Bug 1199089 - add support for duo-security

3 files changed, 85 insertions, 2 deletions

diff --git a/Bugzilla/MFA/Dummy.pm b/Bugzilla/MFA/Dummy.pm
new file mode 100644
index 000000000..d91f7ae42
--- /dev/null
+++ b/Bugzilla/MFA/Dummy.pm
@@ -0,0 +1,26 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# This Source Code Form is "Incompatible With Secondary Licenses", as
+# defined by the Mozilla Public License, v. 2.0.
+
+package Bugzilla::MFA::Dummy;
+use strict;
+use parent 'Bugzilla::MFA';
+
+# if a user is configured to use a disabled or invalid mfa provider, we return
+# this dummy provider.
+#
+# it provides no 2fa protection at all, but prevents crashing.
+
+sub prompt {
+    my ($self, $vars) = @_;
+    my $template = Bugzilla->template;
+
+    print Bugzilla->cgi->header();
+    $template->process('mfa/dummy/verify.html.tmpl', $vars)
+        || ThrowTemplateError($template->error());
+}
+
+1;
diff --git a/Bugzilla/MFA/Duo.pm b/Bugzilla/MFA/Duo.pm
new file mode 100644
index 000000000..4c9aa1184
--- /dev/null
+++ b/Bugzilla/MFA/Duo.pm
@@ -0,0 +1,53 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# This Source Code Form is "Incompatible With Secondary Licenses", as
+# defined by the Mozilla Public License, v. 2.0.
+
+package Bugzilla::MFA::Duo;
+use strict;
+use parent 'Bugzilla::MFA';
+
+use Bugzilla::DuoWeb;
+use Bugzilla::Error;
+
+sub can_verify_inline {
+    return 0;
+}
+
+sub enroll {
+    my ($self, $params) = @_;
+
+    $self->property_set('user', $params->{username});
+}
+
+sub prompt {
+    my ($self, $vars) = @_;
+    my $template = Bugzilla->template;
+
+    $vars->{sig_request} = Bugzilla::DuoWeb::sign_request(
+        Bugzilla->params->{duo_ikey},
+        Bugzilla->params->{duo_skey},
+        Bugzilla->params->{duo_akey},
+        $self->property_get('user'),
+    );
+
+    print Bugzilla->cgi->header();
+    $template->process('mfa/duo/verify.html.tmpl', $vars)
+        || ThrowTemplateError($template->error());
+}
+
+sub check {
+    my ($self, $params) = @_;
+
+    return if Bugzilla::DuoWeb::verify_response(
+        Bugzilla->params->{duo_ikey},
+        Bugzilla->params->{duo_skey},
+        Bugzilla->params->{duo_akey},
+        $params->{sig_response}
+    );
+    ThrowUserError('mfa_bad_code');
+}
+
+1;
diff --git a/Bugzilla/MFA/TOTP.pm b/Bugzilla/MFA/TOTP.pm
index 64efcfc8d..36791da15 100644
--- a/Bugzilla/MFA/TOTP.pm
+++ b/Bugzilla/MFA/TOTP.pm
@@ -16,6 +16,10 @@ use Bugzilla::Util qw( template_var generate_random_password );
 use GD::Barcode::QRcode;
 use MIME::Base64 qw( encode_base64 );
 
+sub can_verify_inline {
+    return 1;
+}
+
 sub _auth {
     my ($self) = @_;
     return Auth::GoogleAuth->new({
@@ -25,7 +29,7 @@ sub _auth {
     });
 }
 
-sub enroll {
+sub enroll_api {
     my ($self) = @_;
 
     # create a new secret for the user
@@ -65,7 +69,7 @@ sub check {
         ThrowUserError('mfa_totp_bad_enrolment_code');
     }
     else {
-        ThrowUserError('mfa_totp_bad_code');
+        ThrowUserError('mfa_bad_code');
     }
 }