Skip to content

Commit 23da836

Browse files
cvogt729cvogt729
committed
initial commit
0 parents  commit 23da836

32 files changed

+6301
-0
lines changed

‎LICENSE

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
BSD 3-Clause License
2+
3+
Copyright (c) 2024, Automatic Controls Equipment Systems, Inc.
4+
All rights reserved.
5+
6+
Redistribution and use in source and binary forms, with or without
7+
modification, are permitted provided that the following conditions are met:
8+
9+
1. Redistributions of source code must retain the above copyright notice, this
10+
list of conditions and the following disclaimer.
11+
12+
2. Redistributions in binary form must reproduce the above copyright notice,
13+
this list of conditions and the following disclaimer in the documentation
14+
and/or other materials provided with the distribution.
15+
16+
3. Neither the name of the copyright holder nor the names of its
17+
contributors may be used to endorse or promote products derived from
18+
this software without specific prior written permission.
19+
20+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
21+
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22+
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
23+
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
24+
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25+
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
26+
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
27+
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
28+
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
29+
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

‎README.md

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
2+
# MFA Add-On
3+
4+
WebCTRL is a trademark of Automated Logic Corporation. Any other trademarks mentioned herein are the property of their respective owners.
5+
6+
## Installation
7+
8+
1. If your server requires signed add-ons, copy the authenticating certificate [*ACES.cer*](https://github.com/automatic-controls/addon-dev-script/blob/main/ACES.cer?raw=true) to the *./addons* directory of your WebCTRL installation folder.
9+
10+
2. Install [*MFA.addon*](https://github.com/automatic-controls/mfa-addon/releases/latest/download/MFA.addon) using the WebCTRL interface.
11+
12+
## General Information
13+
14+
This add-on provides the ability to use multi-factor authentication when logging into WebCTRL. This add-on has been tested on WebCTRL8.5 and WebCTRL9.0. The add-on uses WebCTRL's email server configuration to send a random 6-digit code to a user's email address upon login. Security codes expire in 5 minutes, and users get 3 attempts to enter the code correctly. After logging in, an item will show up in the system menu allowing users to configure or change the MFA email address associated to their account.
15+
16+
![](./root/webapp/images/system_menu.png)
17+
18+
- After installing the add-on, you must logout and login for the *Configure MFA* button to show up in the system menu.
19+
20+
System administrators can change settings in the add-on's main page. MFA emails can be viewed or changed for any user. If a user accidentically configures an incorrect email for MFA, a system administrator can navigate to this page and delete the relevant email mapping.
21+
22+
![](./root/webapp/images/main_page.png)
23+
24+
Users can be added to a restriction bypass whitelist which makes them behave as if MFA is not enforced, service logins are allowed, and MFA bypass on email server failure is enabled (described in more detail below).
25+
26+
| Setting | Description |
27+
| - | - |
28+
| ***Enforce MFA*** | When MFA is enforced, all non-whitelisted users will be forced to configure MFA when they login. |
29+
| ***Allow Service Logins*** | When unchecked, non-whitelisted users with MFA enabled will be unable to login to WebCTRL services such as SOAP and TELNET (these services are incompatible with MFA). |
30+
| ***Bypass MFA on Email Server Failure*** | When WebCTRL fails to connect to its email server, MFA security codes cannot be sent. This option permits MFA to be bypassed in such a case. Otherwise, non-whitelisted users with MFA enabled will not be able to login. |
31+
32+
I suggest adding a least one operator to the restriction bypass whitelist, especially if MFA is enforced and bypass MFA on email failure is disabled. Whitelisted operators can still configure and use MFA on their accounts.

‎config/BUILD_DETAILS

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
JDK Version:
2+
openjdk 22.0.1 2024-04-16
3+
OpenJDK Runtime Environment (build 22.0.1+8-16)
4+
OpenJDK 64-Bit Server VM (build 22.0.1+8-16, mixed mode, sharing)
5+
6+
Compilation Flags:
7+
--release 11
8+
9+
Runtime Dependencies:
10+
addonsupport-api-addon-1.10.0
11+
alarmmanager-api-addon-1.10.0
12+
bacnet-api-core-1.10.007-20240227.1003r
13+
directaccess-api-addon-1.10.0
14+
tomcat-embed-core-9.0.87
15+
webaccess-api-addon-1.10.0
16+
xdatabase-api-addon-1.10.0
17+
common-9.0.002
18+
commonbaseutils-2.0.5
19+
commonexceptions-9.0.002
20+
core-9.0.002
21+
core-api-9.0.002
22+
extensionsupport-api-9.0.002
23+
javax.mail-1.5.6
24+
webaccess-api-9.0.002
25+
26+
Packaged Dependencies:

‎config/COMPILE_FLAGS

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
--release 11

‎config/RUNTIME_DEPS

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
file:core:modules\core
2+
file:core-api:modules\core
3+
file:common:modules\common
4+
file:commonexceptions:modules\commonexceptions
5+
file:commonbaseutils:bin\lib
6+
file:webaccess-api:modules\webaccess
7+
file:extensionsupport-api:modules\extensionsupport
8+
file:javax.mail:bin\lib

