[java-idp-plugin-duo] branch main updated: JDUO-5 Duo auth_time semantics and principal hooks
Phil Smart
philip.smart at jisc.ac.uk
Wed Aug 12 15:48:52 UTC 2020
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-duo.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=cbb49699d10cace99caef89b8e7a328d076f47bb
The following commit(s) were added to refs/heads/main by this push:
new cbb4969 JDUO-5 Duo auth_time semantics and principal hooks
cbb4969 is described below
commit cbb49699d10cace99caef89b8e7a328d076f47bb
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Aug 12 16:48:38 2020 +0100
JDUO-5 Duo auth_time semantics and principal hooks
- Add hook to allow custom principals to be added to the subject based
on information from the context.
https://issues.shibboleth.net/jira/browse/JDUO-5
---
.../impl/ValidateDuoTokenAuthenticationResult.java | 55 ++++++++++++-
.../flows/authn/DuoOIDC/duo-oidc-authn-beans.xml | 10 ++-
.../authn/duo/impl/AbstractDuoActionTest.java | 6 +-
.../duo/impl/ValidateDuoTokenAudienceTest.java | 4 +-
.../ValidateDuoTokenAuthenticationResultTest.java | 94 +++++++++++++++++++++-
.../ValidateDuoTokenAuthenticationTimeTest.java | 10 +--
.../impl/ValidateDuoTokenExpirationTimeTest.java | 8 +-
.../duo/impl/ValidateDuoTokenIssuedAtTest.java | 6 +-
.../authn/duo/impl/ValidateDuoTokenIssuerTest.java | 6 +-
.../duo/impl/ValidateDuoTokenSubjectTest.java | 4 +-
10 files changed, 173 insertions(+), 30 deletions(-)
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
index 959dc16..a0c9bc3 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
@@ -17,6 +17,9 @@
package net.shibboleth.idp.plugin.authn.duo.impl;
import java.security.Principal;
+import java.util.Collection;
+import java.util.function.Function;
+import java.util.stream.Collectors;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -37,6 +40,7 @@ import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
/**
* A validation action that checks for a validate {@link DuoAuthToken} and directly produces an
@@ -58,12 +62,41 @@ public class ValidateDuoTokenAuthenticationResult extends AbstractValidationActi
/** Class logger.*/
@Nonnull private final Logger log = LoggerFactory.getLogger(ValidateDuoTokenAuthenticationResult.class);
- /** Duo authentiction context. **/
- @Nonnull private DuoOIDCAuthenticationContext duoContext;
+ /** Duo authentiction context. */
+ @Nullable private DuoOIDCAuthenticationContext duoContext;
+
+ /** The profile request context.*/
+ @Nullable private ProfileRequestContext prc;
/** Attempted username. */
@Nullable @NotEmpty private String username;
+ /** Hook to map context information, often Duo factors in the Duo token, to principal collections.*/
+ @Nullable private Function<ProfileRequestContext,Collection<Principal>> contextToPrincipalMappingStrategy;
+
+ /**
+ * Get the context to principal mapping strategy for mapping context information into
+ * principal collections e.g. Duo factors.
+ *
+ * @return the mapping hook
+ */
+ @Nullable public Function<ProfileRequestContext,Collection<Principal>> getContextToPrincipalMappingStrategy() {
+ return contextToPrincipalMappingStrategy;
+ }
+
+ /**
+ * Set the context to principal mapping strategy for mapping context information into
+ * principal collections e.g. Duo factors.
+ *
+ * @param hook principal mapping hook
+ */
+ public void setContextToPrincipalMappingStrategy(@Nullable final
+ Function<ProfileRequestContext,Collection<Principal>> hook) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ contextToPrincipalMappingStrategy = hook;
+ }
+
/** {@inheritDoc} */
@Override protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@@ -72,6 +105,8 @@ public class ValidateDuoTokenAuthenticationResult extends AbstractValidationActi
if (!super.doPreExecute(profileRequestContext, authenticationContext)) {
return false;
}
+ //stash the profile request context for later.
