Skip to content

Commit

Permalink
authentication: Add different auth methos for passkey
Browse files Browse the repository at this point in the history 
Add following authentication methods
1. Passkey with pin (default)
2. Passkey with pin and interactive and touch prompts
3. Passkey wihout pin with both prompts
4. Passkey auth when we press enter for pin and
   it goes to next auth method as a password

Signed-off-by: Madhuri Upadhye <[email protected]>
  • Loading branch information
@madhuriupadhye
madhuriupadhye committed Sep 23, 2024
1 parent a5cda6d commit ea96500
Showing 1 changed file with 86 additions and 19 deletions.
105 changes: 86 additions & 19 deletions sssd_test_framework/utils/authentication.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@

from datetime import datetime
from typing import Any
from enum import Enum

from pytest_mh import MultihostHost, MultihostUtility
from pytest_mh.conn import Connection, ProcessResult
Expand All @@ -22,6 +23,15 @@
DEFAULT_AUTHENTICATION_TIMEOUT: int = 60
"""Default timeout for authentication failure."""

class PasskeyAuthenticationUseCases(Enum):
"""
Authentication methods for passkey authentication.
"""
PASSKEY_WITH_PIN = 0,
PASSKEY_WITH_PIN_AND_PROMPTS = 1,
PASSKEY_WITHOUT_PIN_WITH_PROMPTS = 2,
PASSKEY_WITHOUT_PIN_WITHOUT_PROMPTS = 3,
PASSKEY_FALLBACK_TO_PASSWORD = 4,

class AuthenticationUtils(MultihostUtility[MultihostHost]):
"""
Expand Down Expand Up @@ -341,23 +351,32 @@ def password_expired(self, username: str, password: str, new_password: str) -> b
return result.rc == 0

def passkey_with_output(
self, username: str, *, pin: str | int, device: str, ioctl: str, script: str, command: str = "exit 0"
self, username: str, *, device: str, ioctl: str, script: str, pin: str | int | None = None,
interactive_prompt: str = "Insert your passkey device, then press ENTER.",
touch_prompt: str = "Please touch the device.", command: str = "exit 0",
auth_method: PasskeyAuthenticationUseCases = PasskeyAuthenticationUseCases.PASSKEY_WITH_PIN
) -> tuple[int, int, str, str]:
"""
Call ``su - $username`` and authenticate the user with passkey.
:param username: Username
:type username: str
:param pin: Passkey PIN.
:type pin: str | int
:param device: Path to local umockdev device file.
:type device: str
:param ioctl: Path to local umockdev ioctl file.
:type ioctl: str
:param script: Path to local umockdev script file
:type script: str
:param pin: Passkey PIN, defaults to None
:type pin: str | int | None
:param interactive_prompt: Interactive prompt, defaults to "Insert your passkey device, then press ENTER."
:type interactive_prompt: str
:param touch_prompt: Touch prompt, defaults to "Can you touch this device"
:type touch_prompt: str
:param command: Command executed after user is authenticated, defaults to "exit 0"
:type command: str
:param auth_method: Authentication method, defaults to PasskeyAuthenticationUseCases.PASSKEY_WITH_PIN
:type auth_method: PasskeyAuthenticationUseCases
:return: Tuple containing [return code, command code, stdout, stderr].
:rtype: Tuple[int, int, str, str]
"""
Expand All @@ -368,6 +387,17 @@ def passkey_with_output(
ioctl_path = self.fs.upload_to_tmp(ioctl, mode="a=r")
script_path = self.fs.upload_to_tmp(script, mode="a=r")

match auth_method:
case (PasskeyAuthenticationUseCases.PASSKEY_WITH_PIN,
PasskeyAuthenticationUseCases.PASSKEY_WITH_PIN_AND_PROMPTS):
if pin is None:
raise ValueError(f"PIN is required for {str(auth_method)}")
case (PasskeyAuthenticationUseCases.PASSKEY_WITHOUT_PIN,
PasskeyAuthenticationUseCases.PASSKEY_FALLBACK_TO_PASSWORD,
PasskeyAuthenticationUseCases.PASSKEY_WITHOUT_PIN_WITHOUT_PROMPTS):
if pin is not None:
raise ValueError(f"PIN is not required for {str(auth_method)}")

run_su = self.fs.mktmp(
rf"""
#!/bin/bash
Expand All @@ -385,7 +415,6 @@ def passkey_with_output(
""",
mode="a=rx",
)

