edumfa 2.0.3__tar.gz → 2.2.0__tar.gz

{edumfa-2.0.3/edumfa.egg-info → edumfa-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: edumfa
-Version: 2.0.3
+Version: 2.2.0
 Summary: eduMFA: identity, multifactor authentication (OTP), authorization, audit
 Home-page: https://www.edumfa.io
 Author: edumfa.io
@@ -24,58 +24,59 @@ Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.8
 License-File: LICENSE
 License-File: AUTHORS.md
-Requires-Dist: Flask-Babel>=4.0.0
-Requires-Dist: Flask-Migrate>=3.2.0
-Requires-Dist: Flask-SQLAlchemy>=3.0.5
-Requires-Dist: Flask-Versioned>=0.9.4
-Requires-Dist: Flask>=3.0.3
-Requires-Dist: PyJWT>=2.8.0
-Requires-Dist: PyMySQL>=1.1.1
-Requires-Dist: PyYAML>=6.0.1
-Requires-Dist: SQLAlchemy>=1.4.52
-Requires-Dist: argon2_cffi>=23.1.0
-Requires-Dist: beautifulsoup4[lxml]>=4.12.3
-Requires-Dist: cbor2>=5.6.3
-Requires-Dist: configobj>=5.0.6
-Requires-Dist: croniter>=2.0.5
-Requires-Dist: cryptography>=42.0.7
-Requires-Dist: defusedxml>=0.7.1
-Requires-Dist: google-auth>=1.23.0
-Requires-Dist: grpcio>=1.62.1
-Requires-Dist: huey[redis]>=2.5.0
-Requires-Dist: importlib_metadata>=6.11.0
-Requires-Dist: ldap3>=2.9.1
-Requires-Dist: lxml>=5.0.0
-Requires-Dist: netaddr>=0.10.1
-Requires-Dist: passlib[bcrypt]>=1.7.0
-Requires-Dist: pyOpenSSL>=24
-Requires-Dist: pydash>=8.0.1
-Requires-Dist: pyrad>=2.0
-Requires-Dist: python-dateutil>=2.7.3
-Requires-Dist: python-gnupg>=0.5.2
-Requires-Dist: requests>=2.32.2
-Requires-Dist: segno>=1.6.1
-Requires-Dist: smpplib>=2.2.3
-Requires-Dist: typing-extensions>=4.6.0
-Requires-Dist: urllib3>=2.2.1
+Requires-Dist: Flask-Babel==4.0.0
+Requires-Dist: Flask-Migrate==4.0.7
+Requires-Dist: Flask-SQLAlchemy==3.1.1
+Requires-Dist: Flask-Versioned==0.9.4-20101221
+Requires-Dist: Flask==3.0.3
+Requires-Dist: PyJWT==2.8.0
+Requires-Dist: PyMySQL==1.1.1
+Requires-Dist: PyYAML==6.0.1
+Requires-Dist: SQLAlchemy==2.0.31
+Requires-Dist: argon2_cffi==23.1.0
+Requires-Dist: beautifulsoup4[lxml]==4.12.3
+Requires-Dist: cbor2==5.6.4
+Requires-Dist: configobj==5.0.8
+Requires-Dist: croniter==2.0.7
+Requires-Dist: cryptography==42.0.8
+Requires-Dist: defusedxml==0.7.1
