-
-
Notifications
You must be signed in to change notification settings - Fork 98
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
MFA AADSTS50076 error handling #101
Conversation
Codecov Report
@@ Coverage Diff @@
## master #101 +/- ##
==========================================
- Coverage 82.69% 82.05% -0.65%
==========================================
Files 7 8 +1
Lines 416 429 +13
==========================================
+ Hits 344 352 +8
- Misses 72 77 +5
Continue to review full report at Codecov.
|
I'm back in business. Thanks for figuring this out. About this piece of code
What happens if you always send it? E.g. instead of adding a view it would remove complexity if including those query param fixes it in all situations. |
Welcome back! I’m not 100% sure, I think it would force login to MFA even if the server is in a trusted location. Maybe it could be a setting, but with some good docs. |
I'm interested in this PR. Anything I can help with? |
@peterfarrell I don’t have an azure environment set up at the moment, so if you’re able to check what @jobec is asking, that would be nice. I’m currently coding on a few other projects on my spare time, so haven’t had time to look into this one in a while, unfortunately. Tests also need to be written if you want to help out with that. I’ll also try to prioritize this a bit more in the weekend. |
@JonasKs I don't have an Azure setup but onsite ADFS. When I add |
Ok. Did you ever experience this error with your setup in ADFS? Which ADFS version in that case? |
ADFS 4.0, but I haven't seen this error directly, but surmise it might come up. |
Hmm, maybe. Are you able to reproduce the steps above to check? I feel like the error you get from ADFS when appending the parameters either means you don’t have MFA on your account, or that ADFS don’t work the same way as Azure AD. |
@JonasKs The error I found in the ADFS backend was:
So I guess adding that option to all request will fail if that authentication method is not listed for the configured relying party trust. |
Alright, yeah, that makes sense. You will never get |
MFA AADSTS50076 error handling
My collegue encountered the issue explained in #67 today so I offered to look into the problem. This is my proposed solution.
This is what happens:
POST
request (inbackend.py
) withauthorization_code
towards Azure AD.authorization code
, as it was not acquired with MFA.MFA can be forced by setting
amr_values
tongcmfa
. Docs on this can be found here.In other words, this PoC contains:
backend.py
will raise aMFARequired
if the error starts with the codeAADSTS50076
which again is handled in the view, forcing a new MFA log in if that happens. In other words, a second log in is required, this time with MFA.If this is approved, let me know and I'll expand the tests and docs. I've confirmed it works on our set up.
Manual testing (for those with the issue) can be done by installing my branch:
pip install git+https://github.com/JonasKs/django-auth-adfs.git@mfa_poc
.