Update for easier .NET Core integration.

[VictorioBerra]

Hello, I would like to integrate this into an existing .NET Core CLI. I am struggling to do this due to the reliance on namespaces like System.Web.Script.Serialization and System.Web.

Detailed Description

For example HttpUtility.UrlEncode could be replaced with Uri.EscapeDataString to remove reliance on System.Web.

Another odd implementation detail is usage of System.Web.Script.Serialization.JavaScriptSerializer VS something like System.Text.Json or the battle-tested Newtonsoft.Json.

Use Case

The whole point of this library is to make calling the Duo API simpler (which is anything but simple thanks to HMAC auth as opposed to OAuth2 (JWTs) but that is another discussion).

DuoSecurity would benefit from businesses having easier implementation of Duo. Many enterprises live on C#/.NET. There is a lot of business value to having a developer go from 0 to MVP by using a modern API client hosted on something like NuGet.

Duo's new DuoUniversal client is a prime example of a modern and well implemented client even showcasing ASP.NET Core web app examples leveraging Dependency Injection.

Workarounds

None at this time. Currently working to replace code with NETStandard/NETCore equivalents. Or looking into third party clients.

[AaronAtDuo]

@VictorioBerra I agree that this needs to be updated, and we have a couple folks who started on it but stalled...
#22
I'll try to get it prioritized by my team.

[AaronAtDuo]

@VictorioBerra In the meantime, I thought you might be interested in helping us improve our developer experience... if so, please see the below

Duo is looking to learn how to significantly improve the developer experience and what tools, resources, and technology (eg: sandboxes, new sdks, etc.) would best-enable customers to work faster and build things more easily with Duo's developer ecosystem. If your org is a Duo customer, and you have done development work (ex; authentication integrations, creation of a homegrown admin tool, log consumption for SIEMS, etc) with Duo's developer tools/resources in the past year, we would love to speak with you about your experience, what tools/resources you used, and your pain points.
This will be a 60-minute session during which you’ll have the opportunity to discuss your honest thoughts and feedback with Duo researchers. No preparation is necessary, and please know that this is not a sales call or product demo.
If you’re interested in participating, please email [email protected] to start the scheduling process.
Once the 60-minute session is complete, you will receive a token of appreciation in the form of a $75 e-gift card through Tremendous (options for Amazon or select retailers).
Please let me know if you have any questions!
Thanks!

[m33p]

I would agree this library could use some updating. Some of the classes it uses are now marked as obsolete in .NET 8. It would be nice to see System.Text.Json used for serialization since its included as part of .NET 8.

warning SYSLIB0051: 'Exception.Exception(SerializationInfo, StreamingContext)' is obsolete: 'This API supports obsolete formatter-based serialization. It should not be called or extended by application code.' (https://aka.ms/dotnet-warnings/SYSLIB0051)

[AaronAtDuo]

I'm taking another shot at this and making decent progress. Hopefully will have a PR up this week.

[VictorioBerra]

@AaronAtDuo If you need any examples I adapted this library to work against the Admin API with minor changes: https://github.com/orionstudt/DuoSecurity.Auth.Http

See /Core folder.

[AaronAtDuo]

Trying to handle the serialization update at the same time as the framework update is making for a very bloated and annoying diff. So I think I'll tackle just the serialization change first then worry about the framework update. AFAICT System.Text.Json has support all the way back to framework 4.6.2 (and core 6 and standard 2) so it should be possible to move to that before messing with anything else. Fingers crossed!

[m33p]

Do we know if a transition from using HttpWebRequest to something more modern like System.Net.Http.HttpClient will happen as part of this? HttpClient is supported on .NET Framework 4.5+. It is the recommended method for doing http calls and has built in async functionality.