[ CDM-243 ] [ CDM-245 ] Orcid Provider MFA Support & Token response `mfaAuthenticated` key #471

dauglyon · 2025-07-15T17:56:59Z

Adds MFA boolean to RemoteIdentity and StoredToken classes, which get stored in Mongo. Adds JWT parsing to extract the AMR claim from the Orcid login token during login. Modifies the token to include MFA status.

A nice summary of all the changes from claude:

Key Changes

Core Implementation:

Added mfa field to StoredToken (stored as mfa in MongoDB)
Extended RemoteIdentityDetails to capture MFA status from identity providers
Updated APIToken to expose MFA status via /api/V2/token endpoint

ORCID Provider Enhancement:

Changed scope from /authenticate to openid to receive JWT ID tokens
Parse Authentication Method Reference (AMR) claim to detect MFA usage
Set mfa=USED when AMR contains "mfa"

Authentication Flow:

OAuth login: MFA status determined from identity provider and stored on LOGIN token
Password login: MFA status set to uknown (not applicable)
Agent/Dev/Service tokens: MFA status set to uknown (no authentication context)

API Response

The /api/V2/token endpoint now returns mfa with tri-state semantics:

USED: User authenticated with MFA during token creation (e.g. Orcid with MFA)
NOT_USED: User explicitly chose not to use MFA when available (e.g. Orcid without MFA)
UNKNOWN: MFA status unknown or not applicable to authentication method (e.g. Google (mfa inspection not supported), or a dev token)

Database Schema

Tokens collection: Added mfa field
Users collection: Added mfa field to identity objects

…; add MFA tests

dauglyon · 2025-07-15T17:59:27Z

src/main/java/us/kbase/auth2/lib/identity/RemoteIdentityDetails.java


 	@Override
 	public int hashCode() {
 		final int prime = 31;
 		int result = 1;
 		result = prime * result + ((email == null) ? 0 : email.hashCode());
 		result = prime * result + ((fullname == null) ? 0 : fullname.hashCode());
+		result = prime * result + ((mfaAuthenticated == null) ? 0 : mfaAuthenticated.hashCode());


Not sure this is right, as it is a boolean.

(though it seems to be working)

src/main/java/us/kbase/auth2/providers/OrcIDIdentityProviderFactory.java

src/main/java/us/kbase/auth2/service/api/MfaStatus.java

…p code

Update tests to handle MFA field additions and ORCID OpenID Connect changes: - Fix hash codes in RemoteIdentityTest for new MFA field - Update ORCID provider tests for openid scope instead of /authenticate - Add mfaAuthenticated field to API response expectations - Fix non-ORCID provider test to use null MFA status - Update identity ordering in user endpoint tests

codecov · 2025-07-16T02:57:53Z

Codecov Report

Attention: Patch coverage is 97.53086% with 2 lines in your changes missing coverage. Please review.

Project coverage is 93.40%. Comparing base (47f6a01) to head (3d9e93e).

Additional details and impacted files

@@              Coverage Diff              @@
##             develop     #471      +/-   ##
=============================================
+ Coverage      93.37%   93.40%   +0.03%     
- Complexity      2151     2168      +17     
=============================================
  Files            126      126              
  Lines           7558     7623      +65     
  Branches        1184     1202      +18     
=============================================
+ Hits            7057     7120      +63     
  Misses           458      458              
- Partials          43       45       +2

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Move MFA status from being computed from user identities to being stored as a boolean field on tokens themselves. This provides per-token MFA tracking and eliminates the need for complex identity lookups.

src/main/java/us/kbase/auth2/providers/OrcIDIdentityProviderFactory.java

dauglyon · 2025-07-17T23:28:18Z

src/test/java/us/kbase/test/auth2/service/api/UserEndpointTest.java

Seems to be some stochasticity in these tests, as I had to change the order. I haven't identified a change I made that would cause this directly. Seen in src/test/resources/us/kbase/test/auth2/service/ui/MeTest_getMeMaximalInput.testdata, src/test/java/us/kbase/test/auth2/service/ui/MeTest.java, src/test/java/us/kbase/test/auth2/service/api/UserEndpointTest.java

MrCreosote

I haven't looked at tests yet as this review is already pretty huge

RELEASE_NOTES.md

src/main/java/us/kbase/auth2/lib/Authentication.java

MrCreosote · 2025-07-18T19:24:21Z

src/main/java/us/kbase/auth2/providers/OrcIDIdentityProviderFactory.java

+			 */
+			private Boolean parseAmrClaim(final String idToken) {
+				if (idToken == null || idToken.trim().isEmpty()) {
+					return null;


If the token is expected this should throw an error

This was throwing in tests, but I think fixed those tests, so I bet I can remove this check now

I'm going to keep this check so we don't get runtime errors if ORCID fails to return a JWT, but I am going to log that as happening. The user will see their MFA status as unknown, but the flow won't fail. If the JWT is malformed, however, I am going to throw.

Unless there's a documented reason oid wouldn't return a token when we've asked for one, this should fail IMO. Don't code for circumstances that can't happen, just fail

The circumstance would be "they change our oAuth scope access" (eg decide to remove our member API access) which can happen without any change on our end. Trying to be a bit defensive. Seems we shouldn't prevent all orcid logins in that case. But if we're ok with that, I can throw here too

ALSO if we throw here, all auth2 deploys will REQUIRE orcid member api access

Ok. How about a 4th enum value for this case to distinguish it from the provider doesn't support it at all?

