apereo / cas

import org.apereo.cas.adaptors.duo.authn.DuoCredential;

import org.apereo.cas.configuration.CasConfigurationProperties;

import org.apereo.cas.configuration.model.support.mfa.DuoSecurityMultifactorProperties;

import org.apereo.cas.services.MultifactorAuthenticationProvider;

import org.apereo.cas.services.VariegatedMultifactorAuthenticationProvider;

import org.apereo.cas.web.flow.configurer.AbstractMultifactorTrustedDeviceWebflowConfigurer;

import org.apereo.cas.web.flow.CasWebflowConstants;

import org.apereo.cas.web.flow.configurer.DynamicFlowModelBuilder;

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;

import org.springframework.context.ApplicationContext;

import org.springframework.webflow.config.FlowDefinitionRegistryBuilder;

import org.springframework.webflow.definition.registry.FlowDefinitionRegistry;

import org.springframework.webflow.engine.builder.FlowBuilder;

import org.springframework.webflow.engine.builder.model.FlowModelFlowBuilder;

import org.springframework.webflow.engine.builder.support.FlowBuilderServices;

import org.springframework.webflow.engine.model.AbstractActionModel;

import org.springframework.webflow.engine.model.AbstractStateModel;

import org.springframework.webflow.engine.model.ActionStateModel;

import org.springframework.webflow.engine.model.BinderModel;

import org.springframework.webflow.engine.model.BindingModel;

import org.springframework.webflow.engine.model.EndStateModel;

import org.springframework.webflow.engine.model.EvaluateModel;

import org.springframework.webflow.engine.model.TransitionModel;

import org.springframework.webflow.engine.model.VarModel;

import org.springframework.webflow.engine.model.ViewStateModel;

import org.springframework.webflow.engine.model.builder.DefaultFlowModelHolder;

import org.springframework.webflow.engine.model.registry.FlowModelHolder;

import java.util.LinkedList;

/**

 * This is {@link DuoMultifactorWebflowConfigurer}.

 *

 * @author Misagh Moayyed

 * @since 5.0.0

 */

public class DuoMultifactorWebflowConfigurer extends AbstractMultifactorTrustedDeviceWebflowConfigurer {

    private static final Logger LOGGER = LoggerFactory.getLogger(DuoMultifactorWebflowConfigurer.class);

    private static final String STATE_ID_VIEW_LOGIN_FORM_DUO = "viewLoginFormDuo";

    private final VariegatedMultifactorAuthenticationProvider provider;

    public DuoMultifactorWebflowConfigurer(final FlowBuilderServices flowBuilderServices, 

                                           final FlowDefinitionRegistry loginFlowDefinitionRegistry,

                                           final boolean enableDeviceRegistration, 

                                           final VariegatedMultifactorAuthenticationProvider provider,

                                           final ApplicationContext applicationContext,

                                           final CasConfigurationProperties casProperties) {

        super(flowBuilderServices, loginFlowDefinitionRegistry, enableDeviceRegistration, applicationContext, casProperties);

        this.provider = provider;

    }

    @Override

    protected void doInitialize() {

        provider.getProviders().forEach(p -> {

            final FlowDefinitionRegistry duoFlowRegistry = buildDuoFlowRegistry(p);

            applicationContext.getAutowireCapableBeanFactory().initializeBean(duoFlowRegistry, p.getId());

            final ConfigurableListableBeanFactory cfg = (ConfigurableListableBeanFactory) applicationContext.getAutowireCapableBeanFactory();

            cfg.registerSingleton(p.getId(), duoFlowRegistry);

            registerMultifactorProviderAuthenticationWebflow(getLoginFlow(), p.getId(), duoFlowRegistry);

        });

        casProperties.getAuthn().getMfa().getDuo()

                .stream()

                .filter(DuoSecurityMultifactorProperties::isTrustedDeviceEnabled)

                .forEach(duo -> {

                    final String id = duo.getId();

                    try {

                        LOGGER.debug("Activating multifactor trusted authentication for webflow [{}]", id);

                        final FlowDefinitionRegistry registry = applicationContext.getBean(id, FlowDefinitionRegistry.class);

                        registerMultifactorTrustedAuthentication(registry);

                    } catch (final Exception e) {

                        LOGGER.error("Failed to register multifactor trusted authentication for " + id, e);

                    }

                });

    }

    private FlowDefinitionRegistry buildDuoFlowRegistry(final MultifactorAuthenticationProvider p) {

        final DynamicFlowModelBuilder modelBuilder = new DynamicFlowModelBuilder();

        createDuoFlowVariables(modelBuilder);

        createDuoFlowStartActions(modelBuilder);

        createDuoFlowStates(modelBuilder);

        return createDuoFlowDefinitionRegistry(p, modelBuilder);

    }

    private FlowDefinitionRegistry createDuoFlowDefinitionRegistry(final MultifactorAuthenticationProvider p, final DynamicFlowModelBuilder modelBuilder) {

        final FlowModelHolder holder = new DefaultFlowModelHolder(modelBuilder);

        final FlowBuilder flowBuilder = new FlowModelFlowBuilder(holder);

        final FlowDefinitionRegistryBuilder builder = new FlowDefinitionRegistryBuilder(this.applicationContext, flowBuilderServices);

        builder.addFlowBuilder(flowBuilder, p.getId());

        return builder.build();

    }

    private void createDuoFlowStartActions(final DynamicFlowModelBuilder modelBuilder) {

        final LinkedList<AbstractActionModel> starts = new LinkedList<>();

        starts.add(new EvaluateModel("initialFlowSetupAction"));

        modelBuilder.setOnStartActions(starts);

    }

    private void createDuoFlowVariables(final DynamicFlowModelBuilder modelBuilder) {

        final LinkedList<VarModel> vars = new LinkedList<>();

        vars.add(new VarModel(CasWebflowConstants.VAR_ID_CREDENTIAL, DuoCredential.class.getName()));

        modelBuilder.setVars(vars);

    }

}