duosecurity/duo_dotnet

Duo two-factor authentication for ASP.NET web applications

duo_dotnet's Issues

What are DUO_EXPIRE & APP_EXPIRE constants for ?

Hi guys, I'm wondering who can provide a little bit more information about this two constants.

duo_dotnet/DuoWeb/DuoWeb.cs

Line 25 in aaf3f37

const int DUO_EXPIRE = 300;

duo_dotnet/DuoWeb/DuoWeb.cs

Line 26 in aaf3f37

const int APP_EXPIRE = 3600;

Is APP_EXPIRE the recommended way to define the expiration for the session after the user is logged with Duo ?

Thanks

Signed authenticate request succeeds after DUO_EXPIRE (5 mins) interval has passed

Hi,
I create the sig_request for the duo iframe with the DUO_EXPIRE set to 5 minutes. I tried clicking "Send Me a Push" 6, 12 or even 25 minutes later and always get the successful authenticate response. The expiration time of the duo part in the respponse is always "time of 'send me a push click'" + ~1-1.5 minutes.
The sig_request is formed using DateTime.UtcNow

duo_dotnet/DuoWeb/DuoWeb.cs

Line 57 in aaf3f37

DateTime current_time_value = current_time ?? DateTime.UtcNow;

Am I missing something?

Thank You

Nuget Packages

Can you provide/maintain a Nuget package for this?

dotnetcore2.0 support?

Is there any support for 2fa outside of using the full framework? I need to use this product on a site that will be hosted on a linux server and uses dotnetcore 2 and aspnetcore 2. The DuoWeb project does not seem to be compatible with dotnetcore2.0.

Replace HMACSHA1

Please consider upgrading to HMACSHA512 for the crypto.

How to bypass the iframe and send direct push?

Hello guys,

Thank you for great documentation. we are doing the integration with our IOT device and need to bypass the iframe and send direct push after recognizing the username.

Please provide some guidance on how to achieve this in duo web SDK javascript code.

Thank you in advance.

DUOWeb.dll - Does not contain a strong name

I am working on a POC to integrate DUO security with our Existing ASP membership provider to use with Sharepoint 2016. For this I am using the DUO free trail. When I add the DUOWeb dll to our project and deploy I get the following error.

System.IO.FileLoadException occurred
HResult=0x80131044
Message=Could not load file or assembly 'DuoWeb, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null' or one of its dependencies. A strongly-named assembly is required. (Exception from HRESULT: 0x80131044)
Source=

I know it's because the DuoWeb dll is not fully signed. Is there a possibility to obtain a fully trusted dll.
Thank you

The iframe is not doing a POST back, it's a GET

The iframe is not doing a POST back, it's a GET and there's no sig_response.

I am working with Visual Studio, .net 4.5, duo_dotnet, Duo-Web-v2.min.js (I've tried v1 too)

I also have to wonder why the demo reads the whole stream instead of dealing with a run of the mill post back. I don't think that's too much to ask.