+Requires-Dist: google-auth==2.32.0
+Requires-Dist: grpcio==1.64.1
+Requires-Dist: huey[redis]==2.5.1
+Requires-Dist: importlib_metadata==8.0.0
+Requires-Dist: ldap3==2.9.1
+Requires-Dist: lxml==5.2.2
+Requires-Dist: netaddr==1.3.0
+Requires-Dist: passlib[bcrypt]==1.7.4
+Requires-Dist: pyOpenSSL==24.1.0
+Requires-Dist: pydash==8.0.1
+Requires-Dist: pyrad==2.4
+Requires-Dist: python-dateutil==2.9.0.post0
+Requires-Dist: python-gnupg==0.5.2
+Requires-Dist: requests==2.32.3
+Requires-Dist: segno==1.6.1
+Requires-Dist: smpplib==2.2.3
+Requires-Dist: typing-extensions==4.12.2
+Requires-Dist: pyasn1==0.6.0
+Requires-Dist: urllib3==2.2.2
 Provides-Extra: doc
-Requires-Dist: Pallets-Sphinx-Themes>=1.2.3; extra == "doc"
-Requires-Dist: Sphinx>=1.3.1; extra == "doc"
-Requires-Dist: sphinxcontrib-httpdomain>=1.3.0; extra == "doc"
-Requires-Dist: sphinxcontrib-plantuml>=0.18; extra == "doc"
-Requires-Dist: sphinxcontrib-spelling>=7.0.0; extra == "doc"
+Requires-Dist: Pallets-Sphinx-Themes==2.1.3; extra == "doc"
+Requires-Dist: Sphinx==7.4.5; extra == "doc"
+Requires-Dist: sphinxcontrib-httpdomain==1.8.1; extra == "doc"
+Requires-Dist: sphinxcontrib-plantuml==0.30; extra == "doc"
+Requires-Dist: sphinxcontrib-spelling==8.0.0; extra == "doc"
 Provides-Extra: test
-Requires-Dist: mock>=2.0.0; extra == "test"
-Requires-Dist: pytest>=3.6.0; extra == "test"
-Requires-Dist: pytest-cov>=2.5.1; extra == "test"
-Requires-Dist: responses>=0.9.0; extra == "test"
-Requires-Dist: testfixtures>=6.14.2; extra == "test"
+Requires-Dist: mock==5.1.0; extra == "test"
+Requires-Dist: pytest==8.2.2; extra == "test"
+Requires-Dist: pytest-cov==5.0.0; extra == "test"
+Requires-Dist: responses==0.25.3; extra == "test"
+Requires-Dist: testfixtures==8.3.0; extra == "test"
 Provides-Extra: postgres
-Requires-Dist: psycopg2>=2.9.9; extra == "postgres"
+Requires-Dist: psycopg2==2.9.9; extra == "postgres"
 Provides-Extra: hsm
-Requires-Dist: PyKCS11>=1.5.10; extra == "hsm"
+Requires-Dist: PyKCS11==1.5.16; extra == "hsm"
 Provides-Extra: kerberos
-Requires-Dist: gssapi>=1.7.0; extra == "kerberos"
+Requires-Dist: gssapi==1.8.3; extra == "kerberos"
 
