Add Multi-factor Authentication Support

[jzheaux]

Related to spring-projects/spring-security-samples#351

Implement N authentication factors and they will be required in the order that they are declared:

http
    .authorizeHttpRequests(...)
    .formLogin((form) -> form
        .loginPage("/login/form").permitAll()
        .factor(Customizer.withDefaults()
    )
    .oneTimeTokenLogin((ott) -> ott
        .loginPage("/login/ott").permitAll()
        .factor(Customizer.withDefaults())
    )
    // ...

This will ask for a username/password first and a one-time token second. Thereafter, the user will be considered sufficiently authenticated.

You can also compose with MfaConfigurer:

MyCustomConfigurer<HttpSecurity> custom = new MyCustomConfigurer<>();
MfaConfigurer<HttpSecurity> mfa = new MfaConfigurer("AUTHN_CUSTOM", custom);

// ...

http
    .authorizeHttpRequests(...)
    .formLogin((form) -> form.factor(Customizer.withDefaults())
    .with(custom, Customizer.withDefaults())
    .with(mfa, (mfa) -> mfa
        .authenticationEntryPoint("/authorize")
    )

You can grant a custom set of authorities:

http
    .authorizeHttpRequests((authorize) -> authorize
        .requestMatchers("/profille").hasAuthority("profile:read")
        .anyRequest().authenticated()
    )
    .formLogin((form) -> form
        .loginPage("/login/form").permitAll()
        .factor((factor) -> factor
            .grants(Duration.ofMinutes(5), "profile:read")
        )
    .oneTimeTokenLogin((ott) -> ott
       .loginPage("/login/ott").permitAll()
        .factor(Customizer.withDefaults())
    )
    // ...

In this case, the user has the profle:read authority for five minutes after having given their username and password. After five minutes, if they navigate to /profile again, they will need to re-authenticate.

All factors registered are required by default. However, more complex arrangements are possible:

http
    .authorizeHttpRequests((authorize) -> authorize
        .requestMatchers("/login/ott").access(hasAuthority("AUTHN_X509"))
        .anyRequest().access(hasAuthority("app"))
    )
    .x509((x509) -> x509
        .factor(Customizer.withDefaults())
    )
    .oneTimeTokenLogin((ott) -> ott
        .loginPage("/login/ott").permitAll()
        .factor((factor) -> factor.grants("app"))
    )
    .oauth2ResourceServer((oauth2) -> oauth2
        .jwt(Customizer.withDefaults())
        .factor((factor) -> factor.grants("app"))
    )

The above arrangement states that either Bearer Token authentication, or X.509 + OTT is sufficient to use the app. It further requires that X.509 must pass before the one-time token can be entered.

Finally, you can completely customize how a set of authorities is obtained by registering an AuthorizationEntryPoint:

@Component
public class MissingScopeAuthorizationEntryPoint implements AuthorizationEntryPoint {
    @Override 
    public boolean commence(HttpServletRequest request, HttpServletResponse response, AuthorizationRequest authz) {
        Set<String> authorities = AuthorityUtils.authoritiesListToSet(authz.getAuthorities());
        if (!authorities.contains("SCOPE_https://www.gmail.com")) {
            return false;
        }
        // formulate /authorize request to Google and redirect
    }
}

// ...

http
    .authorizeHttpRequests((authorize) -> authorize
        .requestMatchers("/email/stats").hasAuthority("SCOPE_https://www.gmail.com")
        .anyRequest().authenticated()
    )
    .oauth2Login((oauth2) -> oauth2.factor(Customizer.withDefaults())
    .exceptionHandling((exceptions) -> exceptions
        .authorizationEntryPoint((a) -> a.addAll(missingScopeAuthorizationEntryPoint))
    )