+ prc = profileRequestContext;
duoContext = authenticationContext.getSubcontext(DuoOIDCAuthenticationContext.class);
if (duoContext == null) {
@@ -121,8 +156,24 @@ public class ValidateDuoTokenAuthenticationResult extends AbstractValidationActi
/** {@inheritDoc} */
@Override protected Subject populateSubject(@Nonnull final Subject subject) {
+
+ //add the custom Duo principal
subject.getPrincipals().add(new DuoOIDCPrincipal(username));
+ //add any principals specified on the integration.
subject.getPrincipals().addAll(duoContext.getIntegration().getSupportedPrincipals(Principal.class));
+
+ //add any further principals from a function hook that can inspect the Duo response
+ if (getContextToPrincipalMappingStrategy() != null) {
+ final Collection<Principal> mapped = getContextToPrincipalMappingStrategy().apply(prc);
+ if (mapped != null) {
+ subject.getPrincipals().addAll(mapped);
+ if (log.isDebugEnabled()) {
+ log.debug("{} Added mapped Principals: {}", getLogPrefix(),
+ mapped.stream().map(Principal::getName).collect(Collectors.toUnmodifiableList()));
+ }
+ }
+ }
+
return subject;
}
diff --git a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
index 479ee38..540c4e5 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
@@ -63,6 +63,7 @@
<!-- Can override one or more of the beans above. -->
+ <!-- TODO this needs fixing, idp.home will not be substituted inside this expression. -->
<import resource="${idp.duo.oidc.config.user:%{idp.home}/conf/authn/duo-authn-config.xml}" />
@@ -98,10 +99,13 @@
class="net.shibboleth.idp.plugin.authn.duo.impl.ExchangeCodeForDuoToken" />
<bean id="ValidateDuoTokenAuthenticationResult" scope="prototype"
- class="net.shibboleth.idp.plugin.authn.duo.impl.ValidateDuoTokenAuthenticationResult"
- p:addDefaultPrincipals="#{getObject('shibboleth.authn.duo.OIDC.addDefaultPrincipals') ?: true}"
+ class="net.shibboleth.idp.plugin.authn.duo.impl.ValidateDuoTokenAuthenticationResult"
p:classifiedMessages="#{getObject('shibboleth.authn.duo.OIDC.ClassifiedMessageMap') ?: getObject('shibboleth.authn.duo.OIDC.DefaultClassifiedMessageMap')}"
- p:resultCachingPredicate="#{getObject('shibboleth.authn.duo.OIDC.resultCachingPredicate')}" />
+ p:resultCachingPredicate="#{getObject('shibboleth.authn.duo.OIDC.resultCachingPredicate')}"
+ p:cleanupHook="#{getObject('shibboleth.authn.duo.OIDC.CleanUpHook')}"
+ p:contextToPrincipalMappingStrategy="#{getObject('shibboleth.authn.duo.OIDC.ContextToPrincipalMappingStrategy')}"
+ p:addDefaultPrincipals="#{getObject('shibboleth.authn.duo.OIDC.ContextToPrincipalMappingStrategy') == null}"/>
+
<!-- TODO may not be the correct values for the new API -->
<util:map id="shibboleth.authn.duo.OIDC.DefaultClassifiedMessageMap">
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractDuoActionTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractDuoActionTest.java
index f81d2d7..64f4032 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractDuoActionTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractDuoActionTest.java
@@ -104,12 +104,14 @@ public abstract class AbstractDuoActionTest {
* @param iat issued at.
* @param authTime the auth time.
* @param apiHost TODO
+ * @param factor TODO
* @return the duo auth token.
*/
protected DuoAuthToken createDummyToken(@Nonnull final String authResult,
@Nonnull final String authResultMessage, @Nonnull final String aud,
@Nonnull final Instant exp, @Nonnull final Instant iat,
- @Nonnull final Instant authTime, @Nonnull final String apiHost) {
+ @Nonnull final Instant authTime, @Nonnull final String apiHost,
+ @Nonnull final String factor) {
return DuoAuthToken.builder()
.withIss("https://"+apiHost+"/oauth/v1/token")
.withSub("jdoe")
@@ -137,7 +139,7 @@ public abstract class AbstractDuoActionTest {
.withKey("DIU6GEFXXXXXXX")
.withName("Test")
.build())
- .withFactor("duo_push")
+ .withFactor(factor)
.withUsername("jdoe")
.withUserKey("XXXXXXX")
.build()).withAuthTime(Math.toIntExact(authTime.getEpochSecond()))
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAudienceTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAudienceTest.java
index 0815b9e..7e199a6 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAudienceTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAudienceTest.java
@@ -69,7 +69,7 @@ public class ValidateDuoTokenAudienceTest extends AbstractDuoActionTest {
addDuoIntegrationToContext();
addAttemptedFlow("authn/DuoOIDC");
dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW,"Login Succesful",CLIENT_ID,
- Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "api.duosecurity.com"));
+ Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "api.duosecurity.com", "duo_push"));
action.initialize();
final Event event = action.execute(src);
// null event is success.