 eduMFA
 ===========

{edumfa-2.0.3/tests/testdata → edumfa-2.2.0/deploy/edumfa}/dictionary

@@ -5,6 +5,9 @@
 #
 #	$Id$
 #
+# M-A has to be first item as pyrad uses an OrderedDict
+# and CVE-2024-3596
+ATTRIBUTE   Message-Authenticator   80  string
 ATTRIBUTE	User-Name				1	string
 ATTRIBUTE	User-Password				2	string encrypt=1
 ATTRIBUTE	CHAP-Password				3	octets

{edumfa-2.0.3 → edumfa-2.2.0}/deploy/ubuntu/changelog

@@ -1,3 +1,57 @@
+edumfa (2.2.0{{CODENAME}}) {{CODENAME}}; urgency=medium
+ 
+  * chore(deps): update dependency google-auth to v2.32.0
+  * chore(deps): update dependency sphinx to v7.4.0
+  * chore(deps): update dependency setuptools to v70 [security]
+  * chore(deps): update dependency setuptools to v70.3.0
+  * chore(deps): update dependency croniter to v2.0.7 
+  * chore(deps): update dependency cachetools to v5.4.0 
+  * chore(deps): update dependency sphinx to v7.4.5
+  * RADIUS: add support to enforce Message-Authenticator
+
+ -- eduMFA <edumfa-dev@listserv.dfn.de>  Wed, 17 Jul 2024 08:00:00 +0200
+
+edumfa (2.1.0{{CODENAME}}) {{CODENAME}}; urgency=medium
+
+  * fix: corrected typo in e-mail address
+  * feat: handle passkey AuthenticatorDataFlags 
+  * feat: ignore event handler in case of passkey auth
+  * feat: add edumfa-push token type
+  * chore(deps): update dependency pytest to v8
+  * chore(deps): update dependency redis to v5
+  * chore(deps): update dependency zipp to v3.19.0
+  * chore(deps): update dependency mako to v1.3.5
+  * chore(deps): update dependency lxml to v5.2.2
+  * chore(deps): update dependency pykcs11 to v1.5.16
+  * chore(deps): update dependency flask-sqlalchemy to v3.1.1
+  * chore(deps): update dependency cryptography to v42.0.8
+  * chore(deps): update dependency cbor2 to v5.6.4
+  * chore(deps): update dependency pytest to v8.2.2
+  * chore(deps): update dependency redis to v5.0.5
+  * chore(deps): update dependency grpcio to v1.64.1
+  * chore(deps): update dependency huey to v2.5.1
+  * chore(deps): update dependency requests to v2.32.3
+  * chore: test dependencies
+  * chore(deps): update dependency urllib3 to v2.2.2 [security]
+  * chore(deps): update docker/build-push-action action to v6
+  * chore(deps): update dependency zipp to v3.19.2
+  * chore(deps): update dependency certifi to v2024.6.2
+  * chore(deps): update dependency packaging to v24.1
+  * chore(deps): update dependency netaddr to v1
+  * chore(deps): update dependency pyasn1 to v0.6.0
+  * chore(deps): update dependency alembic to v1.13.2
+  * chore(deps): update dependency sqlalchemy to v2.0.31
+  * chore(deps): update dependency redis to v5.0.7
+  * chore(deps): update dependency google-auth to v2.30.0
+  * chore(deps): update dependency typing-extensions to v4.12.2
+  * chore(deps): update dependency importlib-metadata to v8
+  * chore(deps): update dependency gssapi to v1.8.3
+  * chore(deps): pin dependencies
+  * chore(deps): update dependency google-auth to v2.31.0
+  * chore(deps): update dependency certifi to v2024.7.4
+
+ -- eduMFA <edumfa-dev@listserv.dfn.de>  Fri, 05 Jul 2024 12:01:00 +0200
+
 edumfa (2.0.3{{CODENAME}}) {{CODENAME}}; urgency=medium
 
   * fix: redirect filename arg for policy creation 

{edumfa-2.0.3 → edumfa-2.2.0}/deploy/ubuntu-server/changelog

@@ -1,3 +1,15 @@
+edumfa-server (2.2.0{{CODENAME}}) {{CODENAME}}; urgency=medium
+ 
+  * update version number
+
+ -- eduMFA <edumfa-dev@listserv.dfn.de>  Wed, 17 Jul 2024 08:00:00 +0200
+
+edumfa-server (2.1.0{{CODENAME}}) {{CODENAME}}; urgency=medium
+ 
+  * update version number
+
+ -- eduMFA <edumfa-dev@listserv.dfn.de>  Fri, 05 Jul 2024 12:01:00 +0200
+
 edumfa-server (2.0.3{{CODENAME}}) {{CODENAME}}; urgency=medium
  
   * update version number

{edumfa-2.0.3 → edumfa-2.2.0}/doc/conf.py

@@ -23,7 +23,7 @@ import functools
 # built documents.
 #
 # The short X.Y version.
-version = '2.0.3'
+version = '2.2.0'
 # The full version, including alpha/beta/rc tags.
 #release = '2.16dev5'
 release = version

