chore: rework sample credential plugin

[jgomer2001]

Prepare

• Read PR guidelines
• Read license information

---

Description

Target issue

closes #9228

Implementation Details

---

Test and Document the changes

• Static code analysis has been run locally and issues have been fixed
• Relevant unit and integration tests have been added/updated
• Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

• I confirm that there is no impact on the docs due to the code changes in this PR.

[dryrunsecurity]

DryRun Security Summary

This pull request contains changes to the documentation and sample code for the Jans Casa application, focusing on expanding the developer-oriented content and introducing a new "Favorite Color" authentication method, which requires careful review for potential security vulnerabilities.

Expand for full summary

Summary:

This pull request contains a variety of changes to the documentation and sample code for the Jans Casa application, with a focus on expanding the developer-oriented content and introducing a new "Favorite Color" authentication method.

The key security-related highlights are:

1. Documentation Improvements: The addition of a "Developer Guide" section in the documentation is a positive step, as it indicates a focus on providing guidance and support for developers working on the Jans Casa application. This can help ensure that new features and integrations are implemented securely.

2. Sample Credential Implementation: The changes introduce a sample "Favorite Color" authentication method, which uses the user's favorite color as a second factor. While this is an interesting concept, the use of a user's favorite color as a sole second factor is generally not considered a secure authentication mechanism, and the implementation should be carefully reviewed for potential vulnerabilities.

3. Input Validation and Authorization: The sample code for the "Favorite Color" feature lacks robust input validation and proper authorization checks, which could lead to security issues if not addressed. It's important to ensure that user input is properly sanitized and that only authorized users can perform sensitive actions.

4. Hardcoded Configuration: The use of hardcoded values, such as the default color and the credential type, should be avoided in favor of more flexible and configurable approaches to improve maintainability and reduce the risk of security issues.

Overall, the changes in this pull request appear to be focused on expanding the functionality and documentation of the Jans Casa application. From an application security perspective, it's important to ensure that any new features and integrations are thoroughly reviewed and tested to maintain the overall security posture of the application.

Files Changed:

1. Documentation Files:

   • docs/casa/administration/quick-start.md: Minor updates to the documentation for the Jans Casa quick start guide, with a focus on SMS OTP configuration.
   • docs/casa/administration/2fa-basics.md: Changes related to the configuration of requisite authentication methods for two-factor authentication (2FA).
   • docs/casa/developer/overview.md: Updates to the developer guide, providing information on plugins development, configuration management, and customizing the authentication flow.
   • docs/casa/developer/add-authn-methods.md: New documentation on adding custom authentication methods to the Jans Casa application.
   • docs/casa/index.md: Addition of a new "Developer Guide" section in the documentation.

2. Sample Plugin Files:

   • jans-casa/plugins/samples/sample-cred/README.md: Updates to the README file for the "sample-cred" plugin, clarifying that it is a dummy, oversimplified project.
   • jans-casa/plugins/samples/sample-cred/agama/README.md: Similar updates to the README file for the "sample-cred/agama" project.
   • jans-casa/plugins/samples/sample-cred/agama/project.json: Minor updates to the project metadata.
   • jans-casa/plugins/samples/sample-cred/agama/web/color-prompt.ftlh: Changes to the Freemarker template for the color selection form.
   • jans-casa/plugins/samples/sample-cred/agama/code/com.acme.authn.color.flow: Implementation of the "com.acme.authn.color" authentication flow.
   • jans-casa/plugins/samples/sample-cred/src/main/java/io/jans/casa/plugins/sample/extension/SampleCredentialAuthnMethod.java: Implementation of the "SampleCredentialAuthnMethod" class.
   • jans-casa/plugins/samples/sample-cred/src/main/java/io/jans/casa/plugins/sample/service/SampleCredentialService.java: Implementation of the "SampleCredentialService" class.
   • jans-casa/plugins/samples/sample-cred/src/main/java/io/jans/casa/plugins/sample/model/PersonColor.java: Implementation of the "PersonColor" class.
   • jans-casa/plugins/samples/sample-cred/src/main/resources/assets/user/cred_details.zul: Updates to the user interface for the "Sample Credential" feature.
   • `jans-casa/plugins/samples/sample-cred/src

Code Analysis

We ran 9 analyzers against 21 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Authn/Authz Analyzer	5 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.