@@ -84,7 +84,7 @@ public class ValidateDuoTokenAudienceTest extends AbstractDuoActionTest {
addDuoIntegrationToContext();
addAttemptedFlow("authn/DuoOIDC");
dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW,"Login Succesful","WRONG",
- Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "api.duosecurity.com"));
+ Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "api.duosecurity.com", "duo_push"));
action.initialize();
final Event event = action.execute(src);
// null event is success.
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResultTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResultTest.java
index 4f90ae6..f17ffcd 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResultTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResultTest.java
@@ -17,21 +17,33 @@
package net.shibboleth.idp.plugin.authn.duo.impl;
+
+import static org.testng.Assert.assertFalse;
+import static org.testng.Assert.assertNotNull;
import static org.testng.Assert.assertNull;
+import static org.testng.Assert.assertTrue;
+import java.security.Principal;
import java.time.Instant;
import java.time.temporal.ChronoUnit;
+import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
import java.util.HashMap;
+import java.util.List;
import java.util.Map;
+import javax.security.auth.Subject;
+
import org.springframework.webflow.execution.Event;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
import net.shbboleth.idp.plugin.authn.duo.DuoOIDCAuthAPI;
+import net.shbboleth.idp.plugin.authn.duo.context.DuoOIDCAuthenticationContext;
import net.shibboleth.idp.authn.AuthnEventIds;
+import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
/**
@@ -61,7 +73,7 @@ public class ValidateDuoTokenAuthenticationResultTest extends AbstractDuoActionT
addDuoIntegrationToContext();
addAttemptedFlow("authn/DuoOIDC");
dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW,"Login Succesful",CLIENT_ID,
- Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "api.duosecurity.com"));
+ Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "api.duosecurity.com", "duo_push"));
dc.setUsername("jdoe");
action.initialize();
@@ -100,7 +112,7 @@ public class ValidateDuoTokenAuthenticationResultTest extends AbstractDuoActionT
action.setClassifiedMessages(classifiedMessages);
dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_DENY,"Account locked",CLIENT_ID,
- Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "api.duosecurity.com"));
+ Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "api.duosecurity.com", "duo_push"));
dc.setUsername("jdoe");
action.initialize();
@@ -138,9 +150,9 @@ public class ValidateDuoTokenAuthenticationResultTest extends AbstractDuoActionT
addDuoContext();
addDuoIntegrationToContext();
addAttemptedFlow("authn/DuoOIDC");
- //made up fail message, TODO: do they describe this anywhere.
+ //made up fail message, will terminate on the duo site in reality.
dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_DENY,"Login Failed",CLIENT_ID,
- Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "api.duosecurity.com"));
+ Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "api.duosecurity.com", "duo_push"));
dc.setUsername("jdoe");
action.initialize();
@@ -148,5 +160,79 @@ public class ValidateDuoTokenAuthenticationResultTest extends AbstractDuoActionT
assertEventId(event, AuthnEventIds.INVALID_CREDENTIALS);
}
+
+ /**
+ * Test adding principals using the hook.
+ *
+ * @throws ComponentInitializationException on error.
+ */
+ @Test public void testExecuteWithPrincipalHook() throws ComponentInitializationException {
+ addDuoContext();
+ addDuoIntegrationToContext();
+ addAttemptedFlow("authn/DuoOIDC");
+ dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW,"Login Succesful",CLIENT_ID,
+ Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "api.duosecurity.com", "duo_push"));
+ dc.setUsername("jdoe");
+
+ action.setContextToPrincipalMappingStrategy(prc ->{
+
+ DuoOIDCAuthenticationContext duoContext =
+ prc.getSubcontext(AuthenticationContext.class).getSubcontext(DuoOIDCAuthenticationContext.class);
+ List<Principal> p = new ArrayList<>();
+ if ("duo_push".equals(duoContext.getAuthToken().getAuthContext().getFactor())){
+ p.add(new AuthnContextClassRefPrincipal("http://example.com/duoPush"));
+ }
+ return p;
+ });
+
+ action.initialize();
+
+ final Event event = action.execute(src);
+ // success here is a null event
+ assertNull(event);
+
+ //check the correct subject has been populated.
