将 Duo Web 2 因素身份验证与 ColdFusion 集成
Integrating Duo Web 2 Factor Authentication with ColdFusion
我正在尝试将 Duo Web 2FA 与我的 ColdFusion 应用程序集成。我的 Coldfusion 服务器是 Windows Server 2012 运行 Lucee 4.5.2.018 final。我遵循 GitHub 方法作为 described here。我收到以下错误消息，但我不知道这意味着什么或从哪里开始解决此问题：
invalid call of the function listGetAt, second Argument (posNumber) is
invalid, invalid string list index [2]
The error occurred in C:\inetpub\wwwroot\serviceticket\test.cfm: line 82
80: <cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, AKEY, USER)>
81:
82: <cfset valid_app_sig = ListGetAt(request_sig, 2, ":")>
83:
84:
这是我的测试页代码：
<!doctype html>
<html>
<head>
<meta charset="utf-8">
<title>2FA</title>
<script src="Scripts/Duo-Web-v2.js"></script>
<script src="Scripts/Duo-Web.js"></script>
</head>
<body>
<cfset IKEY = "DIGF6DVQMHS39JKMHTR3">
<cfset WRONG_IKEY = "DIXXXXXXXXXXXXXXXXXY">
<cfset SKEY = "HIDDEN">
<cfset AKEY = "8mIeduVeTBLqY0zcAKaCaZzhEXTZIPTQRstb0PYd">
<cfset USER = "testuser">
<!--- Dummy response signatures --->
<cfset INVALID_RESPONSE = "AUTH|INVALID|SIG">
<cfset EXPIRED_RESPONSE = "AUTH|dGVzdHVzZXJ8RElYWFhYWFhYWFhYWFhYWFhYWFh8MTMwMDE1Nzg3NA==|cb8f4d60ec7c261394cd5ee5a17e46ca7440d702">
<cfset FUTURE_RESPONSE = "AUTH|dGVzdHVzZXJ8RElYWFhYWFhYWFhYWFhYWFhYWFh8MTYxNTcyNzI0Mw==|d20ad0d1e62d84b00a3e74ec201a5917e77b6aef">
<cfset WRONG_PARAMS_RESPONSE = "AUTH|dGVzdHVzZXJ8RElYWFhYWFhYWFhYWFhYWFhYWFh8MTYxNTcyNzI0M3xpbnZhbGlkZXh0cmFkYXRh|6cdbec0fbfa0d3f335c76b0786a4a18eac6cdca7">
<cfset WRONG_PARAMS_APP = "APP|dGVzdHVzZXJ8RElYWFhYWFhYWFhYWFhYWFhYWFh8MTYxNTcyNzI0M3xpbnZhbGlkZXh0cmFkYXRh|7c2065ea122d028b03ef0295a4b4c5521823b9b5">
<h2>Test signRequest()</h2>
<cfset DuoWeb = CreateObject("component", "cfcs.DuoWeb")>
<br>
<cfdump var="#DuoWeb#" ><hr>
<cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, AKEY, USER)>
<cfdump var="#request_sig#" label="request_sig" /><hr>
<cfif NOT Len(request_sig)>
<p>FAIL request_sig was NULL</p>
<cfelse>
<p>PASS request_sig was not NULL</p>
</cfif>
<cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, AKEY, "")>
<cfif request_sig IS DuoWeb.ERR_USER>
<p>PASS request_sig is ERR_USER</p>
<cfelse>
<p>FAIL request_sig is not ERR_USER it is: <cfoutput>#request_sig#</cfoutput></p>
</cfif>
<cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, AKEY, "in|valid")>
<cfif request_sig IS DuoWeb.ERR_USER>
<p>PASS request_sig is ERR_USER</p>
<cfelse>
<p>FAIL request_sig is not ERR_USER it is: <cfoutput>#request_sig#</cfoutput></p>
</cfif>
<cfset request_sig = DuoWeb.signRequest("invalid", SKEY, AKEY, USER)>
<cfif request_sig IS DuoWEb.ERR_IKEY>
<p>PASS request_sig is ERR_IKEY</p>
<cfelse>
<p>FAIL request_sig is not ERR_IKEY it is:<cfoutput>#request_sig#</cfoutput></p>
</cfif>
<cfset request_sig = DuoWeb.signRequest(IKEY, "invalid", AKEY, USER)>
<cfif request_sig IS DuoWeb.ERR_SKEY>
<p>PASS request_sig is ERR_SKEY</p>
<cfelsE>