‎ext/deploy.bat

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
@echo off
2+
if "%WebCTRL%" EQU "" goto :bad
3+
if "%addonFile%" EQU "" goto :bad
4+
if "%certFile%" EQU "" goto :bad
5+
if /i "%*" EQU "--help" (
6+
echo DEPLOY Copies the .addon archive and certificate file to the bound WebCTRL installation.
7+
exit /b 0
8+
)
9+
if "%*" NEQ "" (
10+
echo Unexpected parameter.
11+
exit /b 1
12+
)
13+
if not exist "%addonFile%" (
14+
echo Cannot deploy because !name!.addon does not exist.
15+
exit /b 1
16+
)
17+
echo Deploying...
18+
if "!name!" EQU "AddonDevRefresher" (
19+
echo Cannot be used to self-deploy.
20+
echo Deployment unsuccessful.
21+
exit /b 1
22+
)
23+
if not exist "%WebCTRL%\programdata\addons" mkdir "%WebCTRL%\programdata\addons" >nul 2>nul
24+
copy /y "%certFile%" "%WebCTRL%\programdata\addons\%certFileName%" >nul
25+
copy /y "%addonFile%" "%WebCTRL%\programdata\addons\!name!.update" >nul
26+
if %ErrorLevel% NEQ 0 (
27+
echo Deployment unsuccessful.
28+
exit /b 1
29+
)
30+
set /a count=0
31+
:waitUpdate
32+
timeout 1 /nobreak >nul
33+
set /a count+=1
34+
if exist "%WebCTRL%\programdata\addons\!name!.update" (
35+
if "%count%" EQU "60" (
36+
echo Timeout occurred.
37+
echo Deployment unsuccessful.
38+
exit /b 1
39+
) else (
40+
goto :waitUpdate
41+
)
42+
)
43+
if exist "%WebCTRL%\programdata\addons\!name!.addon" (
44+
echo Deployment successful.
45+
exit /b 0
46+
) else (
47+
echo Deployment unsuccessful.
48+
exit /b 1
49+
)
50+
51+
:bad
52+
echo This script should not be invoked as a stand-alone application.
53+
echo You must use this file as an extension to addon-dev-script.
54+
echo https://github.com/automatic-controls/addon-dev-script
55+
echo Press any key to exit.
56+
pause >nul
57+
exit /b 1

‎root/info.xml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
<extension version="1">
2+
<name>MFA</name>
3+
<description>In order to provide MFA, one-time security codes are emailed to users upon login.</description>
4+
<version>0.1.0</version>
5+
<vendor>Automatic Controls Equipment Systems, Inc.</vendor>
6+
<web-operator-provider>aces.webctrl.mfa.core.MFAProvider</web-operator-provider>
7+
<system-menu-provider>aces.webctrl.mfa.web.SystemMenuEditor</system-menu-provider>
8+
</extension>

‎root/webapp/WEB-INF/web.xml

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
3+
<web-app>
4+
5+
<listener>
6+
<listener-class>aces.webctrl.mfa.core.Initializer</listener-class>
7+
</listener>
8+
9+
<welcome-file-list>
10+
<welcome-file>index</welcome-file>
11+
</welcome-file-list>
12+
13+
<servlet>
14+
<servlet-name>MainPage</servlet-name>
15+
<servlet-class>aces.webctrl.mfa.web.MainPage</servlet-class>
16+
</servlet>
17+
<servlet-mapping>
18+
<servlet-name>MainPage</servlet-name>
19+
<url-pattern>/index</url-pattern>
20+
</servlet-mapping>
21+
22+
<servlet>
23+
<servlet-name>QueryMFAPage</servlet-name>
24+
<servlet-class>aces.webctrl.mfa.web.QueryMFAPage</servlet-class>
25+
</servlet>
26+
<servlet-mapping>
27+
<servlet-name>QueryMFAPage</servlet-name>
28+
<url-pattern>/QueryMFA</url-pattern>
29+
</servlet-mapping>
30+
31+
<servlet>
32+
<servlet-name>ConfigureMFAPage</servlet-name>
33+
<servlet-class>aces.webctrl.mfa.web.ConfigureMFAPage</servlet-class>
34+
</servlet>
35+
<servlet-mapping>
36+
<servlet-name>ConfigureMFAPage</servlet-name>
37+
<url-pattern>/ConfigureMFA</url-pattern>
38+
</servlet-mapping>
39+
40+
<servlet>
41+
<servlet-name>ChangeEmailPage</servlet-name>
42+
<servlet-class>aces.webctrl.mfa.web.ChangeEmailPage</servlet-class>
43+
</servlet>
44+
<servlet-mapping>
45+
<servlet-name>ChangeEmailPage</servlet-name>
46+
<url-pattern>/ChangeEmail</url-pattern>
47+
</servlet-mapping>
48+
49+
<security-constraint>
50+
<web-resource-collection>
51+
<web-resource-name>WEB</web-resource-name>
52+
<url-pattern>/*</url-pattern>
53+
</web-resource-collection>
54+
</security-constraint>
55+
56+
<filter>
57+
<filter-name>RoleFilterAJAX</filter-name>
58+
<filter-class>com.controlj.green.addonsupport.web.RoleFilter</filter-class>
59+
<init-param>
60+
<param-name>roles</param-name>
61+
<param-value>login</param-value>
62+
</init-param>
63+
</filter>
64+
<filter-mapping>
65+
<filter-name>RoleFilterAJAX</filter-name>
66+
<url-pattern>/documentation.html</url-pattern>
67+
<url-pattern>/documentation.md</url-pattern>
68+
</filter-mapping>
69+
70+
</web-app>

0 commit comments

Comments
 (0)