eugeniop · August 29, 2015 14:24
diff --git a/yubikey-wt.js b/yubikey-wt.js
 var request = require('request');
 var qs = require('qs');
 var jwt = require('jsonwebtoken');

 return function (context, req, res) {

 	require('async').series([
    /*
     * We only care about POST and GET
     */
    function(callback) {
      if (req.method !== 'POST' && req.method !== 'GET') {
        res.writeHead(404);
        return res.end('Page not found');
      }
      return callback();
    },

    /*
     * 1. GET: Render initial View with OTP.
     */
    function(callback) {
      if (req.method === 'GET') {
        renderOtpView();
      }
      return callback();
    },

    /* 
     * 2. Validate OTP
     */
    function(callback) {
      if (req.method === 'POST') {

 	    yubico_validate(context.data.yubikey_clientid, context.body.otp, function(err,resp) {
 	    	if (err) {
 	      		return callback(err);
 	    	}

 	    	if(resp.status==='OK'){
 	    		//Return result to Auth0 (includes OTP and Status. Only when OK)
 	    		var token = jwt.sign({
 	    					status: resp.status,
 	    					otp: resp.otp
 	    					}, 
 	    					new Buffer(context.data.yubikey_secret, 'base64'),
             					{
 						    subject: context.data.user,
 						    expiresInMinutes: 1,
 						    audience: context.data.yubikey_clientid,
 						    issuer: 'urn:auth0:yubikey:mfa'
 						});

 				res.writeHead(301, {Location: context.data.returnUrl + "?id_token=" + token});
 				res.end();
 	    	}
 	    	return callback([resp.status]);
 	    });
 		
 		return callback();
 	   }
    },
 	], function(err) {

    	if (Array.isArray(err)) {
      		return renderOtpView(err);
    	}

    	if (typeof err === 'string') {
      		return renderOtpView([err]);
    	}

    	if (typeof err === 'object') {
      		var errors = [];
      		errors.push(err.message || err);
      		return renderOtpView(errors);
  	  	}
 	});

 	function yubico_validate(clientId, otp, done){
 		var params = {
 				id: clientId,
 				otp: otp,
 				nonce: uid(16)
 			};

 		request.get('http://api.yubico.com/wsapi/2.0/verify', 
 		{
 			qs: params
 		},function(e,r,b){
 			if(e) return done(e);
 			if(r.statusCode !== 200) return done(new Error('Error: ' + r.statusCode));
 			var yubico_response=qs.parse(b.replace(/\r\n/g, '&'));
 			if(yubico_response.nonce !== params.nonce) return done(new Error('Invalid response - nonce doesn\'t match'));
 			done(null,yubico_response);
 		});
 	}

 	function uid(len) {
 	    var buf = []
 	    , chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'
 	    , charlen = chars.length;

 	    for (var i = 0; i < len; ++i) {
 	      buf.push(chars[getRandomInt(0, charlen - 1)]);
 	    }

 	    return buf.join('');
 	}

 	function getRandomInt(min, max) {
 	    return Math.floor(Math.random() * (max - min + 1)) + min;
 	}

 	function renderOtpView(errors) {
 	    res.writeHead(200, {
 	      'Content-Type': 'text/html'
 	    });
    	res.end(require('ejs').render(otpForm.stringify(), {
 	      user: context.data.user,
 	      errors: errors || []
 	    }));
 	}

 	function otpForm() {
 		/*
 		<html>
 			<body>
 		    	<form method="POST"
 		        	<p>
 		          	Hi <strong><%- user %></strong>, please tap your Yubikey.
 		        	</p>
 		        	Yubikey OTP:<br>
 		        	<input type="text" name="otp" id="otp" />
 		        	<br>
 		        	<input type="submit" value="Submit">
 		    	</form>
 		    	<div style="color: red;">
          			<% errors.forEach(function(error){ %>
          				<p>
            			<%= error %>
          				</p>
          			<%})%>
        		</div>
 			</body>
 		</html>
 		*/
 	}
 }
	var request = require('request');
	var qs = require('qs');
	var jwt = require('jsonwebtoken');

	return function (context, req, res) {

	require('async').series([
	/*
	* We only care about POST and GET
	*/
	function(callback) {
	if (req.method !== 'POST' && req.method !== 'GET') {
	res.writeHead(404);
	return res.end('Page not found');
	}
	return callback();
	},

	/*
	* 1. GET: Render initial View with OTP.
	*/
	function(callback) {
	if (req.method === 'GET') {
	renderOtpView();
	}
	return callback();
	},

	/*
	* 2. Validate OTP
	*/
	function(callback) {
	if (req.method === 'POST') {

	yubico_validate(context.data.yubikey_clientid, context.body.otp, function(err,resp) {
	if (err) {
	return callback(err);
	}

	if(resp.status==='OK'){
	//Return result to Auth0 (includes OTP and Status. Only when OK)
	var token = jwt.sign({
	status: resp.status,
	otp: resp.otp
	},
	new Buffer(context.data.yubikey_secret, 'base64'),
	{
	subject: context.data.user,
	expiresInMinutes: 1,
	audience: context.data.yubikey_clientid,
	issuer: 'urn:auth0:yubikey:mfa'
	});

	res.writeHead(301, {Location: context.data.returnUrl + "?id_token=" + token});
	res.end();
	}
	return callback([resp.status]);
	});

	return callback();
	}
	},
	], function(err) {

	if (Array.isArray(err)) {
	return renderOtpView(err);
	}

	if (typeof err === 'string') {
	return renderOtpView([err]);
	}

	if (typeof err === 'object') {
	var errors = [];
	errors.push(err.message \|\| err);
	return renderOtpView(errors);
	}
	});

	function yubico_validate(clientId, otp, done){
	var params = {
	id: clientId,
	otp: otp,
	nonce: uid(16)
	};

	request.get('http://api.yubico.com/wsapi/2.0/verify',
	{
	qs: params
	},function(e,r,b){
	if(e) return done(e);
	if(r.statusCode !== 200) return done(new Error('Error: ' + r.statusCode));
	var yubico_response=qs.parse(b.replace(/\r\n/g, '&'));
	if(yubico_response.nonce !== params.nonce) return done(new Error('Invalid response - nonce doesn\'t match'));
	done(null,yubico_response);
	});
	}

	function uid(len) {
	var buf = []
	, chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'
	, charlen = chars.length;

	for (var i = 0; i < len; ++i) {
	buf.push(chars[getRandomInt(0, charlen - 1)]);
	}

	return buf.join('');
	}

	function getRandomInt(min, max) {
	return Math.floor(Math.random() * (max - min + 1)) + min;
	}

	function renderOtpView(errors) {
	res.writeHead(200, {
	'Content-Type': 'text/html'
	});
	res.end(require('ejs').render(otpForm.stringify(), {
	user: context.data.user,
	errors: errors \|\| []
	}));
	}

	function otpForm() {
	/*
	<html>
	<body>
	<form method="POST"
	<p>
	Hi <strong><%- user %></strong>, please tap your Yubikey.
	</p>
	Yubikey OTP:<br>
	<input type="text" name="otp" id="otp" />
	<br>
	<input type="submit" value="Submit">
	</form>
	<div style="color: red;">
	<% errors.forEach(function(error){ %>
	<p>
	<%= error %>
	</p>
	<%})%>
	</div>
	</body>
	</html>
	*/
	}
	}