duosecurity / duo_universal_python

Duo OIDC-based two-factor authentication for Python web applications

Duo Universal Python SDK

This SDK allows a web developer to quickly add Duo's interactive, self-service, two-factor authentication to any Python3 web login form. Only Python 3 is supported.

Tested Against Python Versions:

• 3.7
• 3.8
• 3.9
• 3.10
• 3.11

TLS 1.2 and 1.3 Support

Duo_universal_python uses Python's ssl module and OpenSSL for TLS operations. Python versions 2.7 (and higher) and 3.5 (and higher) have both TLS 1.2 and TLS 1.3 support.

What's here:

• duo_universal - The Python Duo SDK for interacting with the Duo Universal Prompt
• demo - An example web application with Duo integrated
• tests - Test cases

Getting Started

To use the SDK in your existing development environment, install it from pypi (https://pypi.org/project/duo_universal).

pip3 install duo_universal

Once it's installed, see our developer documentation at https://duo.com/docs/duoweb and demo/app.py in this repo for guidance on integrating Duo 2FA into your web application.

Contribute

To contribute, fork this repo and make a pull request with your changes when they're ready.

If you're not already working from a dedicated development environment, it's recommended a virtual environment is used. Assuming a virtual environment named env, create and activate the environment:

python3 -m venv env
source env/bin/activate

Build and install the SDK from source:

pip3 install -r requirements.txt
pip3 install .

Tests

Install the test requirements:

cd tests
pip3 install -r requirements.txt

Then run tests from the test directory:

# Run an individual test file
python3 <test_name>.py

# Run all tests with unittest
python3 -m unittest

Lint

flake8

Support

Please report any bugs, feature requests, or issues to us directly at [email protected].

Thank you for using Duo!

https://duo.com/

duo_universal_python's Issues

Example parameter typo

https://duo.com/docs/duoweb#wait-for-the-redirect-from-duo-back-to-your-redirect-uri

You include the following example code at the above url:

code = request.args.get('code')

That does not work for me, but with duo_ prefixed to the parameter name it does. I assume it is a typo and it should actually read the following:

code = request.args.get('duo_code')

Parameter limits disagree with Duo documentation

Description

The code comments for the state parameter indicate the minimum length of state is 22 characters, but the Duo docs (https://duo.com/docs/oauthapi#authorization-request) indicate it's 16. Let's reconcile the two.

Expected Behavior

Anywhere the parameter limits (state and nonce primarily) are described, they agree with the Duo documentation.

Actual Behavior

The state parameter limits disagree.

Steps to Reproduce

N/A

Workarounds

N/A

M1 Mac Install

I am currently running a late 2020 MacBook Air with an M1 chip and I was unable to install using conda / pip through any of the suggested channels. Curious if anyone else had any luck installing the package on an M1 Mac and what your process was to get it to work. Please let me know if you need any more information and I'm happy to provide it.

PyPI tarball is broken

The PyPI tarball doesn't include the requirements.txt file which is explicitly used by setup.py

Duo Universal Prompt in iFrame?

Hi! This is really more of a user-experience issue that I'm having, but I was wondering whether there is any way to embed the new universal prompt into my existing website without having the user redirected to the Duo website and then back to mine? From a user perspective, it is quite jarring to go from my website with one (let's say dark) color palette and then to be tossed into a really bright one on the splash screen. If I could embed an iframe of basically just the prompt into my own website, like the old prompt allowed me to do, I think that it would be a much more seamless experience for my users. Happy to talk about it, thanks!

CORS error while trying to redirect to duo url.

Hello,
I have followed the demos and I am getting CORS error on browser when I am trying to redirect to the prompt_uri.
Any idea why?

.
.
.
    prompt_uri = duo_client.create_auth_url(username, state)

    # Redirect to prompt URI which will redirect to the client's redirect URI
    # after 2FA
    return redirect(prompt_uri)
.
.
.

Bump python dependencies

Could the python dependencies for this be bumped to latest/highest compatible if possible?

CERTIFICATE_VERIFY_FAILED error due to missing parameter in duo.conf

Following readme still leads to

duo_universal.client.DuoException: HTTPSConnectionPool(host='api-duo1.duo.test', port=443): Max retries exceeded with url: /oauth/v1/health_check (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate (_ssl.c:997)')))

Solve it by adding

duo_certs = DISABLE

to your duo.conf file

Description

Expected Behavior

Actual Behavior

Steps to Reproduce

Workarounds

Typo in health_check documentation

https://duo.com/docs/duoweb#call-health_check()

You include the following example code at the above url:

try:
  duo_client.healthcheck()

That does not work for me, but with an underscore it does. I assume it is a typo and it should actually read the following:

try:
  duo_client.health_check()

change the requirements.txt file to use PyPi

I would recommend teaching people to use PyPi. I tested it and this works:

Flask>=1.1.2
configparser>=4.0.2
duo_universal>=2.0.1

Constraint on pyjwt<2 is breaking things

Hi,
I am trying to migrate to this package (as part of migrating to the universal prompt - https://duo.com/docs/universal-prompt-update-guide)
However, the constraint on the pyjwt conflicts with another package that we use:https://github.com/python-social-auth/social-core/blob/master/requirements-base.txt#L4
Note that the reason tests are breaking is because pyjwt 2 dropped support for python 2.7 and python 3.5 both are EOL for a while now...
Maybe this library can drop support for those too ?
Alternatively, the setup.py can be modified to have a different pyjwt for different python version, i.e. python 3.5 & 2.7 have the pyjwt<2 constraint and for newer versions the constraint can be pyjwt>=2