<p>FAIL request_sig is not ERR_SKEY it is: <cfoutput>#request_sig#</cfoutput></p>
</cfif>
<cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, "invalid", USER)>
<cfif request_sig IS DuoWeb.ERR_AKEY>
<p>PASS request_sig is ERR_AKEY</p>
<cfelse>
<p>FAIL request_sig is not ERR_AKEY</p>
</cfif>
<h2>Test verifyResponse()</h2>
<cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, AKEY, USER)>
<cfset valid_app_sig = ListGetAt(request_sig, 2, ":")>
<cfset future_user = DuoWeb.verifyResponse(IKEY, SKEY, AKEY, FUTURE_RESPONSE & ":" & valid_app_sig)>
<cfif future_user IS USER>
<p>PASS future_user</p>
<cfelse>
<p>FAIL future_user is: <cfoutput>#future_user#</cfoutput></p>
</cfif>
<cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, "1234567890123456789012345678901234567890", USER)>
<cfset invalid_app_sig = ListGetAt(request_sig, 2, ":")>
<cfset invalid_user = DuoWeb.verifyResponse(IKEY, SKEY, AKEY, INVALID_RESPONSE & ":" & valid_app_sig)>
<cfif NOT Len(invalid_user)>
<p>PASS invalid_user</p>
<cfelse>
<p>FAIL invalid_user</p>
</cfif>
<cfset expired_user = DuoWeb.verifyResponse(IKEY, SKEY, AKEY, EXPIRED_RESPONSE & ":" & valid_app_sig)>
<cfif NOT Len(expired_user)>
<p>PASS expired_user</p>
<cfelse>
<p>FAIL expired_user</p>
</cfif>
<cfset future_user = DuoWeb.verifyResponse(IKEY, SKEY, AKEY, FUTURE_RESPONSE & ":" & invalid_app_sig)>
<cfif NOT Len(future_user)>
<p>PASS future_user invalid_app_sig</p>
<cfelse>
<p>FAIL future_user invalid_app_sig</p>
</cfif>
<cfset future_user = DuoWeb.verifyResponse(IKEY, SKEY, AKEY, WRONG_PARAMS_RESPONSE & ":" & valid_app_sig)>
<cfif NOT Len(future_user)>
<p>PASS future_user invalid_response_format</p>
<cfelse>
<p>FAIL future_user invalid_response_format</p>
</cfif>
<cfset future_user = DuoWeb.verifyResponse(IKEY, SKEY, AKEY, FUTURE_RESPONSE & ":" & WRONG_PARAMS_APP)>
<cfif NOT Len(future_user)>
<p>PASS future_user invalid_app_format</p>
<cfelse>
<p>FAIL future_user invalid_app_format</p>
</cfif>
<cfset future_user = DuoWeb.verifyResponse(WRONG_IKEY, SKEY, AKEY, FUTURE_RESPONSE & ":" & valid_app_sig)>
<cfif NOT Len(future_user)>
<p>PASS future_user wrong_ikey</p>
<cfelse>
<p>FAIL future_user wrong_ikey</p>
</cfif>
<h2>Test hmacSign</h2>
<!--- test from rfc 2202 --->
<cfset result = DuoWeb.hmacSign("Jefe", "what do ya want for nothing?")>
<cfif result IS NOT "effcdf6ae5eb2fa2d27416d5f184df9c259a7c79">
<p>FAIL hmac result was <cfoutput>#result#</cfoutput></p>
<cfelse>
<p>PASS hmac working properly</p>
</cfif>
</body>
</html>
此实现的文档不多，但看起来很简单。在这一点上，我只是想让这个测试页面正常工作，然后将其完整集成。
任何人都可以帮我检测我做错了什么吗？这是我的错误截图：
将我的 CFC 中的 cftry/cfcatch 替换为：
<cfset duo_sig = signVals(arguments.sKey, arguments.username, arguments.iKey, variables.DUO_PREFIX, variables.DUO_EXPIRE)>
<cfset app_sig = signVals(arguments.aKey, arguments.username, arguments.iKey, variables.APP_PREFIX, variables.APP_EXPIRE)>
这是它抛出的错误：
太多了 cfifs，你不需要它们（我知道你是从他们的测试页面上拿来的，但在这种情况下它没有帮助).
