Skip to content

Commit

Permalink
Duo Universal Login Script Support (#33)
Browse files Browse the repository at this point in the history
* feat: add support for duo universal

* refactor: update log messages & comments to be more relevant

* docs: remove sms mention

* docs: clarify meaning of auth mode

* docs: revising auth mode section, add deprecation note
  • Loading branch information
ewang2002 committed Apr 13, 2024
1 parent 698527d commit 2525c95
Show file tree
Hide file tree
Showing 7 changed files with 972 additions and 617 deletions.
66 changes: 18 additions & 48 deletions scripts/webregautoin/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,20 +12,16 @@ credentials and then automatically select the `Remember me for 7 days` checkbox
That way, you don't need to worry about having to authenticate via Duo for the next 7 days.

## Authentication Modes
As of recently, this script supports either Push or SMS mode. The modes only really matter at the beginning (i.e., when
you start the script).
- Push mode essentially means that, when the script is starting up, the script will initially authenticate you using
Duo Push.
- SMS mode means that, when the script is starting up, the script will initially use the SMS code that best fits the
hint that is given (i.e., it will try to find the code you defined in the configuration file that satisfies the hint
"Your next SMS Passcode starts with XXX").
Prior to March 26, 2024, this script supported either Push or SMS mode. Now, because of the new
[Duo Universal Prompt](https://blink.ucsd.edu/technology/security/services/two-step-login/universal-prompt.html),
only Push is supported.

Push mode is probably the easiest to use short-term, but you'll need to restart the login script setup process every
6-7 days to ensure you can still keep yourself logged in. SMS mode is somewhat easy, and allows you to remember your
session for up to 70 days (10 codes times 7 days per code = 70 days). However, you probably won't be able to use SMS
mode _outside_ of this application.
This script only supports Duo Push: when the script is starting up, the script will initially authenticate you using Duo Push.

As a warning, SMS mode is not guaranteed to work as expected. Duo Push remains the most stable login process.
Keep in mind that you'll need to restart the login script setup process every 6-7 days to ensure you can still keep
yourself logged in.

~~Also, Ruby is a clown~~

## Requirements
In order to ensure that you _can_ use this script, ensure that the following technical and non-technical requirements
Expand All @@ -36,6 +32,10 @@ are satisfied.
- Your UCSD account must be configured so that a Duo push is automatically sent when needed (i.e., set Duo Push as the
**default authentication method**). See [this UCSD ITS article](https://support.ucsd.edu/its?id=kb_article_view&sys_kb_id=f91e1f55873259d8947a0fa8cebb352e&sysparm_article=KB0030238) for more information.

> [!NOTE]
> Starting March 26, 2024, with the introduction of the [Duo Universal Prompt](https://blink.ucsd.edu/technology/security/services/two-step-login/universal-prompt.html),
> Duo Push should automatically be done regardless of what you've chosen above.
### Technical
- You'll need to have [Node.js](https://nodejs.org/en/) installed. The long term support (LTS) version will do.
- If you're using Ubuntu, you'll also need to ensure that the following system dependencies are installed.
Expand All @@ -48,7 +48,7 @@ are satisfied.
## Setup
To actually run this script, follow the directions below.

1. Two sample configuration files have been provided for you: `credentials.sample_push.json` and `credentials.sample_sms.json`.
1. A sample configuration file has been provided for you: `credentials.example.json`.
1. Rename this file to `credentials.json`.
2. Open the file and fill in your UC San Diego Active Directory username and password.
3. Modify any other relevant settings (see the next section on the configuration file for more on this).
Expand Down Expand Up @@ -85,21 +85,18 @@ To actually run this script, follow the directions below.

> **Warning:**
> If you use `push` mode, you'll need to repeat this process every 6-7 days to ensure your scraper runs uninterrupted.
>
> If you use `sms` mode, you'll need to repeat this process every 70 days or so, but you must not use SMS mode outside
> of this program. In other words, if you use `sms` mode for this application, do not use Duo SMS outside of this app.
## Configuration File Layout
There are two sample configuration files you can use; each of them correspond to the type of login process you can use
for this login script.

Both configuration layouts will feature the same keys:
The sample configuration file will have the following layout:
- `webreg.username` (`string`): Your UCSD Active Directory username.
- `webreg.password` (`string`): Your UCSD Active Directory password.
- `settings.loginType` (`sms` or `push`): The login process you want to use. This can only be `sms` or `push`.
- `settings.loginType` (`push`): The login process you want to use. This should only be `push`.
- `settings.automaticPushEnabled` (`boolean`): Whether your account is configured to automatically sends a Duo Push on
login. If this value is `true`, then the login script will cancel the automatic push when setting itself up.

> [!NOTE]
> `settings.automaticPushEnabled` is no longer in use by the script, and will be deprecated in a later version.
### Duo Push
```json
{
Expand All @@ -113,30 +110,3 @@ Both configuration layouts will feature the same keys:
}
}
```

### Duo SMS
```json
{
"webreg": {
"username": "",
"password": ""
},
"settings": {
"loginType": "push",
"automaticPushEnabled": true,
"smsTokens": [
"your",
"sms",
"tokens",
"as",
"strings"
]
}
}
```

Additionally, Duo SMS configuration files have a third settings property:
- `settings.smsTokens` (`string[]`): a list of SMS tokens that Duo sent you. To obtain these tokens, log into your UCSD
account. When you reach the Duo 2FA screen, select "Enter a Passcode" and then click on "Text me new codes." You should
receive the tokens via text. When you do, just put the tokens into `settings.smsTokens`, ensuring that each element is
of type _string_ (**not** an integer).
17 changes: 0 additions & 17 deletions scripts/webregautoin/credentials.sample_sms.json

This file was deleted.

0 comments on commit 2525c95

Please sign in to comment.