chore: project refactoring and docs

[jgomer2001]

Prepare

• Read PR guidelines
• Read license information

---

Description

Target issue

closes #9228

Implementation Details

---

Test and Document the changes

• Static code analysis has been run locally and issues have been fixed
• Relevant unit and integration tests have been added/updated
• Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

• I confirm that there is no impact on the docs due to the code changes in this PR.

[dryrunsecurity]

DryRun Security Summary

The pull request covers a wide range of updates to the documentation and plugin functionality of the Jans Casa application, with a focus on improving the security and usability of the authentication and credential management features, including enhancements to two-factor authentication, secure development practices, user interface improvements, and support for FIDO2 security keys.

Expand for full summary

Summary:

The code changes in this pull request cover a wide range of updates to the documentation and plugin functionality of the Jans Casa application. From an application security perspective, the changes generally focus on improving the security and usability of the authentication and credential management features in the application.

Key security-related updates include:

1. Enhancements to the documentation for two-factor authentication (2FA) features, including support for TOTP/HOTP, push notifications, and customizable 2FA policies.
2. Guidance on secure development practices for Agama-based flows and plugins, emphasizing the importance of input validation, secure configuration management, and proper error handling.
3. Improvements to the user interface and messaging around 2FA enrollment, credential management, and password reset functionality.
4. Addition of support for FIDO2 security keys and other hardware-based authentication methods, which provide stronger security compared to traditional password-based authentication.

While the changes do not appear to introduce any immediate security vulnerabilities, it's important to ensure that the implementation of these features follows best practices for secure coding, input validation, and data protection. Ongoing monitoring and testing of the application's security posture will also be crucial to maintain a high level of security.

Files Changed:

• docs/casa/administration/admin-console.md: Updated documentation for 2FA configuration options, including support for TOTP/HOTP and push notification-based authentication.
• docs/casa/administration/custom-branding.md: Provided guidance on securely customizing the Casa application's appearance through the use of external CSS and assets.
• docs/casa/administration/2fa-basics.md: Simplified the documentation for 2FA types and added information on forcing users to enroll specific credential types.
• docs/admin/developer/agama/agama-best-practices.md: Introduced recommendations for secure and maintainable Agama development practices, including project reuse, flow design, and error handling.
• docs/casa/developer/overview.md: Highlighted the secure features and APIs available for integrating authentication methods into Casa-based applications.
• docs/casa/developer/add-authn-methods.md: Provided guidance on securely implementing custom authentication methods as Agama plugins.
• jans-casa/app/src/main/resources/labels/user.properties: Updated user interface labels and messages related to 2FA and account management features.
• and several other documentation and plugin-related files.

Code Analysis

We ran 9 analyzers against 19 files and 2 analyzers had findings. 7 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	1 finding
Authn/Authz Analyzer	3 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.