将 Duo Web 2 因素身份验证与 ColdFusion 集成

Integrating Duo Web 2 Factor Authentication with ColdFusion

我正在尝试将 Duo Web 2FA 与我的 ColdFusion 应用程序集成。我的 Coldfusion 服务器是 Windows Server 2012 运行 Lucee 4.5.2.018 final。我遵循 GitHub 方法作为 described here。我收到以下错误消息,但我不知道这意味着什么或从哪里开始解决此问题:

invalid call of the function listGetAt, second Argument (posNumber) is 

invalid, invalid string list index [2]

The error occurred in C:\inetpub\wwwroot\serviceticket\test.cfm: line 82

80: <cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, AKEY, USER)>
81: 
82: <cfset valid_app_sig = ListGetAt(request_sig, 2, ":")>
83: 
84: 

这是我的测试页代码:

<!doctype html>
<html>
<head>
<meta charset="utf-8">
<title>2FA</title>

<script src="Scripts/Duo-Web-v2.js"></script>
<script src="Scripts/Duo-Web.js"></script>


</head>

<body>

<cfset IKEY = "DIGF6DVQMHS39JKMHTR3">
<cfset WRONG_IKEY = "DIXXXXXXXXXXXXXXXXXY">
<cfset SKEY = "HIDDEN">
<cfset AKEY = "8mIeduVeTBLqY0zcAKaCaZzhEXTZIPTQRstb0PYd">

<cfset USER = "testuser">

<!--- Dummy response signatures --->
<cfset INVALID_RESPONSE = "AUTH|INVALID|SIG">
<cfset EXPIRED_RESPONSE = "AUTH|dGVzdHVzZXJ8RElYWFhYWFhYWFhYWFhYWFhYWFh8MTMwMDE1Nzg3NA==|cb8f4d60ec7c261394cd5ee5a17e46ca7440d702">
<cfset FUTURE_RESPONSE = "AUTH|dGVzdHVzZXJ8RElYWFhYWFhYWFhYWFhYWFhYWFh8MTYxNTcyNzI0Mw==|d20ad0d1e62d84b00a3e74ec201a5917e77b6aef">
<cfset WRONG_PARAMS_RESPONSE = "AUTH|dGVzdHVzZXJ8RElYWFhYWFhYWFhYWFhYWFhYWFh8MTYxNTcyNzI0M3xpbnZhbGlkZXh0cmFkYXRh|6cdbec0fbfa0d3f335c76b0786a4a18eac6cdca7">
<cfset WRONG_PARAMS_APP = "APP|dGVzdHVzZXJ8RElYWFhYWFhYWFhYWFhYWFhYWFh8MTYxNTcyNzI0M3xpbnZhbGlkZXh0cmFkYXRh|7c2065ea122d028b03ef0295a4b4c5521823b9b5">

<h2>Test signRequest()</h2>
<cfset DuoWeb = CreateObject("component", "cfcs.DuoWeb")>

<br>
<cfdump var="#DuoWeb#" ><hr>

<cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, AKEY, USER)>
<cfdump var="#request_sig#" label="request_sig" /><hr>

<cfif NOT Len(request_sig)>
    <p>FAIL request_sig was NULL</p>
<cfelse>
    <p>PASS request_sig was not NULL</p>
</cfif>

<cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, AKEY, "")>
<cfif request_sig IS DuoWeb.ERR_USER>
    <p>PASS request_sig is ERR_USER</p>
<cfelse>
    <p>FAIL request_sig is not ERR_USER it is: <cfoutput>#request_sig#</cfoutput></p>
</cfif>

<cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, AKEY, "in|valid")>
<cfif request_sig IS DuoWeb.ERR_USER>
    <p>PASS request_sig is ERR_USER</p>
<cfelse>
    <p>FAIL request_sig is not ERR_USER it is: <cfoutput>#request_sig#</cfoutput></p>
</cfif>

<cfset request_sig = DuoWeb.signRequest("invalid", SKEY, AKEY, USER)>
<cfif request_sig IS DuoWEb.ERR_IKEY>
    <p>PASS request_sig is ERR_IKEY</p>
<cfelse>
    <p>FAIL request_sig is not ERR_IKEY it is:<cfoutput>#request_sig#</cfoutput></p>
</cfif>


<cfset request_sig = DuoWeb.signRequest(IKEY, "invalid", AKEY, USER)>
<cfif request_sig IS DuoWeb.ERR_SKEY>
    <p>PASS request_sig is ERR_SKEY</p>
<cfelsE>
    <p>FAIL request_sig is not ERR_SKEY it is: <cfoutput>#request_sig#</cfoutput></p>
</cfif>


<cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, "invalid", USER)>
<cfif request_sig IS DuoWeb.ERR_AKEY>
    <p>PASS request_sig is ERR_AKEY</p>
<cfelse>
    <p>FAIL request_sig is not ERR_AKEY</p>
</cfif>

<h2>Test verifyResponse()</h2>



<cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, AKEY, USER)>

<cfset valid_app_sig = ListGetAt(request_sig, 2, ":")>


<cfset future_user = DuoWeb.verifyResponse(IKEY, SKEY, AKEY, FUTURE_RESPONSE & ":" & valid_app_sig)>
<cfif future_user IS USER>
    <p>PASS future_user</p>
<cfelse>
    <p>FAIL future_user is: <cfoutput>#future_user#</cfoutput></p>
</cfif>

<cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, "1234567890123456789012345678901234567890", USER)>
<cfset invalid_app_sig = ListGetAt(request_sig, 2, ":")>

