Skip to content

Bug 2059948 - Do not offer recovery codes to Duo users #2723

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
loganrosen wants to merge 1 commit into
base: master
Choose a base branch
from
+51 −6
Open

Bug 2059948 - Do not offer recovery codes to Duo users #2723

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions docs/en/rst/using/two-factor-authentication.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,10 +188,10 @@ Do not store recovery codes with your password or on the device that provides
your second factor. If you are unsure whether your codes remain private,
generate and print a new set.

BMO recovery codes cannot replace a Duo verification, even though the 2FA
preferences page offers Duo users the recovery-code generator. Duo users should
configure more than one authentication method in Duo and contact `Mozilla
Service Desk`_ if none of those methods are available.
BMO does not offer its recovery-code generator for Duo accounts because BMO
recovery codes cannot replace a Duo verification. Duo users should configure
more than one authentication method in Duo and contact `Mozilla Service Desk`_
if none of those methods are available.

.. _two-factor-troubleshooting:

Expand Down
49 changes: 47 additions & 2 deletions qa/t/2_test_login_duo.t
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,18 +32,63 @@ $sel->title_is('User Preferences');
$sel->click_ok('mfa-select-duo');
$sel->type_ok('mfa-duo-user', $config->{admin_user_login});
$sel->type_ok('mfa-password', $config->{admin_user_passwd});
$sel->click_ok('update');
$sel->driver->find_element('//form[@name="userprefsform"]')->submit;
$sel->wait_for_page_to_load(WAIT_TIME);
$sel->click_ok('//a[contains(text(),"Redirect Back")]',
'Click Duo Security verification');
$sel->title_is('User Preferences');
$sel->is_text_present_ok(
'The changes to your two-factor authentication have been saved',
'Duo successfully enabled');

ok(
!$sel->is_element_present('mfa-recovery'),
'Recovery code generation is not offered for Duo'
);

# A forged recovery request must fail before opening the Duo prompt.
$sel->driver->execute_script(
q{document.getElementById('mfa-auth-container').style.display = 'block';}
);
$sel->type_ok('mfa-password', $config->{admin_user_passwd});
$sel->driver->execute_script(q{
const source = document.forms.userprefsform;
const form = document.createElement('form');
form.method = 'post';
form.action = source.action;

[
['tab', 'mfa'],
['token', source.elements.token.value],
['dosave', '1'],
['mfa_action', 'recovery'],
['mfa', 'TOTP'],
['password', source.elements.password.value],
].forEach(([name, value]) => {
const input = document.createElement('input');
input.type = 'hidden';
input.name = name;
input.value = value;
form.appendChild(input);
});

document.body.appendChild(form);
form.submit();
});
sleep(2);
$sel->wait_for_page_to_load(WAIT_TIME);
$sel->title_is('Duo Security Error');
$sel->is_text_present_ok(
'Recovery codes are not available when using Duo Security',
'Forged Duo recovery request rejected'
);

# Disable Duo for the admin user
$sel->open_ok('/userprefs.cgi?tab=mfa');
$sel->click_ok('mfa-disable');
$sel->type_ok('mfa-password', $config->{admin_user_passwd});
$sel->click_ok('update');
$sel->driver->find_element('//form[@name="userprefsform"]')->submit;
$sel->wait_for_page_to_load(WAIT_TIME);
$sel->click_ok('//a[contains(text(),"Redirect Back")]',
'Click Duo Security verification');
$sel->title_is('User Preferences');
Expand Down