[java-identity-provider] branch master updated: IDP-1239 - Non-browser support for Duo authentication

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=bb1b9b72416e589dce42a35e57973b2b13420a61

The following commit(s) were added to refs/heads/master by this push:
       new  bb1b9b7   IDP-1239 - Non-browser support for Duo authentication
bb1b9b7 is described below

commit bb1b9b72416e589dce42a35e57973b2b13420a61
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Aug 14 12:46:01 2018 -0400

    IDP-1239 - Non-browser support for Duo authentication
    
    https://issues.shibboleth.net/jira/browse/IDP-1239
    
    Add HttpClient security support.
---
 .../authn/duo/impl/AbstractDuoAuthenticator.java   | 40 +++++++++++++---------
 .../system/flows/authn/duo-authn-beans.xml         |  6 ++--
 2 files changed, 28 insertions(+), 18 deletions(-)

diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/AbstractDuoAuthenticator.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/AbstractDuoAuthenticator.java
index 49ea3ed..c95d89e 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/AbstractDuoAuthenticator.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/AbstractDuoAuthenticator.java
@@ -21,6 +21,7 @@ import java.io.IOException;
 import java.io.InputStream;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.annotation.concurrent.ThreadSafe;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -31,6 +32,9 @@ import org.apache.http.HttpStatus;
 import org.apache.http.client.ClientProtocolException;
 import org.apache.http.client.HttpClient;
 import org.apache.http.client.methods.HttpUriRequest;
+import org.apache.http.client.protocol.HttpClientContext;
+import org.opensaml.security.httpclient.HttpClientSecurityParameters;
+import org.opensaml.security.httpclient.HttpClientSecuritySupport;
 
 import com.duosecurity.duoweb.DuoWebException;
 
@@ -49,38 +53,36 @@ public abstract class AbstractDuoAuthenticator extends AbstractInitializableComp
     /** HttpClient for contacting Duo. */
     @NonnullAfterInit private HttpClient httpClient;
 
+    /** HTTP client security parameters. */
+    @Nullable private HttpClientSecurityParameters httpClientSecurityParameters;
+    
     /** JSON object mapper. */
     @NonnullAfterInit private ObjectMapper objectMapper;
     
     /**
-     * Get the {@link HttpClient} to use for contacting Duo.
-     * 
-     * @return HttpClient
-     */
-    @NonnullAfterInit public HttpClient getHttpClient() {
-        return httpClient;
-    }
-
-    /**
      * Set the {@link HttpClient} to use for contacting Duo.
      * 
      * @param client HttpClient
      */
     public void setHttpClient(@Nonnull final HttpClient client) {
         ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
 
         httpClient = Constraint.isNotNull(client, "HTTP client cannot be null");
     }
 
     /**
-     * Get the JSON {@link ObjectMapper}.
+     * Set the optional client security parameters.
      * 
-     * @return ObjectMapper
+     * @param params the new client security parameters
      */
-    @NonnullAfterInit public ObjectMapper getObjectMapper() {
-        return objectMapper;
-    }
+    public void setHttpClientSecurityParameters(@Nullable final HttpClientSecurityParameters params) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
 
+        httpClientSecurityParameters = params;
+    }
+    
     /**
      * Set the JSON {@link ObjectMapper}.
      * 
@@ -88,6 +90,7 @@ public abstract class AbstractDuoAuthenticator extends AbstractInitializableComp
      */
     public void setObjectMapper(@Nonnull final ObjectMapper mapper) {
         ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
 
         objectMapper = Constraint.isNotNull(mapper, "Object mapper cannot be null");
     }
@@ -95,7 +98,8 @@ public abstract class AbstractDuoAuthenticator extends AbstractInitializableComp
     /** {@inheritDoc} */
     @Override protected void doInitialize() throws ComponentInitializationException {
         super.doInitialize();
-
+        
+        
         if (httpClient == null) {
             throw new ComponentInitializationException("HttpClient cannot be null");
         }
@@ -124,7 +128,11 @@ public abstract class AbstractDuoAuthenticator extends AbstractInitializableComp
                     throws DuoWebException, ClientProtocolException, IOException {
 
         // Make the request.
-        final HttpResponse httpResponse = getHttpClient().execute(request);
+        final HttpClientContext clientContext = HttpClientContext.create();
+        HttpClientSecuritySupport.marshalSecurityParameters(clientContext, httpClientSecurityParameters, true);
+        HttpClientSecuritySupport.addDefaultTLSTrustEngineCriteria(clientContext, request);
+        final HttpResponse httpResponse = httpClient.execute(request, clientContext);
+        HttpClientSecuritySupport.checkTLSCredentialEvaluated(clientContext, request.getURI().getScheme());
 
         // Check the HTTP response code.
         final int httpStatusCode = httpResponse.getStatusLine().getStatusCode();
diff --git a/idp-conf/src/main/resources/system/flows/authn/duo-authn-beans.xml b/idp-conf/src/main/resources/system/flows/authn/duo-authn-beans.xml
index bf65567..43ff19a 100644
--- a/idp-conf/src/main/resources/system/flows/authn/duo-authn-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/duo-authn-beans.xml
@@ -63,12 +63,14 @@
     <bean id="DuoPreauthAuthenticator" lazy-init="true"
         class="net.shibboleth.idp.authn.duo.impl.DuoPreauthAuthenticator"
         p:objectMapper-ref="shibboleth.JSONObjectMapper"
-        p:httpClient-ref="%{idp.duo.nonbrowser.httpClient:shibboleth.NonCachingHttpClient}" />
+        p:httpClient="#{getObject('shibboleth.authn.Duo.NonBrowser.HttpClient') ?: getObject('shibboleth.NonCachingHttpClient')}"
+        p:httpClientSecurityParameters="#{getObject('shibboleth.authn.Duo.NonBrowser.HttpClientSecurityParameters')}" />
 
     <bean id="DuoAuthAuthenticator" lazy-init="true"
         class="net.shibboleth.idp.authn.duo.impl.DuoAuthAuthenticator"
         p:objectMapper-ref="shibboleth.JSONObjectMapper"
-        p:httpClient-ref="%{idp.duo.nonbrowser.httpClient:shibboleth.NonCachingHttpClient}" />
+        p:httpClient="#{getObject('shibboleth.authn.Duo.NonBrowser.HttpClient') ?: getObject('shibboleth.NonCachingHttpClient')}"
+        p:httpClientSecurityParameters="#{getObject('shibboleth.authn.Duo.NonBrowser.HttpClientSecurityParameters')}" />
 
     <util:map id="shibboleth.authn.duo.DefaultClassifiedMessageMap">
         <entry key="AccountLocked">

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.