Documentation
¶
Overview ¶
Package mfa implements the in-memory state for Auth0's MFA challenge dance.
Auth0 enforces MFA via a two-step /oauth/token flow:
- The initial password / password-realm request returns 403 { "error": "mfa_required", "mfa_token": "..." } instead of minting.
- The client re-calls /oauth/token with one of the MFA grants (mfa-otp, mfa-oob, mfa-recovery-code) and presents the user's factor.
Whether MFA is required at all is controlled by a runtime flag mutated via /admin0/mfa-required. The accepted challenges are fixed canned values (matching the spirit of /passwordless/verify accepting "000000"):
OTP = "123456" BindingCode = "123456" RecoveryCode = "ABCDEFGHIJKLMNOP"
Index ¶
Constants ¶
const ( AcceptedOTP = "123456" AcceptedBindingCode = "123456" AcceptedRecoveryCode = "ABCDEFGHIJKLMNOP" )
Fixed canned challenges accepted by the mock. Tests can rely on them.
const DefaultTokenTTL = 10 * time.Minute
DefaultTokenTTL is how long an issued mfa_token stays valid before the matching challenge becomes unredeemable.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Context ¶
type Context struct {
ClientID string
Audience string
Scope string
Subject string
Realm string // Empty for plain password grant.
// contains filtered or unexported fields
}
Context carries the token-issuance state from step 1 (the 403 response) to step 2 (the MFA grant exchange) so the second request can mint a token equivalent to what the first would have produced.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store holds active mfa_tokens and the global "MFA required" flag. Safe for concurrent use.
func (*Store) Consume ¶
Consume returns the Context registered against an mfa_token and removes it (single-use). Returns false if the token is unknown or expired.
func (*Store) IsRequired ¶
IsRequired reports whether MFA enforcement is currently on.
func (*Store) Issue ¶
Issue creates a fresh mfa_token bound to ctx, valid for the configured TTL. Returns the opaque token string the client should present in step 2.
func (*Store) Reset ¶
func (s *Store) Reset()
Reset clears every issued mfa_token AND turns enforcement off.
func (*Store) SetRequired ¶
SetRequired toggles the global flag. When true, the password and password-realm grants return 403 mfa_required + an mfa_token instead of minting a token directly.
Source Files