Support one-time authorization code for form-based authentication mechanism #46974

michalvavrik · 2025-03-24T23:21:01Z

Implements non-JDBC part of the Enhance Form authentication to support one-time tokens #45977.

github-actions · 2025-03-25T00:02:02Z

🎊 PR Preview 0061772 has been successfully built and deployed to https://quarkus-pr-main-46974-preview.surge.sh/version/main/guides/

Images of blog posts older than 3 months are not available.
Newsletters older than 3 months are not available.

michalvavrik · 2025-03-25T09:12:25Z

Update: Windows failure seems like a bug (though don't see how it is related to changes here), I'll find it and fix it.

michalvavrik · 2025-03-25T11:16:33Z

Oh, it is failing because during merging I removed the fix I introduced to Quarkus main branch already, my bad, I'll drop it.

sberyozkin · 2025-03-25T11:38:06Z

Thanks @michalvavrik, I'll look a bit later.

michalvavrik · 2025-03-25T11:52:52Z

Thanks @michalvavrik, I'll look a bit later.

Thanks as well, no hurry, I expect this will take a longer discussion. But I think it is easier this way because it is less code to review and once this is in, JDBC part will be easy.

docs/src/main/asciidoc/security-authentication-mechanisms.adoc

...spi/src/main/java/io/quarkus/security/spi/runtime/OneTimeAuthZCodeAuthenticationRequest.java

...ns/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/FormAuthRuntimeConfig.java

sberyozkin · 2025-03-25T17:50:17Z

@michalvavrik Thanks, I've started commenting and we can continue in the next few days, I suggest to set it Draft for now as I guess there will be a few more iterations

michalvavrik · 2025-03-26T12:18:10Z

As the PR is draft now, I'll be pushing changes continuously. I'll inform you with a PR comment once the PR is adapted to what we agreed in here and via email. Please ignore pushes until then.

michalvavrik · 2025-04-02T23:32:58Z

@sberyozkin your turn :-)

sberyozkin · 2025-04-26T15:38:45Z

docs/src/main/asciidoc/security-authentication-mechanisms.adoc

+[source,properties]
+----
+quarkus.http.auth.form.authentication-token.enabled=true
+quarkus.http.auth.form.authentication-token.request-redirect-path=/authentication-token-form <1>


This path can be made a default value, quarkus.http.auth.form.authentication-token.enabled=true should be enough for such a case. Also propose to shorten the property to authentication-token.redirect-path

sberyozkin · 2025-04-26T15:46:58Z

...ime/src/main/java/io/quarkus/vertx/http/security/token/OneTimeAuthenticationTokenSender.java

+ * This interface should be implemented as {@link jakarta.enterprise.context.ApplicationScoped}
+ * or {@link jakarta.inject.Singleton} CDI bean.
+ */
+public interface OneTimeAuthenticationTokenSender {


Would it be correct to name it FormAuthenticationTokenSender, with the one-time aspect highlighted in the docs ? Form authentication is the only built in mechanism that this interface can work with

sberyozkin · 2025-04-26T15:48:43Z

...ime/src/main/java/io/quarkus/vertx/http/runtime/security/OneTimeAuthTokenRequestHandler.java

+import io.smallrye.mutiny.Uni;
+import io.vertx.ext.web.RoutingContext;
+
+final class OneTimeAuthTokenRequestHandler {


Suggested change

final class OneTimeAuthTokenRequestHandler {

final class FormAuthenticationTokenRequestHandler {

or, FormAuthenticationTokenHandler

sberyozkin · 2025-04-26T15:53:17Z

...tp/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/FormAuthenticationEvent.java

+        /**
+         * Event fired when Quarkus received one-time authentication token request.
+         */
+        ONE_TIME_AUTH_TOKEN_REQUESTED


I propose to propose to replace ONE_TIME (and lower cases onetime) everywhere with Form (using the right case), in this case it might be AUTHENTICATION_TOKEN (since it in the FormEventType), not sure _REQUESTED is necessary

sberyozkin · 2025-04-26T16:10:45Z

Hi @michalvavrik, apologies for delaying reviewing it.

IMHO, it indeed looks better with the cookie.

I have a question, as it is not quite obvious to me from the PR.

At what point do you create a session cookie in the PR ? If it is created before the user has to submit the token back to Quarkus, then it is problematic, because the user is already having a session cookie, without completing 2-factor, and can probably cancel the form and just access some secured endpoint path.

This may already be done this way, please clarify, but the way I imagine it should is as follows, if Form 2FA is enabled:

Redirect the user with the one time token cookie to the token submission form
Once the user token submission has been confirmed, remove the token cookie, create the session cookie

Do you agree ? Sorry if it is how it is already implemented

Thanks

MichalMaler · 2025-05-14T14:05:48Z

docs/src/main/asciidoc/security-authentication-mechanisms.adoc

+[[two-factor-auth]]
+==== Two-factor authentication
+
+The form-based authentication mechanism supports two-factor authentication (2FA) with a one-time authentication token second-factor option.


