AENG-378: EAS POC - #1827
Conversation
Introduces eight new LC keys used by the EAS push-MFA gate: - zimbra_okta_mfa_enabled - zimbra_okta_org_url - zimbra_okta_api_token - zimbra_okta_push_deadline_ms - zimbra_okta_push_poll_interval_ms - zimbra_okta_http_connect_timeout_ms - zimbra_okta_http_read_timeout_ms - zimbra_okta_device_trust_ttl_ms Defaults leave the gate disabled (zimbra_okta_mfa_enabled=false), so existing deployments are unaffected until an admin sets the org URL, API token, and enables the flag. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
Rakeshkumar More seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account. You have signed the CLA already but the status is still pending? Let us recheck it. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
|
||
| // Okta push MFA for EAS. Disabled unless zimbra_okta_mfa_enabled is set true and | ||
| // zimbra_okta_org_url + zimbra_okta_api_token are populated. | ||
| public static final KnownKey zimbra_okta_mfa_enabled = KnownKey.newKey(false); |
There was a problem hiding this comment.
🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.naming.ConstantNameCheck> reported by reviewdog 🐶
Name 'zimbra_okta_mfa_enabled' must match pattern '^[A-Z][A-Z0-9](_[A-Z0-9]+)$'.
| // Okta push MFA for EAS. Disabled unless zimbra_okta_mfa_enabled is set true and | ||
| // zimbra_okta_org_url + zimbra_okta_api_token are populated. | ||
| public static final KnownKey zimbra_okta_mfa_enabled = KnownKey.newKey(false); | ||
| public static final KnownKey zimbra_okta_org_url = KnownKey.newKey(""); |
There was a problem hiding this comment.
🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.whitespace.EmptyLineSeparatorCheck> reported by reviewdog 🐶
'VARIABLE_DEF' should be separated from previous line.
| // Okta push MFA for EAS. Disabled unless zimbra_okta_mfa_enabled is set true and | ||
| // zimbra_okta_org_url + zimbra_okta_api_token are populated. | ||
| public static final KnownKey zimbra_okta_mfa_enabled = KnownKey.newKey(false); | ||
| public static final KnownKey zimbra_okta_org_url = KnownKey.newKey(""); |
There was a problem hiding this comment.
🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.naming.ConstantNameCheck> reported by reviewdog 🐶
Name 'zimbra_okta_org_url' must match pattern '^[A-Z][A-Z0-9](_[A-Z0-9]+)$'.
| // zimbra_okta_org_url + zimbra_okta_api_token are populated. | ||
| public static final KnownKey zimbra_okta_mfa_enabled = KnownKey.newKey(false); | ||
| public static final KnownKey zimbra_okta_org_url = KnownKey.newKey(""); | ||
| public static final KnownKey zimbra_okta_api_token = KnownKey.newKey(""); |
There was a problem hiding this comment.
🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.whitespace.EmptyLineSeparatorCheck> reported by reviewdog 🐶
'VARIABLE_DEF' should be separated from previous line.
| // zimbra_okta_org_url + zimbra_okta_api_token are populated. | ||
| public static final KnownKey zimbra_okta_mfa_enabled = KnownKey.newKey(false); | ||
| public static final KnownKey zimbra_okta_org_url = KnownKey.newKey(""); | ||
| public static final KnownKey zimbra_okta_api_token = KnownKey.newKey(""); |
There was a problem hiding this comment.
🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.naming.ConstantNameCheck> reported by reviewdog 🐶
Name 'zimbra_okta_api_token' must match pattern '^[A-Z][A-Z0-9](_[A-Z0-9]+)$'.
| public static final KnownKey zimbra_okta_push_deadline_ms = KnownKey.newKey(25_000L); | ||
| public static final KnownKey zimbra_okta_push_poll_interval_ms = KnownKey.newKey(2_000L); | ||
| public static final KnownKey zimbra_okta_http_connect_timeout_ms = KnownKey.newKey(5_000L); | ||
| public static final KnownKey zimbra_okta_http_read_timeout_ms = KnownKey.newKey(10_000L); |
There was a problem hiding this comment.
🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.naming.ConstantNameCheck> reported by reviewdog 🐶
Name 'zimbra_okta_http_read_timeout_ms' must match pattern '^[A-Z][A-Z0-9](_[A-Z0-9]+)$'.
| public static final KnownKey zimbra_okta_http_connect_timeout_ms = KnownKey.newKey(5_000L); | ||
| public static final KnownKey zimbra_okta_http_read_timeout_ms = KnownKey.newKey(10_000L); | ||
| // How long an Okta-approved (account,deviceId) tuple stays trusted before another push is required. | ||
| public static final KnownKey zimbra_okta_device_trust_ttl_ms = KnownKey.newKey(30L * 24 * 60 * 60 * 1000); |
There was a problem hiding this comment.
🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.whitespace.EmptyLineSeparatorCheck> reported by reviewdog 🐶
'VARIABLE_DEF' should be separated from previous line.
| public static final KnownKey zimbra_okta_http_connect_timeout_ms = KnownKey.newKey(5_000L); | ||
| public static final KnownKey zimbra_okta_http_read_timeout_ms = KnownKey.newKey(10_000L); | ||
| // How long an Okta-approved (account,deviceId) tuple stays trusted before another push is required. | ||
| public static final KnownKey zimbra_okta_device_trust_ttl_ms = KnownKey.newKey(30L * 24 * 60 * 60 * 1000); |
There was a problem hiding this comment.
🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.naming.ConstantNameCheck> reported by reviewdog 🐶
Name 'zimbra_okta_device_trust_ttl_ms' must match pattern '^[A-Z][A-Z0-9](_[A-Z0-9]+)$'.
| // is auto-promoted to the device-trust cache without a second push. This handles clients | ||
| // (notably Outlook mobile) that send several EAS requests with different DeviceIds during | ||
| // the same setup session. | ||
| public static final KnownKey zimbra_okta_recent_approval_window_ms = KnownKey.newKey(60_000L); |
There was a problem hiding this comment.
🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.whitespace.EmptyLineSeparatorCheck> reported by reviewdog 🐶
'VARIABLE_DEF' should be separated from previous line.
| // is auto-promoted to the device-trust cache without a second push. This handles clients | ||
| // (notably Outlook mobile) that send several EAS requests with different DeviceIds during | ||
| // the same setup session. | ||
| public static final KnownKey zimbra_okta_recent_approval_window_ms = KnownKey.newKey(60_000L); |
There was a problem hiding this comment.
🚫 [checkstyle] <com.puppycrawl.tools.checkstyle.checks.naming.ConstantNameCheck> reported by reviewdog 🐶
Name 'zimbra_okta_recent_approval_window_ms' must match pattern '^[A-Z][A-Z0-9](_[A-Z0-9]+)$'.
|
I have just seen the work done in: https://github.com/Zimbra/zm-mailbox/commits/feat/eas-okta-mfa/ . Relying on localconfig variables implies that this feature is not going to be multi-tenant friendly. What happens if we run a SaaS and two different clients have different I'll assume for now that it's easier to draft PoC using xml for saving extra keys rather than messing around with ldap values... and that later on you will consider this to be a per-domain setting. |
3 participants
AENG-378: EAS POC