edumfa-2.2.0/edumfa/api/lib/policyhelper.py

@@ -0,0 +1,198 @@
+# -*- coding: utf-8 -*-
+#
+# License:  AGPLv3
+# This file is part of eduMFA. eduMFA is a fork of privacyIDEA which was forked from LinOTP.
+# Copyright (c) 2024 eduMFA Project-Team
+# Previous authors by privacyIDEA project:
+#
+# 2023 Cornelius Kölbel <cornelius@privacyidea.org>
+#
+# This code is free software; you can redistribute it and/or
+# modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
+# License as published by the Free Software Foundation; either
+# version 3 of the License, or any later version.
+#
+# This code is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU AFFERO GENERAL PUBLIC LICENSE for more details.
+#
+# You should have received a copy of the GNU Affero General Public
+# License along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+"""
+These are logical policy functions that are usually used in policy API decorators, but
+in some cases also used beside the API.
+Like policies, that are supposed to read and pass parameters during enrollment of a token.
+"""
+
+import logging
+from edumfa.lib.log import log_with
+from edumfa.lib.policy import Match, SCOPE, ACTION
+from edumfa.lib.error import PolicyError
+from edumfa.lib.tokens.webauthntoken import WEBAUTHNACTION
+
+log = logging.getLogger(__name__)
+
+
+@log_with(log)
+def get_init_tokenlabel_parameters(g, params=None, token_type="hotp", user_object=None):
+    """
+    This helper function modifies the request parameters in regards
+    to enrollment policies tokenlabel, tokenissuer, appimage, force_app_pin
+
+    :param params: The request parameter
+    :param user_object: User object in the request
+    :return: modified request parameters
+    """
+    params = params or {}
+    label_pols = Match.user(g, scope=SCOPE.ENROLL, action=ACTION.TOKENLABEL,
+                            user_object=user_object).action_values(unique=True, allow_white_space_in_action=True)
+    if len(label_pols) == 1:
+        # The policy was set, so we need to set the tokenlabel in the request.
+        params[ACTION.TOKENLABEL] = list(label_pols)[0]
+
+    label_pols = Match.user(g, scope=SCOPE.ENROLL, action=WEBAUTHNACTION.TOKENLABEL,
+                            user_object=user_object).action_values(unique=True, allow_white_space_in_action=True)
+    if len(label_pols) == 1:
+        # The policy was set, so we need to set the tokenlabel in the request.
+        params[WEBAUTHNACTION.TOKENLABEL] = list(label_pols)[0]
+
+    issuer_pols = Match.user(g, scope=SCOPE.ENROLL, action=ACTION.TOKENISSUER,
+                             user_object=user_object).action_values(unique=True, allow_white_space_in_action=True)
+    if len(issuer_pols) == 1:
+        params[ACTION.TOKENISSUER] = list(issuer_pols)[0]
+
+    imageurl_pols = Match.user(g, scope=SCOPE.ENROLL, action=ACTION.APPIMAGEURL,
+                               user_object=user_object).action_values(unique=True, allow_white_space_in_action=True)
+    if len(imageurl_pols) == 1:
+        params[ACTION.APPIMAGEURL] = list(imageurl_pols)[0]
+
+    # check the force_app_pin policy
+    app_pin_pols = Match.user(g, scope=SCOPE.ENROLL,
+                              action='{0!s}_{1!s}'.format(token_type, ACTION.FORCE_APP_PIN),
+                              user_object=user_object).any()
+    if app_pin_pols:
+        params[ACTION.FORCE_APP_PIN] = True
+
+    return params
+
+
+def get_pushtoken_add_config(g, params=None, user_obj=None):
+    """
+    This helper function modifies the request parameters in regards
+    to enrollment policies for push tokens.
+
+    :param params: The request parameter
+    :param user_object: User object in the request
+    :return: modified request parameters
+    """
+    params = params or {}
+    from edumfa.lib.tokens.pushtoken import PushTokenClass
+
+    # Get the firebase configuration from the policies
+    firebase_config = Match.user(
+        g,
+        scope=SCOPE.ENROLL,
+        action=PushTokenClass.PUSH_ACTION.FIREBASE_CONFIG,
+        user_object=user_obj if user_obj else None,
+    ).action_values(unique=True, allow_white_space_in_action=True)
+    if len(firebase_config) == 1:
