fix(jans-cli-tui): authn page for non-ldap backend

[devrimyatar]

closes #9330

• I confirm that there is no impact on the docs due to the code changes in this PR.

Closes #9340,

[dryrunsecurity]

DryRun Security Summary

The pull request focuses on the authentication server configuration in the Jans CLI TUI application, including changes to LDAP server configurations, custom authentication scripts, Agama flows, and ACR mappings, which require careful review and implementation of appropriate security measures to address security-sensitive areas.

Expand for full summary

Summary:

The code changes in this pull request are focused on the authentication server configuration in the Jans CLI TUI (Text-based User Interface) application. The key changes include the handling of LDAP server configurations, custom authentication scripts, Agama flows, and ACR (Authentication Context Reference) mappings. From an application security perspective, these changes introduce several security-sensitive areas that require careful review and implementation of appropriate security measures.

The LDAP server configuration includes sensitive information, such as bind DN and password, which should be properly protected through access control and encryption. The custom authentication scripts may contain security-sensitive logic and should be thoroughly reviewed and tested for vulnerabilities. The ACR mappings can be used to map user-supplied ACRs to different authentication methods, and it is crucial to implement proper input validation and sanitization to prevent potential injection attacks. Finally, the integration with the Agama module introduces additional complexity and potential attack surface, and the communication between the application and the Agama module should be properly secured.

Files Changed:

• jans-cli-tui/cli_tui/plugins/010_auth_server/authn.py: This file handles the configuration of the authentication server in the Jans CLI TUI application. The key changes include:
  • LDAP server configuration: Allows users to add, edit, and delete LDAP server configurations, including sensitive information such as bind DN and password.
  • Authentication scripts: Supports the configuration of custom authentication scripts, which should be reviewed for security vulnerabilities.
  • Agama flows: Integrates with the Agama module to retrieve and display ACR values, introducing additional complexity and potential attack surface.
  • ACR mappings: Allows users to configure ACR mappings, which should be implemented with proper input validation and sanitization to prevent injection attacks.

Code Analysis

We ran 9 analyzers against 1 file and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[mo-auto]

Error: Hi @devrimyatar, You did not reference an open issue in your PR. I attempted to create an issue for you.
Please update that issues' title and body and make sure I correctly referenced it in the above PRs body.

[sonarqubecloud]

Quality Gate passed for 'jans-cli'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed for 'jans-config-api-parent'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed for 'Jans-Keycloak-Link'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed for 'Fido2 API'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed for 'SCIM API'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud