c702ec4

replace duo token provider

45b5a04

removed last bits and replaced validation

caac7c7

fixed tests

668b451

Testing Duo two factor implementation

80fc7c1

Formatting

f227fa9

formatting

5452259

syncing

0fadba2

github-actions bot added the feature-flag label Oct 16, 2024

Merge branch 'main' into auth/pm-8107/remove-v2-duo

6d30c3f

github-actions bot removed the feature-flag label Oct 16, 2024

ike-kottlowski closed this Oct 16, 2024

ike-kottlowski deleted the auth/pm-8107/remove-v2-duo branch October 16, 2024 00:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[PM-8107] Remove Duo SDK version 2 from server code #4837

[PM-8107] Remove Duo SDK version 2 from server code #4837

ike-kottlowski commented Sep 30, 2024 •

edited by jira bot

Loading

codecov bot commented Sep 30, 2024 •

edited

Loading

github-actions bot commented Sep 30, 2024 •

edited

Loading

[PM-8107] Remove Duo SDK version 2 from server code #4837

[PM-8107] Remove Duo SDK version 2 from server code #4837

Conversation

ike-kottlowski commented Sep 30, 2024 • edited by jira bot Loading

🎟️ Tracking

📔 Objective

📸 Screenshots

Setting Duo for a User

Logging in with User Duo two factor

Setting Duo for Organization

Logging in using Organization Duo two factor

⏰ Reminders before review

🦮 Reviewer guidelines

codecov bot commented Sep 30, 2024 • edited Loading

Codecov Report

github-actions bot commented Sep 30, 2024 • edited Loading

New Issues

Fixed Issues

ike-kottlowski commented Sep 30, 2024 •

edited by jira bot

Loading

codecov bot commented Sep 30, 2024 •

edited

Loading

github-actions bot commented Sep 30, 2024 •

edited

Loading