[management] [mfa] HTTP factor

[tcompiegne]

:rainbow: Feature

As a 'an application owner'

I want to 'validate the MFA challenge of my end-users via an HTTP call'

So that 'they can access their account'

:sunrise_over_mountains: Additional information

• This plugin will be part of our enterprise edition
• This plugin should be compatible with AM 3.15.x
• We MUST be able to manage HTTP headers and HTTP body with support of Expression Language
• HTTP proxy MUST be supported as well
• We should be able to skip MFA enrollment page ??
• We should have access to the whole request (not only the code but every params) from the MFA challenge page

:camera: Mockups

:books: Documentation required

Provide link to the issue for documentation update

:superhero: Acceptance criteria

• [ ] Given 'an end-user who wants to sign-in with MFA enabled' Then 'the end-user will verify its account' When 'using HTTP factor'

:warning: Potential impacts

What are the impacted versions?

3.18

:heavy_check_mark: Definition of Done

For each User Story everything on the list must be considered, select only what was required

• [ ] Acceptance criteria met and tested
• [ ] Sonar Cloud quality gate passes
• [ ] CircleCi checks pass
• [ ] Cypress or Postman API check passes
• [ ] Test containers passed if modifications on the repository modules
• [ ] Developer created draft documentation PR
• [ ] New migration scripts checked Can be run multiple times but only makes changes the first time Display to user what script has done
• [ ] Validated on appropriate environment
• [ ] Existing test cases refactored

:rocket:

[omatthewsgravitee]

Hey team! Please add your planning poker estimate with ZenHub @ashraf706 @farmborough @LalithaGu @leleueri @patelami @remisultan

[tcompiegne]

After investigation, the HTTP factor will be treated like the other factors with two methods :

• Enroll MFA HTTP call
• Verify MFA challenge HTTP call