* Include Member Decryption Type
* Make ICurrentContext protected from base class
* Return MemberDecryptionType
* Extend WebApplicationFactoryBase
- Allow for service subsitution
* Create SSO Tests
- Mock IAuthorizationCodeStore so the SSO process can be limited to Identity
* Add MemberDecryptionOptions
* Remove Unused Property Assertion
* Make MemberDecryptionOptions an Array
* Address PR Feedback
* Make HasAdminApproval Policy Aware
* Format
* Use Object Instead
* Add UserDecryptionOptions File
* [EC-787] Add new stored procedure OrganizationUser_ReadByUserIdWithPolicyDetails
* [EC-787] Add new method IOrganizationUserRepository.GetByUserIdWithPolicyDetailsAsync
* [EC-787] Add OrganizationUserPolicyDetails to represent policies applicable to a specific user
* [EC-787] Add method IPolicyService.GetPoliciesApplicableToUser to filter the obtained policy data
* [EC-787] Returning PolicyData on stored procedures
* [EC-787] Changed GetPoliciesApplicableToUserAsync to return ICollection
* [EC-787] Switched all usings of IPolicyRepository.GetManyByTypeApplicableToUserIdAsync to IPolicyService.GetPoliciesApplicableToUserAsync
* [EC-787] Removed policy logic from BaseRequestValidator and added usage of IPolicyService.GetPoliciesApplicableToUserAsync
* [EC-787] Added unit tests for IPolicyService.GetPoliciesApplicableToUserAsync
* [EC-787] Added unit tests for OrganizationUserRepository.GetByUserIdWithPolicyDetailsAsync
* [EC-787] Changed integration test to check for single result
* [EC-787] Marked IPolicyRepository methods GetManyByTypeApplicableToUserIdAsync and GetCountByTypeApplicableToUserIdAsync as obsolete
* [EC-787] Returning OrganizationUserId on OrganizationUser_ReadByUserIdWithPolicyDetails
* [EC-787] Remove deprecated stored procedures Policy_CountByTypeApplicableToUser, Policy_ReadByTypeApplicableToUser and function PolicyApplicableToUser
* [EC-787] Added method IPolicyService.AnyPoliciesApplicableToUserAsync
* [EC-787] Removed 'OrganizationUserType' parameter from queries
* [EC-787] Formatted OrganizationUserPolicyDetailsCompare
* [EC-787] Renamed SQL migration files
* [EC-787] Changed OrganizationUser_ReadByUserIdWithPolicyDetails to return Permissions json
* [EC-787] Refactored excluded user types for each Policy
* [EC-787] Updated dates on dbo_future files
* [EC-787] Remove dbo_future files from sql proj
* [EC-787] Added parameter PolicyType to IOrganizationUserRepository.GetByUserIdWithPolicyDetailsAsync
* [EC-787] Rewrote OrganizationUser_ReadByUserIdWithPolicyDetails and added parameter for PolicyType
* Update util/Migrator/DbScripts/2023-03-10_00_OrganizationUserReadByUserIdWithPolicyDetails.sql
Co-authored-by: Thomas Rittson <31796059+eliykat@users.noreply.github.com>
---------
Co-authored-by: Thomas Rittson <31796059+eliykat@users.noreply.github.com>
* PM-1196 - Created first draft solution for solving SSO with Email 2FA serverside. Per architectural review discussion, will be replacing OTP use with expiring tokenable implementation in order to decouple the OTP implementation from the need for an auth factor when arriving on the email 2FA screen post SSO.
* PM-1196 - Refactored OTP solution to leverage newly created SsoEmail2faSessionTokenable. Working now but some code cleanup required. Might revisit whether or not we still send down email alongside the token or not to make the SendEmailLoginAsync method more streamlined.
* PM-1196 - Send down email separately on token rejection b/c of 2FA required so that 2FA Controller send email login can be refactored to be much cleaner with email required.
* PM-1196 - Fix lint issues w/ dotnet format.
* PM-1196 - More formatting issue fixes.
* PM-1196 - Remove unnecessary check as email is required again on TwoFactorEmailRequestModel
* PM-1196 - Update SsoEmail2faSessionTokenable to expire after just over 2 min to match client side auth service expiration of 2 min with small buffer.
* PM-1196 - Fix lint issue w/ dotnet format.