+        params[PushTokenClass.PUSH_ACTION.FIREBASE_CONFIG] = list(firebase_config)[0]
+    else:
+        raise PolicyError(f"Missing enrollment policy for push token: {PushTokenClass.PUSH_ACTION.FIREBASE_CONFIG!s}")
+
+    # Get the sslverify definition from the policies
+    ssl_verify = Match.user(
+        g,
+        scope=SCOPE.ENROLL,
+        action=PushTokenClass.PUSH_ACTION.SSL_VERIFY,
+        user_object=user_obj if user_obj else None,
+    ).action_values(unique=True)
+    if len(ssl_verify) == 1:
+        params[PushTokenClass.PUSH_ACTION.SSL_VERIFY] = list(ssl_verify)[0]
+    else:
+        params[PushTokenClass.PUSH_ACTION.SSL_VERIFY] = "1"
+
+    # Get the TTL and the registration URL from the policies
+    registration_url = Match.user(
+        g,
+        scope=SCOPE.ENROLL,
+        action=PushTokenClass.PUSH_ACTION.REGISTRATION_URL,
+        user_object=user_obj if user_obj else None,
+    ).action_values(unique=True, allow_white_space_in_action=True)
+    if len(registration_url) == 1:
+        params[PushTokenClass.PUSH_ACTION.REGISTRATION_URL] = list(registration_url)[0]
+    else:
+        raise PolicyError(f"Missing enrollment policy for push token: {PushTokenClass.PUSH_ACTION.REGISTRATION_URL!s}")
+    ttl = Match.user(
+        g,
+        scope=SCOPE.ENROLL,
+        action=PushTokenClass.PUSH_ACTION.TTL,
+        user_object=user_obj if user_obj else None,
+    ).action_values(unique=True, allow_white_space_in_action=True)
+    if len(ttl) == 1:
+        params[PushTokenClass.PUSH_ACTION.TTL] = list(ttl)[0]
+    else:
+        params[PushTokenClass.PUSH_ACTION.TTL] = "10"
+    return params
+
+
+def get_legacypushtoken_add_config(g, params=None, user_obj=None):
+    """
+    This helper function modifies the request parameters in regards
+    to enrollment policies for push tokens.
+
+    :param params: The request parameter
+    :param user_object: User object in the request
+    :return: modified request parameters
+    """
+    params = params or {}
+    from edumfa.lib.tokens.legacypushtoken import LegacyPushTokenClass
+
+    # Get the firebase configuration from the policies
+    firebase_config = Match.user(
+        g,
+        scope=SCOPE.ENROLL,
+        action=LegacyPushTokenClass.PUSH_ACTION.FIREBASE_CONFIG,
+        user_object=user_obj if user_obj else None,
+    ).action_values(unique=True, allow_white_space_in_action=True)
+    if len(firebase_config) == 1:
+        params[LegacyPushTokenClass.PUSH_ACTION.FIREBASE_CONFIG] = list(firebase_config)[0]
+    else:
+        raise PolicyError(f"Missing enrollment policy for push token: {LegacyPushTokenClass.PUSH_ACTION.FIREBASE_CONFIG!s}")
+
+    # Get the sslverify definition from the policies
+    ssl_verify = Match.user(
+        g,
+        scope=SCOPE.ENROLL,
+        action=LegacyPushTokenClass.PUSH_ACTION.SSL_VERIFY,
+        user_object=user_obj if user_obj else None,
+    ).action_values(unique=True)
+    if len(ssl_verify) == 1:
+        params[LegacyPushTokenClass.PUSH_ACTION.SSL_VERIFY] = list(ssl_verify)[0]
+    else:
+        params[LegacyPushTokenClass.PUSH_ACTION.SSL_VERIFY] = "1"
+
+    # Get the TTL and the registration URL from the policies
+    registration_url = Match.user(
+        g,
+        scope=SCOPE.ENROLL,
+        action=LegacyPushTokenClass.PUSH_ACTION.REGISTRATION_URL,
+        user_object=user_obj if user_obj else None,
+    ).action_values(unique=True, allow_white_space_in_action=True)
+    if len(registration_url) == 1:
+        params[LegacyPushTokenClass.PUSH_ACTION.REGISTRATION_URL] = list(registration_url)[0]
+    else:
+        raise PolicyError(f"Missing enrollment policy for push token: {LegacyPushTokenClass.PUSH_ACTION.REGISTRATION_URL!s}")
+    ttl = Match.user(
+        g,
+        scope=SCOPE.ENROLL,
+        action=LegacyPushTokenClass.PUSH_ACTION.TTL,
+        user_object=user_obj if user_obj else None,
+    ).action_values(unique=True, allow_white_space_in_action=True)
+    if len(ttl) == 1:
+        params[LegacyPushTokenClass.PUSH_ACTION.TTL] = list(ttl)[0]
+    else:
+        params[LegacyPushTokenClass.PUSH_ACTION.TTL] = "10"
+    return params