+ assertNotNull(prc.getSubcontext(AuthenticationContext.class).getAuthenticationResult());
+ final Subject sbj = prc.getSubcontext(AuthenticationContext.class).getAuthenticationResult().getSubject();
+ assertTrue(sbj.getPrincipals().contains(
+ new AuthnContextClassRefPrincipal("http://example.com/duoPush")));
+ }
+
+ /**
+ * Test adding principals using the hook. The principal is not added, because the factor does not match.
+ *
+ * @throws ComponentInitializationException on error.
+ */
+ @Test public void testExecuteWithPrincipalHookNoMatchingFactor() throws ComponentInitializationException {
+ addDuoContext();
+ addDuoIntegrationToContext();
+ addAttemptedFlow("authn/DuoOIDC");
+ dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW,"Login Succesful",CLIENT_ID,
+ Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "api.duosecurity.com", "duo_push"));
+ dc.setUsername("jdoe");
+
+ action.setContextToPrincipalMappingStrategy(prc ->{
+
+ DuoOIDCAuthenticationContext duoContext =
+ prc.getSubcontext(AuthenticationContext.class).getSubcontext(DuoOIDCAuthenticationContext.class);
+ List<Principal> p = new ArrayList<>();
+ if ("sms".equals(duoContext.getAuthToken().getAuthContext().getFactor())){
+ p.add(new AuthnContextClassRefPrincipal("http://example.com/sms"));
+ }
+ return p;
+ });
+
+ action.initialize();
+
+ final Event event = action.execute(src);
+ // success here is a null event
+ assertNull(event);
+
+ //check the correct subject has been populated.
+ assertNotNull(prc.getSubcontext(AuthenticationContext.class).getAuthenticationResult());
+ final Subject sbj = prc.getSubcontext(AuthenticationContext.class).getAuthenticationResult().getSubject();
+ assertFalse(sbj.getPrincipals().contains(
+ new AuthnContextClassRefPrincipal("http://example.com/sms")));
+ }
}
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationTimeTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationTimeTest.java
index 0af88ee..1d6ed14 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationTimeTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationTimeTest.java
@@ -68,7 +68,7 @@ public class ValidateDuoTokenAuthenticationTimeTest extends AbstractDuoActionTes
action.setClockSkew(Duration.of(1, ChronoUnit.MINUTES));
action.setAuthnLifetime(Duration.of(1, ChronoUnit.MINUTES));
dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW,"Login Succesful",CLIENT_ID,
- Instant.now(),Instant.now(), Instant.now(), "api.duosecurity.com"));
+ Instant.now(),Instant.now(), Instant.now(), "api.duosecurity.com", "duo_push"));
action.initialize();
final Event event = action.execute(src);
// null event is success.
@@ -90,7 +90,7 @@ public class ValidateDuoTokenAuthenticationTimeTest extends AbstractDuoActionTes
action.setClockSkew(Duration.of(1, ChronoUnit.MINUTES));
action.setAuthnLifetime(Duration.of(1, ChronoUnit.MINUTES));
dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW,"Login Succesful",CLIENT_ID,
- Instant.now(),Instant.now(), Instant.now(), "api.duosecurity.com"));
+ Instant.now(),Instant.now(), Instant.now(), "api.duosecurity.com", "duo_push"));
action.initialize();
final Event event = action.execute(src);
// null event is success.
@@ -112,7 +112,7 @@ public class ValidateDuoTokenAuthenticationTimeTest extends AbstractDuoActionTes
action.setClockSkew(Duration.of(1, ChronoUnit.MINUTES));
action.setAuthnLifetime(Duration.of(1, ChronoUnit.MINUTES));
dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW,"Login Succesful",CLIENT_ID,
- Instant.now(),Instant.now(), Instant.now().plus(Duration.of(10, ChronoUnit.MINUTES)), "api.duosecurity.com"));
+ Instant.now(),Instant.now(), Instant.now().plus(Duration.of(10, ChronoUnit.MINUTES)), "api.duosecurity.com", "duo_push"));
action.initialize();
final Event event = action.execute(src);
// null event is success.
