authentik.stages.authenticator_validate.models

  1"""Authenticator Validation Stage"""
  2
  3from django.contrib.postgres.fields.array import ArrayField
  4from django.db import models
  5from django.utils.translation import gettext_lazy as _
  6from django.views import View
  7from rest_framework.serializers import BaseSerializer
  8
  9from authentik.flows.models import NotConfiguredAction, Stage
 10from authentik.lib.utils.time import timedelta_string_validator
 11from authentik.stages.authenticator_webauthn.models import UserVerification, WebAuthnHint
 12
 13
 14class DeviceClasses(models.TextChoices):
 15    """Device classes this stage can validate"""
 16
 17    # device class must match Device's class name so StaticDevice -> static
 18    STATIC = "static", _("Static")
 19    TOTP = "totp", _("TOTP")
 20    WEBAUTHN = "webauthn", _("WebAuthn")
 21    DUO = "duo", _("Duo")
 22    SMS = "sms", _("SMS")
 23    EMAIL = "email", _("Email")
 24
 25
 26def default_device_classes() -> list:
 27    """By default, accept all device classes"""
 28    return [
 29        DeviceClasses.STATIC,
 30        DeviceClasses.TOTP,
 31        DeviceClasses.WEBAUTHN,
 32        DeviceClasses.DUO,
 33        DeviceClasses.SMS,
 34        DeviceClasses.EMAIL,
 35    ]
 36
 37
 38class AuthenticatorValidateStage(Stage):
 39    """Validate user's configured Multi Factor Authentication."""
 40
 41    not_configured_action = models.TextField(
 42        choices=NotConfiguredAction.choices, default=NotConfiguredAction.SKIP
 43    )
 44
 45    configuration_stages = models.ManyToManyField(
 46        Stage,
 47        blank=True,
 48        default=None,
 49        related_name="+",
 50        help_text=_(
 51            "Stages used to configure Authenticator when user doesn't have any compatible "
 52            "devices. After this configuration Stage passes, the user is not prompted again."
 53        ),
 54    )
 55
 56    device_classes = ArrayField(
 57        models.TextField(choices=DeviceClasses.choices),
 58        help_text=_("Device classes which can be used to authenticate"),
 59        default=default_device_classes,
 60    )
 61
 62    last_auth_threshold = models.TextField(
 63        default="seconds=0",
 64        validators=[timedelta_string_validator],
 65        help_text=_(
 66            "If any of the user's device has been used within this threshold, this "
 67            "stage will be skipped"
 68        ),
 69    )
 70
 71    webauthn_user_verification = models.TextField(
 72        help_text=_("Enforce user verification for WebAuthn devices."),
 73        choices=UserVerification.choices,
 74        default=UserVerification.PREFERRED,
 75    )
 76    webauthn_hints = ArrayField(
 77        models.TextField(choices=WebAuthnHint.choices),
 78        default=list,
 79        blank=True,
 80    )
 81    webauthn_allowed_device_types = models.ManyToManyField(
 82        "authentik_stages_authenticator_webauthn.WebAuthnDeviceType", blank=True
 83    )
 84
 85    @property
 86    def serializer(self) -> type[BaseSerializer]:
 87        from authentik.stages.authenticator_validate.api import AuthenticatorValidateStageSerializer
 88
 89        return AuthenticatorValidateStageSerializer
 90
 91    @property
 92    def view(self) -> type[View]:
 93        from authentik.stages.authenticator_validate.stage import AuthenticatorValidateStageView
 94
 95        return AuthenticatorValidateStageView
 96
 97    @property
 98    def component(self) -> str:
 99        return "ak-stage-authenticator-validate-form"
100
101    class Meta:
102        verbose_name = _("Authenticator Validation Stage")
103        verbose_name_plural = _("Authenticator Validation Stages")