* PM-1196 - Per PR feedback, move CustomTokenRequestValidator constructor param to new line
* PM-1196 - Per PR feedback, update ThrowDelayedBadRequestExceptionAsync to return a task so that it can be awaited and so that the calling code can handle any exceptions that occur during its execution
* PM-1196 - Per PR feedback, refactor SsoEmail2faSessionTokenable to leverage TimeSpan vs double for token expiration lifetime.
* [EC-1070] Add API endpoint to retrieve all policies for the current user
The additional API endpoint is required to avoid forcing a full sync call before every login for master password policy enforcement on login.
* [EC-1070] Add MasterPasswordPolicyData model
* [EC-1070] Move PolicyResponseModel to Core project
The response model is used by both the Identity and Api projects.
* [EC-1070] Supply master password polices as a custom identity token response
* [EC-1070] Include master password policies in 2FA token response
* [EC-1070] Add response model to verify-password endpoint that includes master password policies
* [AC-1070] Introduce MasterPasswordPolicyResponseModel
* [AC-1070] Add policy service method to retrieve a user's master password policy
* [AC-1070] User new policy service method
- Update BaseRequestValidator
- Update AccountsController for /verify-password endpoint
- Update VerifyMasterPasswordResponseModel to accept MasterPasswordPolicyData
* [AC-1070] Cleanup new policy service method
- Use User object instead of Guid
- Remove TODO message
- Use `PolicyRepository.GetManyByTypeApplicableToUserIdAsync` instead of filtering locally
* [AC-1070] Cleanup MasterPasswordPolicy models
- Remove default values from both models
- Add missing `RequireLower`
- Fix mismatched properties in `CombineWith` method
- Make properties nullable in response model
* [AC-1070] Remove now un-used GET /policies endpoint
* [AC-1070] Update policy service method to use GetManyByUserIdAsync
* [AC-1070] Ensure existing value is not null before comparison
* [AC-1070] Remove redundant VerifyMasterPasswordResponse model
* [AC-1070] Fix service typo in constructor
* Add KdfMemory and KDFParallelism fields
* Revise argon2 support
This pull request makes the new attribues for argon2, kdfMemory and
kdfParallelism optional. Furthermore it adds checks for the argon2
parametrs and improves the database migration script.
* Add validation for argon2 in RegisterRequestModel
* update validation messages
* update sql scripts
* register data protection with migration factories
* add ef migrations
* update kdf option validation
* adjust validation
* Centralize and Test KDF Validation
Co-authored-by: Kyle Spearrin <kspearrin@users.noreply.github.com>
Co-authored-by: Kyle Spearrin <kyle.spearrin@gmail.com>
Co-authored-by: Justin Baur <19896123+justindbaur@users.noreply.github.com>
* [EC-758] Add environment variable GlobalSettings.Sso.EnforceSsoPolicyForAllUsers to enforce SSO Policy for all users
* [EC-758] Add integration tests
* [EC-758] Add Entities namespace to resolve ambiguous reference
* [EC-758] dotnet format
* [EC-758] Updated integration tests to check for logins with all user types
* [EC-758] Create new TestServer for each test
* [EC-758] Combine unit tests and refactor to use BitAutoData
* Revert "Set Id property on existing devices so we don't try to create a new one instead of updating existing. (#2420)"
This reverts commit 02e4b10ae8.
* Revert "Update push token on login to allow multiple users on mobile devices (#2404)"
This reverts commit 24469e2267.
* Added back test changes.
* Changed query for device to include userId
(cherry picked from commit 5e3f6db64b)
* Refactored push registration to allow notification on multiple clients
(cherry picked from commit 75d299ae269eeb8ac272c96458815a359ea6d085)
* Linting
(cherry picked from commit f1cf54ebef2019743834f667861f9b34c1661e11)
* Fixed compile error.
* Removed class that I created when refactoring.
* Removed references to PushNotification from DeviceService tests.
* Refactored to not pass back a result on Save
* Refactored to send requestDevice to push notifications.
* Fixed whitespace.
* Added missing Noop services.
(cherry picked from commit bdad6cfadaf2779c2e672027122c95ea64e3cf0b)
* Linting.
* Refactored to put the push token back in SaveAsync.
* Removed constructor parameter.
* Added back in ClearTokenAsync to reduce risk.
* Updated tab for linting.