Suggested change

The form-based authentication mechanism supports two-factor authentication (2FA) with a one-time authentication token second-factor option.

The form-based authentication mechanism supports two-factor authentication (2FA) with a one-time authentication token as a second-factor option.

MichalMaler · 2025-05-14T14:07:17Z

docs/src/main/asciidoc/security-authentication-mechanisms.adoc

+----
+<1> Once the one-time authentication token has been generated, redirect to a page with an authentication token form.
+
+When user submit a username and password to the `/j_security_check` POST location, they will get relocated to the `/authentication-token-form` page.


Suggested change

When user submit a username and password to the `/j_security_check` POST location, they will get relocated to the `/authentication-token-form` page.

After users post their username and password to `/j_security_check`, they are redirected to `/authentication-token-form`.

MichalMaler · 2025-05-14T14:30:14Z

docs/src/main/asciidoc/security-authentication-mechanisms.adoc

+
+The form-based authentication mechanism supports two-factor authentication (2FA) with a one-time authentication token second-factor option.
+
+.Enable two-factor authentication


Suggested change

.Enable two-factor authentication

* To enable 2FA, set the following properties:

+

MichalMaler · 2025-05-14T14:33:42Z

docs/src/main/asciidoc/security-authentication-mechanisms.adoc

+quarkus.http.auth.form.authentication-token.enabled=true
+quarkus.http.auth.form.authentication-token.request-redirect-path=/authentication-token-form <1>
+----
+<1> Once the one-time authentication token has been generated, redirect to a page with an authentication token form.


Suggested change

<1> Once the one-time authentication token has been generated, redirect to a page with an authentication token form.

<1> After generating the one-time authentication token, redirect to the authentication token form.

Hello Michal! Not sure if we need to use the <1> here. If not, I would just use the "+" above that sentence to glue and align it to that snippet above, and we should be good. It's a way to describe the aftermath of our earlier actions.

MichalMaler · 2025-05-14T14:48:40Z

docs/src/main/asciidoc/security-authentication-mechanisms.adoc

+<1> Once the one-time authentication token has been generated, redirect to a page with an authentication token form.
+
+When user submit a username and password to the `/j_security_check` POST location, they will get relocated to the `/authentication-token-form` page.
+The `/authentication-token-form` page should allow users to submit the one-time authentication token sent to them.


Suggested change

The `/authentication-token-form` page should allow users to submit the one-time authentication token sent to them.

The `/authentication-token-form` page allows them to submit the one-time authentication token.

MichalMaler · 2025-05-14T14:51:35Z

docs/src/main/asciidoc/security-authentication-mechanisms.adoc

+When user submit a username and password to the `/j_security_check` POST location, they will get relocated to the `/authentication-token-form` page.
+The `/authentication-token-form` page should allow users to submit the one-time authentication token sent to them.
+
+.Example form for authentication with a one-time authentication token


Suggested change

.Example form for authentication with a one-time authentication token

.An example of an HTML form that submits a one-time authentication token

MichalMaler · 2025-05-14T14:52:29Z

docs/src/main/asciidoc/security-authentication-mechanisms.adoc

+
+Once Quarkus has generated the one-time authentication token, you need to deliver the token to a user by declaring a CDI bean that implements the `io.quarkus.vertx.http.security.token.OneTimeAuthenticationTokenSender` interface.
+
+.Example one-time authentication token sender


Suggested change

.Example one-time authentication token sender

.An example of a CDI bean that sends the one-time authentication token by email

MichalMaler · 2025-05-14T14:55:58Z

docs/src/main/asciidoc/security-authentication-mechanisms.adoc

+}
+----
+<1> Use the Quarkus Mailer extension to send the email with the authentication token.
+See the xref:mailer-reference.adoc[Quarkus Mailer Reference documentation] for more information about the mailer.


Suggested change

See the xref:mailer-reference.adoc[Quarkus Mailer Reference documentation] for more information about the mailer.

For more information about the mailer, see the xref:mailer-reference.adoc[Quarkus Mailer reference documentation].

MichalMaler · 2025-05-14T15:00:15Z

Hey, @michalvavrik ! I just spotted this awesome PR and provided a few suggestions. Use them if you like it, or feel free to tweak them or drop them completely :)
Kind regards, Michal

michalvavrik requested a review from sberyozkin March 24, 2025 23:21

quarkus-bot bot added area/docstyle issues related for manual docstyle review area/documentation area/security area/vertx labels Mar 24, 2025

This comment has been minimized.