Actually - does changing the scope mean that other auth installs will fail if they don't have member api access?

I'm going to actually have to double check the api on this; it looks like the docs say conflicting things (you need member api to see the jwt claims, but that the openid scope is available on the public api and it's only purpose is to return the jwt) or it's possible it will return two completely different jwts depending on scope or api access... anyway I will check

src/main/java/us/kbase/auth2/providers/OrcIDIdentityProviderFactory.java

src/main/java/us/kbase/auth2/lib/identity/RemoteIdentityDetails.java

src/main/java/us/kbase/auth2/service/api/Token.java

src/main/java/us/kbase/auth2/service/api/APIToken.java

Add openid role and mfa parsing to Orcid provider; support MFA status…

e78616e

…; add MFA tests

dauglyon commented Jul 15, 2025

View reviewed changes

src/main/java/us/kbase/auth2/providers/OrcIDIdentityProviderFactory.java Show resolved Hide resolved

dauglyon commented Jul 15, 2025

View reviewed changes

src/main/java/us/kbase/auth2/service/api/MfaStatus.java Outdated Show resolved Hide resolved

dauglyon assigned dauglyon and unassigned dauglyon Jul 15, 2025

This comment has been minimized.

Sign in to view

dauglyon added 4 commits July 15, 2025 12:05

move MFA status to token endpoint; remove mfaStatus endpoint; clean u…

984fdb2

…p code

fix build errors

e23c5dd

reorder expected html for test

99f0573

dauglyon added 6 commits July 15, 2025 20:23

Improve test coverage; improve error handling

748c8a2

fix exception errors

589d52a

Update ORCID provider tests to use MockServer

099ca8d

remove duplicate tests

4cbf2ec

fix TokenEndpointTest.getToken

ef094fd

fix TokenEndpointTest.getToken

ac606a5

dauglyon marked this pull request as ready for review July 17, 2025 17:17

dauglyon changed the title ~~MFA Support~~ Orcid Provider MFA Support & Token response mfaAuthenticated key Jul 17, 2025

dauglyon changed the title ~~Orcid Provider MFA Support & Token response mfaAuthenticated key~~ [ CDM-243 ] [ CDM-245 ] Orcid Provider MFA Support & Token response mfaAuthenticated key Jul 17, 2025

dauglyon added 2 commits July 17, 2025 12:31

Store MFA authentication status directly on tokens

9dfc0a7

Move MFA status from being computed from user identities to being stored as a boolean field on tokens themselves. This provides per-token MFA tracking and eliminates the need for complex identity lookups.

update tests

53ed176

dauglyon commented Jul 17, 2025

View reviewed changes

src/main/java/us/kbase/auth2/providers/OrcIDIdentityProviderFactory.java Outdated Show resolved Hide resolved

fix tests

ae74a21

dauglyon force-pushed the MFAStatus branch from 202a9b8 to ae74a21 Compare July 17, 2025 21:46

dauglyon added 2 commits July 17, 2025 15:17

slightly better documentation

935f193

update token field name

7bbf759

dauglyon force-pushed the MFAStatus branch from 1f38446 to ff8e201 Compare July 17, 2025 22:57

consolidate test logic

3d9e93e

dauglyon force-pushed the MFAStatus branch 2 times, most recently from 52f871c to 3d9e93e Compare July 17, 2025 23:25

dauglyon commented Jul 17, 2025

View reviewed changes

dauglyon mentioned this pull request Jul 18, 2025

Add MFA status indicators to login sessions kbase/ui#250

Open

MrCreosote reviewed Jul 18, 2025

View reviewed changes

dauglyon added 8 commits July 18, 2025 13:49

Change mfa value to enum, from boolean

8d85ad9

rename all uses MfaAuthenticated -> mfa

2db7814

fix tests

328704c

rename all uses MfaAuthenticated -> mfa

90ce1af

rename jwt field for clarity

58a2aec

fix tests, equalities

c766704

throw errors for jwt parsing issues

37d2ef6

add check for null/missing AMR claim, fix tests

62d6066

dauglyon force-pushed the MFAStatus branch from 591dbbb to 62d6066 Compare July 18, 2025 23:12

[ CDM-243 ] [ CDM-245 ] Orcid Provider MFA Support & Token response mfaAuthenticated key #471

Are you sure you want to change the base?

[ CDM-243 ] [ CDM-245 ] Orcid Provider MFA Support & Token response mfaAuthenticated key #471

Uh oh!

Conversation

dauglyon commented Jul 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

This comment has been minimized.

codecov bot commented Jul 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MrCreosote left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dauglyon Jul 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

[ CDM-243 ] [ CDM-245 ] Orcid Provider MFA Support & Token response `mfaAuthenticated` key #471

[ CDM-243 ] [ CDM-245 ] Orcid Provider MFA Support & Token response `mfaAuthenticated` key #471

dauglyon commented Jul 15, 2025 •

edited

Loading

codecov bot commented Jul 16, 2025 •

edited

Loading

dauglyon Jul 18, 2025 •

edited

Loading