or run

npx @tessl/cli init
Log in

Version

Tile

Overview

Evals

Files

docs

authentication-components.mdevent-resolution.mdindex.mdprovider-selection.mdwebflow-actions.mdwebflow-configuration.mdwebflow-utilities.md
tile.json

tessl/maven-org-apereo-cas--cas-server-core-webflow-mfa-api

Core API for multifactor authentication webflow configuration in Apereo CAS providing interfaces and base classes for MFA provider integration

Workspace
tessl
Visibility
Public
Created
Last updated
Describes
mavenpkg:maven/org.apereo.cas/cas-server-core-webflow-mfa-api@7.2.x

To install, run

npx @tessl/cli install tessl/maven-org-apereo-cas--cas-server-core-webflow-mfa-api@7.2.0

index.mddocs/

CAS Server Core Webflow MFA API

The CAS Server Core Webflow MFA API provides the foundational interfaces and base classes for integrating multifactor authentication (MFA) providers into the Apereo Central Authentication Service webflow. This module serves as the core framework for MFA webflow configuration, event resolution, and provider orchestration within CAS deployments.

Package Information

  • Package Name: cas-server-core-webflow-mfa-api
  • Package Type: maven
  • Language: Java 21
  • Group ID: org.apereo.cas
  • Installation: Include as Maven dependency in CAS modules

Core Imports

import org.apereo.cas.web.flow.configurer.AbstractCasMultifactorWebflowConfigurer;
import org.apereo.cas.web.flow.configurer.CasMultifactorWebflowConfigurer;
import org.apereo.cas.web.flow.util.MultifactorAuthenticationWebflowUtils;
import org.apereo.cas.web.flow.actions.AbstractMultifactorAuthenticationAction;

Basic Usage

// Extend base configurer to create custom MFA webflow
public class MyMfaWebflowConfigurer extends AbstractCasMultifactorWebflowConfigurer {
    
    public MyMfaWebflowConfigurer(
        FlowBuilderServices flowBuilderServices,
        FlowDefinitionRegistry flowDefinitionRegistry,
        ConfigurableApplicationContext applicationContext,
        CasConfigurationProperties casProperties,
        Optional<FlowDefinitionRegistry> mfaFlowDefinitionRegistry,
        List<CasMultifactorWebflowCustomizer> mfaFlowCustomizers) {
        super(flowBuilderServices, flowDefinitionRegistry, applicationContext, 
              casProperties, mfaFlowDefinitionRegistry, mfaFlowCustomizers);
    }
    
    @Override
    protected void doInitialize() {
        val loginFlow = getLoginFlow();
        registerMultifactorProviderAuthenticationWebflow(loginFlow, "myMfaProvider");
    }
}

// Create custom MFA action
public class MyMfaAction extends AbstractMultifactorAuthenticationAction<MyMfaProvider> {
    
    @Override
    protected Event doExecuteInternal(RequestContext context) {
        // Access resolved provider via this.provider field
        val principal = resolvePrincipal(
            WebUtils.getAuthentication(context).getPrincipal(), context);
        
        // Perform MFA-specific logic
        return success();
    }
}

Architecture

The CAS MFA Webflow API is organized into several key architectural layers:

  • Configuration Layer: Interfaces and base classes for webflow configuration (CasMultifactorWebflowConfigurer, AbstractCasMultifactorWebflowConfigurer)
  • Event Resolution Layer: Components that determine when and which MFA providers should be triggered during authentication flows
  • Action Layer: Webflow actions that execute MFA-specific logic during state transitions
  • Provider Selection Layer: Specialized components for handling scenarios with multiple available MFA providers
  • Utility Layer: Static utility methods for managing MFA-related data in webflow scopes

Capabilities

Webflow Configuration

Core interfaces and base classes for configuring MFA webflows and integrating MFA providers into the CAS authentication flow.

public interface CasMultifactorWebflowConfigurer {
    void registerMultifactorProviderAuthenticationWebflow(Flow flow, String subflowId, String providerId);
    default void registerMultifactorProviderAuthenticationWebflow(Flow flow, String providerId);
    int getOrder();
    List<FlowDefinitionRegistry> getMultifactorAuthenticationFlowDefinitionRegistries();
}

public abstract class AbstractCasMultifactorWebflowConfigurer extends AbstractCasWebflowConfigurer
    implements CasMultifactorWebflowConfigurer {
    
    public void registerMultifactorProviderAuthenticationWebflow(Flow flow, String subflowId, String providerId);
    public List<FlowDefinitionRegistry> getMultifactorAuthenticationFlowDefinitionRegistries();
    public int getOrder();
}

Webflow Configuration

Event Resolution

Components responsible for determining when MFA should be triggered and which providers should be used based on authentication context and policies.