创建对象后立即执行 <cfdump var="#DuoWeb#" >，希望这会显示 signRequest 方法的签名。
如果可行，一次分配 request_sig 一个，然后执行 <cfdump var="#request_sig#" >
<h2>Test signRequest()</h2>
<cfset DuoWeb = CreateObject("component", "cfcs.DuoWeb")>
<cfdump var="#DuoWeb#" label="DuoWeb Object" />
<hr />
<cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, AKEY, USER)>
<cfdump var="#request_sig#" label="request_sig" />
如果 request_sig 看起来不像 包含 : 的字符串，那么 ListGetAt(request_sig, 2, ":") 将抛出错误。
希望对您有所帮助。
Update
DuoWeb.cfc 中有一个 cftry/cfcatch 部分，因此您看不到真正的问题。
打开DuoWeb.cfc并暂时删除cftry/cfcatch然后再次运行测试页。它应该在问题所在的位置抛出错误并提供更多信息。
在 DuoWeb.cfc 中替换为：
<cftry>
<cfset duo_sig = signVals(arguments.sKey, arguments.username, arguments.iKey, variables.DUO_PREFIX, variables.DUO_EXPIRE)>
<cfset app_sig = signVals(arguments.aKey, arguments.username, arguments.iKey, variables.APP_PREFIX, variables.APP_EXPIRE)>
<cfcatch>
<cfreturn this.ERR_UNKNOWN>
</cfcatch>
</cftry>
有了这个：
<cfset duo_sig = signVals(arguments.sKey, arguments.username, arguments.iKey, variables.DUO_PREFIX, variables.DUO_EXPIRE)>
<cfset app_sig = signVals(arguments.aKey, arguments.username, arguments.iKey, variables.APP_PREFIX, variables.APP_EXPIRE)>
Update 2
我试过 Lucee，但它不能正常工作。看起来 Lucee 不喜欢 DuoWeb.cfc , signVals 方法这一部分中的 "cookie" 这个词。
在 DuoWeb.cfc 中更改为：
<cfset var cookie = arguments.prefix & "|" & ToBase64(value)>
<cfset var sig = hmacSign(arguments.key, cookie)>
<cfreturn cookie & "|" & sig>
对此（我的建议是cookie__）：
<cfset var cookie__ = arguments.prefix & "|" & ToBase64(value)>
<cfset var sig = hmacSign(arguments.key, cookie__)>
<cfreturn cookie__ & "|" & sig>
它应该可以解决问题。
我正在尝试将 Duo Web 2FA 与我的 ColdFusion 应用程序集成。我的 Coldfusion 服务器是 Windows Server 2012 运行 Lucee 4.5.2.018 final。我遵循 GitHub 方法作为 described here。我收到以下错误消息，但我不知道这意味着什么或从哪里开始解决此问题：
invalid call of the function listGetAt, second Argument (posNumber) is
invalid, invalid string list index [2]
The error occurred in C:\inetpub\wwwroot\serviceticket\test.cfm: line 82
80: <cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, AKEY, USER)>
81:
82: <cfset valid_app_sig = ListGetAt(request_sig, 2, ":")>
83:
84:
这是我的测试页代码：
<!doctype html>
<html>
<head>
<meta charset="utf-8">
<title>2FA</title>
<script src="Scripts/Duo-Web-v2.js"></script>
<script src="Scripts/Duo-Web.js"></script>
</head>
<body>
<cfset IKEY = "DIGF6DVQMHS39JKMHTR3">
<cfset WRONG_IKEY = "DIXXXXXXXXXXXXXXXXXY">
<cfset SKEY = "HIDDEN">
<cfset AKEY = "8mIeduVeTBLqY0zcAKaCaZzhEXTZIPTQRstb0PYd">
<cfset USER = "testuser">
<!--- Dummy response signatures --->
<cfset INVALID_RESPONSE = "AUTH|INVALID|SIG">
<cfset EXPIRED_RESPONSE = "AUTH|dGVzdHVzZXJ8RElYWFhYWFhYWFhYWFhYWFhYWFh8MTMwMDE1Nzg3NA==|cb8f4d60ec7c261394cd5ee5a17e46ca7440d702">
<cfset FUTURE_RESPONSE = "AUTH|dGVzdHVzZXJ8RElYWFhYWFhYWFhYWFhYWFhYWFh8MTYxNTcyNzI0Mw==|d20ad0d1e62d84b00a3e74ec201a5917e77b6aef">
<cfset WRONG_PARAMS_RESPONSE = "AUTH|dGVzdHVzZXJ8RElYWFhYWFhYWFhYWFhYWFhYWFh8MTYxNTcyNzI0M3xpbnZhbGlkZXh0cmFkYXRh|6cdbec0fbfa0d3f335c76b0786a4a18eac6cdca7">
