authentik.stages.authenticator_validate.models

  1"""Authenticator Validation Stage"""
  2
  3from django.contrib.postgres.fields.array import ArrayField
  4from django.db import models
  5from django.utils.translation import gettext_lazy as _
  6from django.views import View
  7from rest_framework.serializers import BaseSerializer
  8
  9from authentik.flows.models import NotConfiguredAction, Stage
 10from authentik.lib.utils.time import timedelta_string_validator
 11from authentik.stages.authenticator_webauthn.models import UserVerification, WebAuthnHint
 12
 13
 14class DeviceClasses(models.TextChoices):
 15    """Device classes this stage can validate"""
 16
 17    # device class must match Device's class name so StaticDevice -> static
 18    STATIC = "static", _("Static")
 19    TOTP = "totp", _("TOTP")
 20    WEBAUTHN = "webauthn", _("WebAuthn")
 21    DUO = "duo", _("Duo")
 22    SMS = "sms", _("SMS")
 23    EMAIL = "email", _("Email")
 24
 25    @staticmethod
 26    def from_model_label(model_label: str) -> DeviceClasses:
 27        return getattr(
 28            DeviceClasses, model_label.rsplit(".", maxsplit=1)[-1][: -len("device")].upper()
 29        )
 30
 31
 32def default_device_classes() -> list:
 33    """By default, accept all device classes"""
 34    return [
 35        DeviceClasses.STATIC,
 36        DeviceClasses.TOTP,
 37        DeviceClasses.WEBAUTHN,
 38        DeviceClasses.DUO,
 39        DeviceClasses.SMS,
 40        DeviceClasses.EMAIL,
 41    ]
 42
 43
 44class AuthenticatorValidateStage(Stage):
 45    """Validate user's configured Multi Factor Authentication."""
 46
 47    not_configured_action = models.TextField(
 48        choices=NotConfiguredAction.choices, default=NotConfiguredAction.SKIP
 49    )
 50
 51    configuration_stages = models.ManyToManyField(
 52        Stage,
 53        blank=True,
 54        default=None,
 55        related_name="+",
 56        help_text=_(
 57            "Stages used to configure Authenticator when user doesn't have any compatible "
 58            "devices. After this configuration Stage passes, the user is not prompted again."
 59        ),
 60    )
 61
 62    device_classes = ArrayField(
 63        models.TextField(choices=DeviceClasses.choices),
 64        help_text=_("Device classes which can be used to authenticate"),
 65        default=default_device_classes,
 66    )
 67
 68    last_auth_threshold = models.TextField(
 69        default="seconds=0",
 70        validators=[timedelta_string_validator],
 71        help_text=_(
 72            "If any of the user's device has been used within this threshold, this "
 73            "stage will be skipped"
 74        ),
 75    )
 76
 77    webauthn_user_verification = models.TextField(
 78        help_text=_("Enforce user verification for WebAuthn devices."),
 79        choices=UserVerification.choices,
 80        default=UserVerification.PREFERRED,
 81    )
 82    webauthn_hints = ArrayField(
 83        models.TextField(choices=WebAuthnHint.choices),
 84        default=list,
 85        blank=True,
 86    )
 87    webauthn_allowed_device_types = models.ManyToManyField(
 88        "authentik_stages_authenticator_webauthn.WebAuthnDeviceType", blank=True
 89    )
 90
 91    email_otp_throttling_factor = models.FloatField(default=1)
 92    sms_otp_throttling_factor = models.FloatField(default=1)
 93    totp_otp_throttling_factor = models.FloatField(default=1)
 94    static_otp_throttling_factor = models.FloatField(default=1)
 95
 96    @property
 97    def serializer(self) -> type[BaseSerializer]:
 98        from authentik.stages.authenticator_validate.api import AuthenticatorValidateStageSerializer
 99
100        return AuthenticatorValidateStageSerializer
101
102    @property
103    def view(self) -> type[View]:
104        from authentik.stages.authenticator_validate.stage import AuthenticatorValidateStageView
105
106        return AuthenticatorValidateStageView
107
108    @property
109    def component(self) -> str:
110        return "ak-stage-authenticator-validate-form"
111
112    def get_throttling_factor(self, device_class: DeviceClasses) -> float | None:
113        if device_class == DeviceClasses.EMAIL:
114            return self.email_otp_throttling_factor
115        elif device_class == DeviceClasses.SMS:
116            return self.sms_otp_throttling_factor
117        elif device_class == DeviceClasses.TOTP:
118            return self.totp_otp_throttling_factor
119        elif device_class == DeviceClasses.STATIC:
120            return self.static_otp_throttling_factor
121        return None
122
123    class Meta:
124        verbose_name = _("Authenticator Validation Stage")
125        verbose_name_plural = _("Authenticator Validation Stages")