public abstract class AbstractCasMultifactorAuthenticationWebflowEventResolver 
    extends AbstractCasWebflowEventResolver {
    
    protected AbstractCasMultifactorAuthenticationWebflowEventResolver(
        CasWebflowEventResolutionConfigurationContext webflowEventResolutionConfigurationContext);
}

public class RankedMultifactorAuthenticationProviderWebflowEventResolver 
    extends AbstractCasMultifactorAuthenticationWebflowEventResolver {
    
    public Set<Event> resolveInternal(RequestContext context);
    public Event resolveSingle(RequestContext context);
    public void addDelegate(CasWebflowEventResolver resolver);
    public void addDelegate(CasWebflowEventResolver resolver, int index);
}

Event Resolution

Webflow Actions

Action classes that execute during webflow state transitions to perform MFA-specific operations like availability checks, bypassing, and failure handling.

public abstract class AbstractMultifactorAuthenticationAction<T extends MultifactorAuthenticationProvider> 
    extends BaseCasWebflowAction {
    
    protected T provider;
    
    protected Principal resolvePrincipal(Principal principal, RequestContext requestContext);
    protected String getThrottledRequestKeyFor(Authentication authentication, RequestContext requestContext);
}

public class MultifactorAuthenticationAvailableAction 
    extends AbstractMultifactorAuthenticationAction<MultifactorAuthenticationProvider>;

public class MultifactorAuthenticationBypassAction 
    extends AbstractMultifactorAuthenticationAction<MultifactorAuthenticationProvider>;

Webflow Actions

Provider Selection

Specialized components for handling composite MFA scenarios where multiple providers are available and selection logic is required.

@FunctionalInterface
public interface MultifactorProviderSelectionCriteria {
    boolean shouldProceedWithMultifactorProviderSelection(RequestContext requestContext);
    static MultifactorProviderSelectionCriteria select();
}

public class MultifactorProviderSelectedAction extends BaseCasWebflowAction {
    public static final String PARAMETER_SELECTED_MFA_PROVIDER = "mfaProvider";
    
    protected Event doExecuteInternal(RequestContext requestContext);
    protected void rememberSelectedMultifactorAuthenticationProvider(RequestContext context, String providerId);
}

Provider Selection

Authentication Components

Core authentication and provider selection logic including selectors, resolvers, and transaction management components.

public abstract class BaseMultifactorAuthenticationProviderEventResolver 
    extends AbstractCasMultifactorAuthenticationWebflowEventResolver {
    
    protected RegisteredService resolveRegisteredServiceInRequestContext(RequestContext requestContext);
}

public class RankedMultifactorAuthenticationProviderSelector 
    implements MultifactorAuthenticationProviderSelector {
    
    public MultifactorAuthenticationProvider resolve(
        Collection<MultifactorAuthenticationProvider> providers,
        RegisteredService service,
        Principal principal);
}

Authentication Components

Webflow Utilities

Static utility methods for managing MFA-related data in webflow scopes, device registration, provider selection, and token management.

@UtilityClass
public class MultifactorAuthenticationWebflowUtils {
    
    // Provider management
    public static void putMultifactorAuthenticationProvider(RequestContext context, MultifactorAuthenticationProvider provider);
    public static String getMultifactorAuthenticationProvider(RequestContext context);
    public static void putResolvedMultifactorAuthenticationProviders(RequestContext context, Collection<MultifactorAuthenticationProvider> value);
    public static Collection<String> getResolvedMultifactorAuthenticationProviders(RequestContext context);
    
    // Device registration
    public static boolean isMultifactorDeviceRegistrationEnabled(RequestContext requestContext);
    public static void putMultifactorDeviceRegistrationEnabled(RequestContext requestContext, boolean enabled);
    
    // Provider selection
    public static void putSelectableMultifactorAuthenticationProviders(RequestContext requestContext, List<String> mfaProviders);
    public static List<String> getSelectableMultifactorAuthenticationProviders(RequestContext requestContext);
}

Webflow Utilities

Types

Core Types

// From CAS core authentication API
public interface MultifactorAuthenticationProvider {
    String getId();
    int getOrder();
    String getFriendlyName();
    boolean matches(String identifier);
    MultifactorAuthenticationFailureMode getFailureMode();
    String getFailureModeEvaluator();
    MultifactorAuthenticationBypassEvaluator getBypassEvaluator();
}

// From Spring Webflow
public interface RequestContext {
    FlowScope getFlowScope();
    ConversationScope getConversationScope();
    ViewScope getViewScope();
}

public interface Flow {
    String getId();
    StateDefinition getStartState();
    TransitionableState getTransitionableState(String stateId);
}