playback_umockdev = self.fs.mktmp(
rf"""
#!/bin/bash
Expand Down Expand Up @@ -422,33 +451,73 @@ def passkey_with_output(
set timeout {DEFAULT_AUTHENTICATION_TIMEOUT}
set prompt "\n.*\[#\$>\] $"
set command "{command}"
set auth_method "{auth_method}"
spawn "{playback_umockdev}"
expect {{
"Insert your passkey device, then press ENTER*" {{send -- "\n"}}
timeout {{exitmsg "Unexpected output" 201}}
eof {{exitmsg "Unexpected end of file" 202}}
# If the authentication method set without entering the PIN, it will directly ask
# prompt, if we set prompting options in sssd.conf it will ask interactive and touch prompt.
if {{ ($auth_method eq "{PasskeyAuthenticationUseCases.PASSKEY_WITHOUT_PIN_WITHOUT_PROMPTS}")
|| ($auth_method eq "{PasskeyAuthenticationUseCases.PASSKEY_WITHOUT_PIN_WITH_PROMPTS}") }} {{
expect {{
"{interactive_prompt}*" {{ send -- "\n" }}
timeout {{exitmsg "Unexpected output" 201 }}
eof {{exitmsg "Unexpected end of file" 202 }}
}}
# If prompt options are set
if {{ ($auth_method eq "{PasskeyAuthenticationUseCases.PASSKEY_WITHOUT_PIN_WITH_PROMPTS}") }} {{
expect {{
"{touch_prompt}*" {{ send -- "\n" }}
timeout {{exitmsg "Unexpected output" 201 }}
eof {{exitmsg "Unexpected end of file" 202 }}
}}
}}
}}
expect {{
"Enter PIN:*" {{send -- "{pin}\r"}}
timeout {{exitmsg "Unexpected output" 201}}
eof {{exitmsg "Unexpected end of file" 202}}
# If authentication method set with PIN, after interactive prompt always ask to Enter the PIN.
# If PIN is correct with prompt options in sssd.conf it will ask interactive and touch prompt.
# If we press Enter key for PIN, sssd will fallback to next auth method, here it will ask
# for Password.
if {{ ($auth_method eq "{PasskeyAuthenticationUseCases.PASSKEY_WITH_PIN}")
|| ($auth_method eq "{PasskeyAuthenticationUseCases.PASSKEY_WITH_PIN_AND_PROMPTS}")
|| ($auth_method eq "{PasskeyAuthenticationUseCases.PASSKEY_FALLBACK_TO_PASSWORD}")}} {{
expect {{
"{interactive_prompt}*" {{ send -- "\n" }}
timeout {{exitmsg "Unexpected output" 201 }}
eof {{exitmsg "Unexpected end of file" 202 }}
}}
expect {{
"Enter PIN:*" {{send -- "{pin}\r"}}
timeout {{exitmsg "Unexpected output" 201}}
eof {{exitmsg "Unexpected end of file" 202}}
}}
if {{ ($auth_method eq "{PasskeyAuthenticationUseCases.PASSKEY_FALLBACK_TO_PASSWORD}") }} {{
expect {{
"Password:*" {{send -- "Secret123\r"}}
timeout {{exitmsg "Unexpected output" 201}}
eof {{exitmsg "Unexpected end of file" 202}}
}}
}}
if {{ ($auth_method eq "{PasskeyAuthenticationUseCases.PASSKEY_WITH_PIN_AND_PROMPTS}") }} {{
expect {{
"{touch_prompt}*" {{ send -- "\n" }}
timeout {{exitmsg "Unexpected output" 201 }}
eof {{exitmsg "Unexpected end of file" 202 }}
}}
}}
}}
expect {{
"Authentication failure" {{exitmsg "Authentication failure" 1}}
eof {{exitmsg "Password authentication successful" 0}}
timeout {{exitmsg "Unexpected output" 201}}
}}
exitmsg "Unexpected code path" 203
""",
verbose=False,
)

self.fs.restore("/usr/libexec/sssd/passkey_child")

if result.rc > 200:
Expand All @@ -464,9 +533,7 @@ def passkey_with_output(

return result.rc, cmdrc, stdout, result.stderr

def passkey(
self, username: str, *, pin: str | int, device: str, ioctl: str, script: str, command: str = "exit 0"
) -> bool:
def passkey(self, username: str, *, device: str, ioctl: str, script: str, pin: str | int | None = None, command: str = "exit 0") -> bool:
"""
Call ``su - $username`` and authenticate the user with passkey.
Expand Down

0 comments on commit ea96500

Please sign in to comment.