<cfset WRONG_PARAMS_APP = "APP|dGVzdHVzZXJ8RElYWFhYWFhYWFhYWFhYWFhYWFh8MTYxNTcyNzI0M3xpbnZhbGlkZXh0cmFkYXRh|7c2065ea122d028b03ef0295a4b4c5521823b9b5">
<h2>Test signRequest()</h2>
<cfset DuoWeb = CreateObject("component", "cfcs.DuoWeb")>
<br>
<cfdump var="#DuoWeb#" ><hr>
<cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, AKEY, USER)>
<cfdump var="#request_sig#" label="request_sig" /><hr>
<cfif NOT Len(request_sig)>
<p>FAIL request_sig was NULL</p>
<cfelse>
<p>PASS request_sig was not NULL</p>
</cfif>
<cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, AKEY, "")>
<cfif request_sig IS DuoWeb.ERR_USER>
<p>PASS request_sig is ERR_USER</p>
<cfelse>
<p>FAIL request_sig is not ERR_USER it is: <cfoutput>#request_sig#</cfoutput></p>
</cfif>
<cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, AKEY, "in|valid")>
<cfif request_sig IS DuoWeb.ERR_USER>
<p>PASS request_sig is ERR_USER</p>
<cfelse>
<p>FAIL request_sig is not ERR_USER it is: <cfoutput>#request_sig#</cfoutput></p>
</cfif>
<cfset request_sig = DuoWeb.signRequest("invalid", SKEY, AKEY, USER)>
<cfif request_sig IS DuoWEb.ERR_IKEY>
<p>PASS request_sig is ERR_IKEY</p>
<cfelse>
<p>FAIL request_sig is not ERR_IKEY it is:<cfoutput>#request_sig#</cfoutput></p>
</cfif>
<cfset request_sig = DuoWeb.signRequest(IKEY, "invalid", AKEY, USER)>
<cfif request_sig IS DuoWeb.ERR_SKEY>
<p>PASS request_sig is ERR_SKEY</p>
<cfelsE>
<p>FAIL request_sig is not ERR_SKEY it is: <cfoutput>#request_sig#</cfoutput></p>
</cfif>
<cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, "invalid", USER)>
<cfif request_sig IS DuoWeb.ERR_AKEY>
<p>PASS request_sig is ERR_AKEY</p>
<cfelse>
<p>FAIL request_sig is not ERR_AKEY</p>
</cfif>
<h2>Test verifyResponse()</h2>
<cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, AKEY, USER)>
<cfset valid_app_sig = ListGetAt(request_sig, 2, ":")>
<cfset future_user = DuoWeb.verifyResponse(IKEY, SKEY, AKEY, FUTURE_RESPONSE & ":" & valid_app_sig)>
<cfif future_user IS USER>
<p>PASS future_user</p>
<cfelse>
<p>FAIL future_user is: <cfoutput>#future_user#</cfoutput></p>
</cfif>
<cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, "1234567890123456789012345678901234567890", USER)>
<cfset invalid_app_sig = ListGetAt(request_sig, 2, ":")>
<cfset invalid_user = DuoWeb.verifyResponse(IKEY, SKEY, AKEY, INVALID_RESPONSE & ":" & valid_app_sig)>
<cfif NOT Len(invalid_user)>
<p>PASS invalid_user</p>
<cfelse>
<p>FAIL invalid_user</p>
</cfif>
<cfset expired_user = DuoWeb.verifyResponse(IKEY, SKEY, AKEY, EXPIRED_RESPONSE & ":" & valid_app_sig)>
<cfif NOT Len(expired_user)>
<p>PASS expired_user</p>
<cfelse>
<p>FAIL expired_user</p>
</cfif>
<cfset future_user = DuoWeb.verifyResponse(IKEY, SKEY, AKEY, FUTURE_RESPONSE & ":" & invalid_app_sig)>
<cfif NOT Len(future_user)>
<p>PASS future_user invalid_app_sig</p>
<cfelse>
<p>FAIL future_user invalid_app_sig</p>
</cfif>
<cfset future_user = DuoWeb.verifyResponse(IKEY, SKEY, AKEY, WRONG_PARAMS_RESPONSE & ":" & valid_app_sig)>
