feat(jans-casa): add agama project for casa authentication

[jgomer2001]

Prepare

• Read PR guidelines
• Read license information

---

Description

Target issue

closes #8846

Implementation Details

---

Test and Document the changes

• Static code analysis has been run locally and issues have been fixed
• Relevant unit and integration tests have been added/updated
• Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

• I confirm that there is no impact on the docs due to the code changes in this PR.

[dryrunsecurity]

DryRun Security Summary

The provided code changes cover a wide range of functionality within the Jans Casa application, including FIDO2 authentication, SMS-based one-time passwords (OTPs), trusted devices management, and various utility classes and templates, with a focus on improving the security and usability of the application's authentication mechanisms.

Expand for full summary

Summary:

The provided code changes cover a wide range of functionality within the Jans Casa application, including FIDO2 authentication, SMS-based one-time passwords (OTPs), trusted devices management, and various utility classes and templates. Overall, the changes appear to be focused on improving the security and usability of the application's authentication mechanisms.

From an application security perspective, the changes generally follow good security practices, such as input validation, error handling, and the use of secure authentication standards like FIDO2. However, there are a few areas that should be reviewed and addressed to ensure a comprehensive security posture:

1. Input Validation and Sanitization: Ensure that all user-supplied input is properly validated and sanitized to prevent common web application vulnerabilities, such as SQL injection, cross-site scripting (XSS), and others.
2. Sensitive Data Handling: Review the handling of sensitive information, such as OTP secrets, access tokens, and user metadata, to ensure that it is properly secured and protected from unauthorized access or leakage.
3. Logging and Error Handling: Ensure that logging and error handling mechanisms do not inadvertently expose sensitive information that could be useful to an attacker.
4. Secure Configuration Management: Carefully manage the application's configuration, including any hardcoded values, to prevent potential security issues and ensure maintainability.
5. Dependency Management: Regularly review and update the application's dependencies to address any known vulnerabilities.

By addressing these security considerations, the application can be further strengthened and provide a more secure user authentication experience.

Files Changed:

• jans-casa/agama/pom.xml: The changes add a new module called casa-agama to the existing casa-base project, which is a routine update to the project's build configuration and does not raise any immediate security concerns.
• jans-casa/agama/project/code/io.jans.casa.authn.fido2.flow: The changes implement a FIDO2 authentication flow, which is a secure and passwordless authentication method. The code follows good security practices, such as input validation and error handling.
• jans-casa/agama/project/code/io.jans.casa.authn.otp.flow: The changes implement an OTP authentication flow, which includes a retry mechanism and input validation to mitigate potential security risks.
• jans-casa/agama/project/code/io.jans.casa.authn.main.flow: The changes implement a multi-step authentication process, including password validation, two-factor authentication, and trusted device management. The code should be reviewed to ensure that all security-critical components are implemented securely.
• jans-casa/agama/project/lib/io/jans/agamalab/CasaWSBase.java: The changes implement a base class for communication between the Agama and Casa applications, with a focus on authentication, authorization, and error handling.
• And several other files related to SMS-based OTP, FIDO2 authentication, trusted devices management, and various utility classes and templates.

Code Analysis

We ran 9 analyzers against 30 files and 2 analyzers had findings. 7 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	2 findings
Authn/Authz Analyzer	13 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.