Sign in to view

quarkus-bot bot added the triage/flaky-test label Mar 25, 2025

michalvavrik force-pushed the feature/form-auth-one-time-token branch from 7c7b6b6 to 6db6efa Compare March 25, 2025 11:51

This comment has been minimized.

Sign in to view

sberyozkin reviewed Mar 25, 2025

View reviewed changes

docs/src/main/asciidoc/security-authentication-mechanisms.adoc Outdated Show resolved Hide resolved

sberyozkin reviewed Mar 25, 2025

View reviewed changes

docs/src/main/asciidoc/security-authentication-mechanisms.adoc Outdated Show resolved Hide resolved

sberyozkin reviewed Mar 25, 2025

View reviewed changes

...spi/src/main/java/io/quarkus/security/spi/runtime/OneTimeAuthZCodeAuthenticationRequest.java Outdated Show resolved Hide resolved

sberyozkin reviewed Mar 25, 2025

View reviewed changes

...ns/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/FormAuthRuntimeConfig.java Outdated Show resolved Hide resolved

michalvavrik marked this pull request as draft March 25, 2025 17:51

michalvavrik force-pushed the feature/form-auth-one-time-token branch 2 times, most recently from fff3113 to dbfe323 Compare March 29, 2025 12:40

michalvavrik force-pushed the feature/form-auth-one-time-token branch from dbfe323 to c94c5f1 Compare April 2, 2025 23:31

michalvavrik requested a review from sberyozkin April 2, 2025 23:32

feat(security): enable 2fa for form-auth with one-time token

55cf344

michalvavrik force-pushed the feature/form-auth-one-time-token branch from c94c5f1 to 55cf344 Compare April 16, 2025 18:51

sberyozkin reviewed Apr 26, 2025

View reviewed changes

MichalMaler reviewed May 14, 2025

View reviewed changes

	final class OneTimeAuthTokenRequestHandler {
	final class FormAuthenticationTokenRequestHandler {

	The form-based authentication mechanism supports two-factor authentication (2FA) with a one-time authentication token second-factor option.
	The form-based authentication mechanism supports two-factor authentication (2FA) with a one-time authentication token as a second-factor option.

	When user submit a username and password to the `/j_security_check` POST location, they will get relocated to the `/authentication-token-form` page.
	After users post their username and password to `/j_security_check`, they are redirected to `/authentication-token-form`.


		The form-based authentication mechanism supports two-factor authentication (2FA) with a one-time authentication token second-factor option.

		.Enable two-factor authentication

	.Enable two-factor authentication
	* To enable 2FA, set the following properties:
	+

	<1> Once the one-time authentication token has been generated, redirect to a page with an authentication token form.
	<1> After generating the one-time authentication token, redirect to the authentication token form.

	The `/authentication-token-form` page should allow users to submit the one-time authentication token sent to them.
	The `/authentication-token-form` page allows them to submit the one-time authentication token.

	.Example form for authentication with a one-time authentication token
	.An example of an HTML form that submits a one-time authentication token


		Once Quarkus has generated the one-time authentication token, you need to deliver the token to a user by declaring a CDI bean that implements the `io.quarkus.vertx.http.security.token.OneTimeAuthenticationTokenSender` interface.

		.Example one-time authentication token sender

	.Example one-time authentication token sender
	.An example of a CDI bean that sends the one-time authentication token by email

	See the xref:mailer-reference.adoc[Quarkus Mailer Reference documentation] for more information about the mailer.
	For more information about the mailer, see the xref:mailer-reference.adoc[Quarkus Mailer reference documentation].

Support one-time authorization code for form-based authentication mechanism #46974

Are you sure you want to change the base?

Support one-time authorization code for form-based authentication mechanism #46974

Uh oh!

Conversation

michalvavrik commented Mar 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment has been minimized.

github-actions bot commented Mar 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment has been minimized.

michalvavrik commented Mar 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

michalvavrik commented Mar 25, 2025

Uh oh!

sberyozkin commented Mar 25, 2025

Uh oh!

michalvavrik commented Mar 25, 2025

Uh oh!

This comment has been minimized.

This comment has been minimized.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sberyozkin commented Mar 25, 2025

Uh oh!

michalvavrik commented Mar 26, 2025

Uh oh!

michalvavrik commented Apr 2, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sberyozkin Apr 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sberyozkin Apr 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sberyozkin commented Apr 26, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MichalMaler May 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MichalMaler commented May 14, 2025

Uh oh!

Uh oh!

michalvavrik commented Mar 24, 2025 •

edited

Loading

github-actions bot commented Mar 25, 2025 •

edited

Loading

michalvavrik commented Mar 25, 2025 •

edited

Loading

sberyozkin Apr 26, 2025 •

edited

Loading

sberyozkin Apr 26, 2025 •

edited

Loading

MichalMaler May 14, 2025 •

edited

Loading