{edumfa-2.0.3 → edumfa-2.2.0}/edumfa/api/lib/prepolicy.py

@@ -40,6 +40,7 @@ from edumfa.lib.error import PolicyError, RegistrationError, TokenAdminError, Re
 from flask import g, current_app
 from edumfa.lib.policy import SCOPE, ACTION, REMOTE_USER
 from edumfa.lib.policy import Match, check_pin
+from edumfa.lib.tokens.legacypushtoken import LegacyPushTokenClass
 from edumfa.lib.user import (get_user_from_param, get_default_realm,
                                   split_user, User)
 from edumfa.lib.token import (get_tokens, get_realms_of_token, get_token_type, get_token_owner)
@@ -49,7 +50,11 @@ from edumfa.lib.utils import (parse_timedelta, is_true, generate_charlists_from_
 from edumfa.lib.crypto import generate_password
 from edumfa.lib.auth import ROLE
 from edumfa.api.lib.utils import getParam, attestation_certificate_allowed, is_fqdn
-from edumfa.api.lib.policyhelper import get_init_tokenlabel_parameters, get_pushtoken_add_config
+from edumfa.api.lib.policyhelper import (
+    get_init_tokenlabel_parameters,
+    get_pushtoken_add_config,
+    get_legacypushtoken_add_config,
+)
 from edumfa.lib.clientapplication import save_clientapplication
 from edumfa.lib.config import (get_token_class)
 from edumfa.lib.tokenclass import ROLLOUTSTATE
@@ -81,7 +86,7 @@ from edumfa.lib.tokens.webauthntoken import (WEBAUTHNACTION,
                                                   is_webauthn_assertion_response)
 from edumfa.lib.tokens.u2ftoken import (U2FACTION, parse_registration_data)
 from edumfa.lib.tokens.u2f import x509name_to_string
-from edumfa.lib.tokens.pushtoken import PUSH_ACTION
+from edumfa.lib.tokens.pushtoken import PushTokenClass
 from edumfa.lib.tokens.indexedsecrettoken import PIIXACTION
 
 log = logging.getLogger(__name__)
@@ -1437,7 +1442,8 @@ def pushtoken_disable_wait(request, action):
     :param action:
     :return:
     """
-    request.all_data[PUSH_ACTION.WAIT] = False
+    request.all_data[PushTokenClass.PUSH_ACTION.WAIT] = False
+    request.all_data[LegacyPushTokenClass.PUSH_ACTION.WAIT] = False
 
 
 def pushtoken_wait(request, action):
@@ -1450,14 +1456,37 @@ def pushtoken_wait(request, action):
     :return:
     """
     user_object = request.User
-    waiting = Match.user(g, scope=SCOPE.AUTH, action=PUSH_ACTION.WAIT,
-                         user_object=user_object if user_object else None)\
-        .action_values(unique=True, allow_white_space_in_action=True)
+    waiting = Match.user(
+        g,
+        scope=SCOPE.AUTH,
+        action=PushTokenClass.PUSH_ACTION.WAIT,
+        user_object=user_object if user_object else None,
+    ).action_values(unique=True, allow_white_space_in_action=True)
     if len(waiting) >= 1:
-        request.all_data[PUSH_ACTION.WAIT] = int(list(waiting)[0])
+        request.all_data[PushTokenClass.PUSH_ACTION.WAIT] = int(list(waiting)[0])
     else:
-        request.all_data[PUSH_ACTION.WAIT] = False
+        request.all_data[PushTokenClass.PUSH_ACTION.WAIT] = False
 
+def legacypushtoken_wait(request, action):
+    """
+    This is a auth specific wrapper to decorate /validate/check
+    According to the policy scope=SCOPE.AUTH, action=push_wait
+
+    :param request:
+    :param action:
+    :return:
+    """
+    user_object = request.User
+    waiting = Match.user(
+        g,
+        scope=SCOPE.AUTH,
+        action=LegacyPushTokenClass.PUSH_ACTION.WAIT,
+        user_object=user_object if user_object else None,
+    ).action_values(unique=True, allow_white_space_in_action=True)
+    if len(waiting) >= 1:
+        request.all_data[LegacyPushTokenClass.PUSH_ACTION.WAIT] = int(list(waiting)[0])
+    else:
+        request.all_data[LegacyPushTokenClass.PUSH_ACTION.WAIT] = False
 
 def pushtoken_add_config(request, action):
     """
@@ -1471,8 +1500,10 @@ def pushtoken_add_config(request, action):
     :return:
     """
     ttype = request.all_data.get("type")
-    if ttype and ttype.lower() == "push":
+    if ttype and ttype.lower() == "edupush":
         request.all_data = get_pushtoken_add_config(g, request.all_data, request.User)
+    elif ttype and ttype.lower() == "push":
+        request.all_data = get_legacypushtoken_add_config(g, request.all_data, request.User)
 
 
 def u2ftoken_verify_cert(request, action):