<cfif NOT Len(future_user)>
<p>PASS future_user invalid_response_format</p>
<cfelse>
<p>FAIL future_user invalid_response_format</p>
</cfif>
<cfset future_user = DuoWeb.verifyResponse(IKEY, SKEY, AKEY, FUTURE_RESPONSE & ":" & WRONG_PARAMS_APP)>
<cfif NOT Len(future_user)>
<p>PASS future_user invalid_app_format</p>
<cfelse>
<p>FAIL future_user invalid_app_format</p>
</cfif>
<cfset future_user = DuoWeb.verifyResponse(WRONG_IKEY, SKEY, AKEY, FUTURE_RESPONSE & ":" & valid_app_sig)>
<cfif NOT Len(future_user)>
<p>PASS future_user wrong_ikey</p>
<cfelse>
<p>FAIL future_user wrong_ikey</p>
</cfif>
<h2>Test hmacSign</h2>
<!--- test from rfc 2202 --->
<cfset result = DuoWeb.hmacSign("Jefe", "what do ya want for nothing?")>
<cfif result IS NOT "effcdf6ae5eb2fa2d27416d5f184df9c259a7c79">
<p>FAIL hmac result was <cfoutput>#result#</cfoutput></p>
<cfelse>
<p>PASS hmac working properly</p>
</cfif>
</body>
</html>
此实现的文档不多，但看起来很简单。在这一点上，我只是想让这个测试页面正常工作，然后将其完整集成。
任何人都可以帮我检测我做错了什么吗？这是我的错误截图：
将我的 CFC 中的 cftry/cfcatch 替换为：
<cfset duo_sig = signVals(arguments.sKey, arguments.username, arguments.iKey, variables.DUO_PREFIX, variables.DUO_EXPIRE)>
<cfset app_sig = signVals(arguments.aKey, arguments.username, arguments.iKey, variables.APP_PREFIX, variables.APP_EXPIRE)>
这是它抛出的错误：
太多了 cfifs，你不需要它们（我知道你是从他们的测试页面上拿来的，但在这种情况下它没有帮助).
创建对象后立即执行 <cfdump var="#DuoWeb#" >，希望这会显示 signRequest 方法的签名。
如果可行，一次分配 request_sig 一个，然后执行 <cfdump var="#request_sig#" >
<h2>Test signRequest()</h2>
<cfset DuoWeb = CreateObject("component", "cfcs.DuoWeb")>
<cfdump var="#DuoWeb#" label="DuoWeb Object" />
<hr />
<cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, AKEY, USER)>
<cfdump var="#request_sig#" label="request_sig" />
如果 request_sig 看起来不像 包含 : 的字符串，那么 ListGetAt(request_sig, 2, ":") 将抛出错误。
希望对您有所帮助。
Update
DuoWeb.cfc 中有一个 cftry/cfcatch 部分，因此您看不到真正的问题。
打开DuoWeb.cfc并暂时删除cftry/cfcatch然后再次运行测试页。它应该在问题所在的位置抛出错误并提供更多信息。
在 DuoWeb.cfc 中替换为：
<cftry>
<cfset duo_sig = signVals(arguments.sKey, arguments.username, arguments.iKey, variables.DUO_PREFIX, variables.DUO_EXPIRE)>
<cfset app_sig = signVals(arguments.aKey, arguments.username, arguments.iKey, variables.APP_PREFIX, variables.APP_EXPIRE)>
<cfcatch>
<cfreturn this.ERR_UNKNOWN>
</cfcatch>
</cftry>
有了这个：
<cfset duo_sig = signVals(arguments.sKey, arguments.username, arguments.iKey, variables.DUO_PREFIX, variables.DUO_EXPIRE)>
<cfset app_sig = signVals(arguments.aKey, arguments.username, arguments.iKey, variables.APP_PREFIX, variables.APP_EXPIRE)>
Update 2
我试过 Lucee，但它不能正常工作。看起来 Lucee 不喜欢 DuoWeb.cfc , signVals 方法这一部分中的 "cookie" 这个词。
在 DuoWeb.cfc 中更改为：
<cfset var cookie = arguments.prefix & "|" & ToBase64(value)>
<cfset var sig = hmacSign(arguments.key, cookie)>
<cfreturn cookie & "|" & sig>
对此（我的建议是cookie__）：
<cfset var cookie__ = arguments.prefix & "|" & ToBase64(value)>
<cfset var sig = hmacSign(arguments.key, cookie__)>
<cfreturn cookie__ & "|" & sig>
它应该可以解决问题。