YUbikey MFA and customized validation URLs

[Philippe MARASSE]

Folks,

Unless I'm mistaken, I've not seen any configuration for a customized
validation URL, all URLs are hardcoded into Yubikey client class and
I've not seen any CAS configuration value related to validation URLs.

So, how to customize these URLs ?

Regards.

--
Philippe MARASSE

Responsable pôle Infrastructures - DSIO
Centre Hospitalier Henri Laborit
CS 10587 - 370 avenue Jacques Cœur
86021 Poitiers Cedex
Tel : 05.49.44.57.19

[Misagh Moayyed]

There is nothing that allows to modify the validation urls. They are built into the Yubikey API. 

-- 
Misagh

From: Philippe MARASSE <philippe...@ch-poitiers.fr>
Reply: Philippe MARASSE <philippe...@ch-poitiers.fr>
Date: September 13, 2016 at 8:22:48 PM
To: cas-...@apereo.org <cas-...@apereo.org>
Subject:  [cas-user] YUbikey MFA and customized validation URLs

Folks,

Unless I'm mistaken, I've not seen any configuration for a customized
validation URL, all URLs are hardcoded into Yubikey client class and
I've not seen any CAS configuration value related to validation URLs.

So, how to customize these URLs ?

Regards.

-- br/>Philippe MARASSE <

Responsable pôle Infrastructures - DSIO
Centre Hospitalier Henri Laborit

CS 10587 - 370 avenue Jacques Cœur br/>86021 Poitiers CCedex
Tel : 05.49.44.57.19


-- br/>You received this message because you are subscribed tto the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To post to this group, send email to cas-...@apereo.org.
Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/db15e0e4-a807-d724-c1dc-b7e1e4f8cc4c%40ch-poitiers.fr.
For more options, visit https://groups.google.com/a/apereo.org/d/optout.

[Philippe MARASSE]

I've seen : YubicoClient.setWsapiUrls(String[] wsapi), by default, the property is valued with :

protected String wsapi_urls[] = {
               "https://api.yubico.com/wsapi/2.0/verify",
               "https://api2.yubico.com/wsapi/2.0/verify",
               "https://api3.yubico.com/wsapi/2.0/verify",
               "https://api4.yubico.com/wsapi/2.0/verify",
               "https://api5.yubico.com/wsapi/2.0/verify"
            };

I think, it's the right property that I need to change, but for now, there is no configuration entry in CAS to do that.

Regards.

-- 
Philippe MARASSE

Responsable pôle Infrastructures - DSIO
Centre Hospitalier Henri Laborit
CS 10587 - 370 avenue Jacques Cœur 
86021 Poitiers Cedex
Tel : 05.49.44.57.19

[Misagh Moayyed]

Yes, all valid statements. 

I am curious; what’s your case for modifying the validation URLs? Do you wish to disable a certain API version? 

--
You received this message because you are subscribed to the Google Groups "CAS Community" group.

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To post to this group, send email to cas-...@apereo.org.
Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.

To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/94668519-eb27-59f8-e92b-ba8e8957c43e%40ch-poitiers.fr.

[Philippe MARASSE]

Actually, we're testing a few Yubikeys with customized cryptographic keys, so public Yubico API's cannot validate our tokens. I've set up a local validation server that works the very same ways Yubico's one following this :

https://developers.yubico.com/Software_Projects/YubiKey_OTP/YubiCloud_Validation_Servers/

So I need to tell yubico client to use my validation server instead of public ones.

Regards.

[Dmitriy Kopylenko]

That's a valid use case, IMO. I think we need to open up that config option. If you could file an issues on Github, that would be terrific. 

D. 

To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/cece06c2-7882-1efa-b2c6-d21a718fb86c%40ch-poitiers.fr.

[Philippe MARASSE]

Done : https://github.com/apereo/cas/issues/1998

Thank you.

[Philippe MARASSE]

Tested OK with 5.0.0 RC3-SNAPSHOT following the new configuration option cas.authn.mfa.yubikey.apiUrls

To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/bd3c3afd-2d1f-6fed-1db1-53842b7b8212%40ch-poitiers.fr.

For more options, visit https://groups.google.com/a/apereo.org/d/optout.