<cfset invalid_user = DuoWeb.verifyResponse(IKEY, SKEY, AKEY, INVALID_RESPONSE & ":" & valid_app_sig)>
<cfif NOT Len(invalid_user)>
    <p>PASS invalid_user</p>
<cfelse>
    <p>FAIL invalid_user</p>
</cfif>


<cfset expired_user = DuoWeb.verifyResponse(IKEY, SKEY, AKEY, EXPIRED_RESPONSE & ":" & valid_app_sig)>
<cfif NOT Len(expired_user)>
    <p>PASS expired_user</p>
<cfelse>
    <p>FAIL expired_user</p>
</cfif>


<cfset future_user = DuoWeb.verifyResponse(IKEY, SKEY, AKEY, FUTURE_RESPONSE & ":" & invalid_app_sig)>
<cfif NOT Len(future_user)>
    <p>PASS future_user invalid_app_sig</p>
<cfelse>
    <p>FAIL future_user invalid_app_sig</p>
</cfif>

<cfset future_user = DuoWeb.verifyResponse(IKEY, SKEY, AKEY, WRONG_PARAMS_RESPONSE & ":" & valid_app_sig)>
<cfif NOT Len(future_user)>
    <p>PASS future_user invalid_response_format</p>
<cfelse>
    <p>FAIL future_user invalid_response_format</p>
</cfif>

<cfset future_user = DuoWeb.verifyResponse(IKEY, SKEY, AKEY, FUTURE_RESPONSE & ":" & WRONG_PARAMS_APP)>
<cfif NOT Len(future_user)>
    <p>PASS future_user invalid_app_format</p>
<cfelse>
    <p>FAIL future_user invalid_app_format</p>
</cfif>

<cfset future_user = DuoWeb.verifyResponse(WRONG_IKEY, SKEY, AKEY, FUTURE_RESPONSE & ":" & valid_app_sig)>
<cfif NOT Len(future_user)>
    <p>PASS future_user wrong_ikey</p>
<cfelse>
    <p>FAIL future_user wrong_ikey</p>
</cfif>


<h2>Test hmacSign</h2>
<!--- test from rfc 2202 --->
<cfset result = DuoWeb.hmacSign("Jefe", "what do ya want for nothing?")>
<cfif result IS NOT "effcdf6ae5eb2fa2d27416d5f184df9c259a7c79">
    <p>FAIL hmac result was <cfoutput>#result#</cfoutput></p>
<cfelse>
    <p>PASS hmac working properly</p>
</cfif>

</body>
</html>

此实现的文档不多,但看起来很简单。在这一点上,我只是想让这个测试页面正常工作,然后将其完整集成。

任何人都可以帮我检测我做错了什么吗?这是我的错误截图:


将我的 CFC 中的 cftry/cfcatch 替换为:

 <cfset duo_sig = signVals(arguments.sKey, arguments.username, arguments.iKey, variables.DUO_PREFIX, variables.DUO_EXPIRE)>
 <cfset app_sig = signVals(arguments.aKey, arguments.username, arguments.iKey, variables.APP_PREFIX, variables.APP_EXPIRE)>

这是它抛出的错误:

太多了 cfifs你不需要它们(我知道你是从他们的测试页面上拿来的,但在这种情况下它没有帮助).

创建对象后立即执行 <cfdump var="#DuoWeb#" >,希望这会显示 signRequest 方法的签名。

如果可行,一次分配 request_sig 一个,然后执行 <cfdump var="#request_sig#" >

<h2>Test signRequest()</h2>

<cfset DuoWeb = CreateObject("component", "cfcs.DuoWeb")>
<cfdump var="#DuoWeb#" label="DuoWeb Object" />
<hr />

<cfset request_sig = DuoWeb.signRequest(IKEY, SKEY, AKEY, USER)>
<cfdump var="#request_sig#" label="request_sig" />

如果 request_sig 看起来不像 包含 : 的字符串,那么 ListGetAt(request_sig, 2, ":") 将抛出错误。


希望对您有所帮助。

Update

DuoWeb.cfc 中有一个 cftry/cfcatch 部分,因此您看不到真正的问题。

打开DuoWeb.cfc并暂时删除cftry/cfcatch然后再次运行测试页。它应该在问题所在的位置抛出错误并提供更多信息。

DuoWeb.cfc 中替换为:

    <cftry>
        <cfset duo_sig = signVals(arguments.sKey, arguments.username, arguments.iKey, variables.DUO_PREFIX, variables.DUO_EXPIRE)>
        <cfset app_sig = signVals(arguments.aKey, arguments.username, arguments.iKey, variables.APP_PREFIX, variables.APP_EXPIRE)>
        <cfcatch>
            <cfreturn this.ERR_UNKNOWN>
        </cfcatch>
    </cftry>

有了这个:

        <cfset duo_sig = signVals(arguments.sKey, arguments.username, arguments.iKey, variables.DUO_PREFIX, variables.DUO_EXPIRE)>
        <cfset app_sig = signVals(arguments.aKey, arguments.username, arguments.iKey, variables.APP_PREFIX, variables.APP_EXPIRE)>

Update 2

我试过 Lucee,但它不能正常工作。看起来 Lucee 不喜欢 DuoWeb.cfc , signVals 方法这一部分中的 "cookie" 这个词。

DuoWeb.cfc 中更改为:

    <cfset var cookie = arguments.prefix & "|" & ToBase64(value)>
    <cfset var sig = hmacSign(arguments.key, cookie)>
    <cfreturn cookie & "|" & sig>

对此(我的建议是cookie__):

    <cfset var cookie__ = arguments.prefix & "|" & ToBase64(value)>
    <cfset var sig = hmacSign(arguments.key, cookie__)>
    <cfreturn cookie__ & "|" & sig>

它应该可以解决问题。