{edumfa-2.0.3 → edumfa-2.2.0}/edumfa/api/radiusserver.py

@@ -66,13 +66,14 @@ def create(identifier=None):
     secret = getParam(param, "secret", required)
     retries = int(getParam(param, "retries", default=3))
     timeout = int(getParam(param, "timeout", default=5))
+    enforce_ma = bool(getParam(param, "enforce_ma", default=False))
     description = getParam(param, "description", default="")
     dictionary = getParam(param, "dictionary",
                           default="/etc/edumfa/dictionary")
 
     r = add_radius(identifier, server, secret, port=port,
                    description=description, dictionary=dictionary,
-                   retries=retries, timeout=timeout)
+                   retries=retries, timeout=timeout, enforce_ma=enforce_ma)
 
     g.audit_object.log({'success': r > 0,
                         'info':  r})
@@ -125,13 +126,15 @@ def test():
     secret = getParam(param, "secret", required)
     retries = int(getParam(param, "retries", default=3))
     timeout = int(getParam(param, "timeout", default=5))
+    enforce_ma = bool(getParam(param, "enforce_ma", default=False))
     user = getParam(param, "username", required)
     password = getParam(param, "password", required)
     dictionary = getParam(param, "dictionary",
                           default="/etc/edumfa/dictionary")
 
     r = test_radius(identifier, server, secret, user, password, port=port,
-                    dictionary=dictionary, retries=retries, timeout=timeout)
+                    dictionary=dictionary, retries=retries, timeout=timeout,
+                    enforce_ma=enforce_ma)
     g.audit_object.log({'success': r > 0,
                         'info':  r})
     return send_result(r > 0)

{edumfa-2.0.3 → edumfa-2.2.0}/edumfa/api/validate.py

@@ -74,7 +74,7 @@ from edumfa.api.lib.prepolicy import (prepolicy, set_realm,
                                            save_client_application_type,
                                            check_base_action, pushtoken_wait, webauthntoken_auth, webauthntoken_authz,
                                            webauthntoken_request, check_application_tokentype,
-                                           increase_failcounter_on_challenge)
+                                           increase_failcounter_on_challenge, legacypushtoken_wait)
 from edumfa.api.lib.postpolicy import (postpolicy,
                                             check_tokentype, check_serial,
                                             check_tokeninfo,
@@ -205,6 +205,7 @@ def offlinerefill():
 @add_serial_from_response_to_g
 @prepolicy(check_application_tokentype, request=request)
 @prepolicy(pushtoken_wait, request=request)
+@prepolicy(legacypushtoken_wait, request=request)
 @prepolicy(set_realm, request=request)
 @prepolicy(mangle, request=request)
 @prepolicy(increase_failcounter_on_challenge, request=request)

{edumfa-2.0.3 → edumfa-2.2.0}/edumfa/lib/config.py

@@ -738,6 +738,7 @@ def get_token_list():
     module_list.add("edumfa.lib.tokens.vascotoken")
     module_list.add("edumfa.lib.tokens.tantoken")
     module_list.add("edumfa.lib.tokens.pushtoken")
+    module_list.add("edumfa.lib.tokens.legacypushtoken")
     module_list.add("edumfa.lib.tokens.indexedsecrettoken")
     module_list.add("edumfa.lib.tokens.webauthntoken")
 

{edumfa-2.0.3 → edumfa-2.2.0}/edumfa/lib/eventhandler/tokenhandler.py

@@ -32,6 +32,8 @@ You can attach token actions like enable, disable, delete, unassign,... of the
  * all disabled tokens
  * ...
 """
+
+from edumfa.api.lib.utils import getParam
 from edumfa.lib.eventhandler.base import BaseEventHandler
 from edumfa.lib.machine import attach_token
 from edumfa.lib.token import (get_token_types, set_validity_period_end,
@@ -564,7 +566,7 @@ class TokenEventHandler(BaseEventHandler):
                                         " Token serial: {!0s}".format(serial))
 
 
-            else:
+            elif not getParam(request.all_data, "webauthn_usernameless_authn"):
                 log.info("Action {0!s} requires serial number. But no serial "
                          "number could be found in request {1!s}.".format(action, request))