/// <summary>
/// Verify one time password from user input
/// </summary>
private async Task <PacketCode> ProcessChallenge(PendingRequest request, ClientConfiguration clientConfig, string state)
{
var userName = request.RequestPacket.UserName;
if (string.IsNullOrEmpty(userName))
{
_logger.Warning("Can't find User-Name in message id={id} from {host:l}:{port}", request.RequestPacket.Identifier, request.RemoteEndpoint.Address, request.RemoteEndpoint.Port);
return(PacketCode.AccessReject);
}
PacketCode response;
string userAnswer;
switch (request.RequestPacket.AuthenticationType)
{
case AuthenticationType.PAP:
//user-password attribute holds second request challenge from user
userAnswer = request.RequestPacket.GetString("User-Password");
if (string.IsNullOrEmpty(userAnswer))
{
_logger.Warning("Can't find User-Password with user response in message id={id} from {host:l}:{port}", request.RequestPacket.Identifier, request.RemoteEndpoint.Address, request.RemoteEndpoint.Port);
return(PacketCode.AccessReject);
}
break;
case AuthenticationType.MSCHAP2:
var msChapResponse = request.RequestPacket.GetAttribute <byte[]>("MS-CHAP2-Response");
if (msChapResponse == null)
{
_logger.Warning("Can't find MS-CHAP2-Response in message id={id} from {host:l}:{port}", request.RequestPacket.Identifier, request.RemoteEndpoint.Address, request.RemoteEndpoint.Port);
return(PacketCode.AccessReject);
}
//forti behaviour
var otpData = msChapResponse.Skip(2).Take(6).ToArray();
userAnswer = Encoding.ASCII.GetString(otpData);
break;
default:
_logger.Warning("Unable to process {auth} challange in message id={id} from {host:l}:{port}", request.RequestPacket.AuthenticationType, request.RequestPacket.Identifier, request.RemoteEndpoint.Address, request.RemoteEndpoint.Port);
return(PacketCode.AccessReject);
}
response = await _multifactorApiClient.Challenge(request, clientConfig, userName, userAnswer, state);
switch (response)
{
case PacketCode.AccessAccept:
var stateChallengePendingRequest = GetStateChallengeRequest(state);
if (stateChallengePendingRequest != null)
{
request.UserGroups = stateChallengePendingRequest.UserGroups;
request.ResponsePacket = stateChallengePendingRequest.ResponsePacket;
request.LdapAttrs = stateChallengePendingRequest.LdapAttrs;
}
break;
case PacketCode.AccessReject:
RemoveStateChallengeRequest(state);
break;
}
return(response);
}