@@ -134,7 +134,7 @@ public class ValidateDuoTokenAuthenticationTimeTest extends AbstractDuoActionTes
action.setClockSkew(Duration.of(1, ChronoUnit.MINUTES));
action.setAuthnLifetime(Duration.of(1, ChronoUnit.MINUTES));
dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW,"Login Succesful",CLIENT_ID,
- Instant.now(),Instant.now(), Instant.now().minus(Duration.of(10, ChronoUnit.MINUTES)), "api.duosecurity.com"));
+ Instant.now(),Instant.now(), Instant.now().minus(Duration.of(10, ChronoUnit.MINUTES)), "api.duosecurity.com", "duo_push"));
action.initialize();
final Event event = action.execute(src);
assertEventId(event, AuthnEventIds.AUTHN_EXCEPTION);
@@ -155,7 +155,7 @@ public class ValidateDuoTokenAuthenticationTimeTest extends AbstractDuoActionTes
action.setClockSkew(Duration.of(1, ChronoUnit.MINUTES));
action.setAuthnLifetime(Duration.of(1, ChronoUnit.MINUTES));
dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW,"Login Succesful",CLIENT_ID,
- Instant.now(),Instant.now(), Instant.now().plus(Duration.of(10, ChronoUnit.MINUTES)), "api.duosecurity.com"));
+ Instant.now(),Instant.now(), Instant.now().plus(Duration.of(10, ChronoUnit.MINUTES)), "api.duosecurity.com", "duo_push"));
action.initialize();
final Event event = action.execute(src);
assertEventId(event, AuthnEventIds.AUTHN_EXCEPTION);
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenExpirationTimeTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenExpirationTimeTest.java
index e186ce1..8163928 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenExpirationTimeTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenExpirationTimeTest.java
@@ -56,7 +56,7 @@ public class ValidateDuoTokenExpirationTimeTest extends AbstractDuoActionTest {
addDuoIntegrationToContext();
addAttemptedFlow("authn/DuoOIDC");
dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW,"Login Succesful",CLIENT_ID,
- Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "api.duosecurity.com"));
+ Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "api.duosecurity.com", "duo_push"));
action.initialize();
final Event event = action.execute(src);
// null event is success.
@@ -76,7 +76,7 @@ public class ValidateDuoTokenExpirationTimeTest extends AbstractDuoActionTest {
addAttemptedFlow("authn/DuoOIDC");
//create token, set expiry 1 day in the past.
dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW,"Login Succesful",CLIENT_ID,
- Instant.now().minus(1,ChronoUnit.DAYS),Instant.now(), Instant.now(), "api.duosecurity.com"));
+ Instant.now().minus(1,ChronoUnit.DAYS),Instant.now(), Instant.now(), "api.duosecurity.com", "duo_push"));
action.initialize();
final Event event = action.execute(src);
assertEventId(event, AuthnEventIds.AUTHN_EXCEPTION);
@@ -98,7 +98,7 @@ public class ValidateDuoTokenExpirationTimeTest extends AbstractDuoActionTest {
action.setClockSkew(Duration.of(1, ChronoUnit.MINUTES));
//create token, set expiry 50 second in the past.
dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW,"Login Succesful",CLIENT_ID,
- Instant.now().minus(50,ChronoUnit.SECONDS),Instant.now(), Instant.now(), "api.duosecurity.com"));
+ Instant.now().minus(50,ChronoUnit.SECONDS),Instant.now(), Instant.now(), "api.duosecurity.com", "duo_push"));
action.initialize();
final Event event = action.execute(src);
// null event is success.
@@ -120,7 +120,7 @@ public class ValidateDuoTokenExpirationTimeTest extends AbstractDuoActionTest {
action.setClockSkew(Duration.of(0, ChronoUnit.SECONDS));
//create token, set expiry 1 second in the past.
dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW,"Login Succesful",CLIENT_ID,
- Instant.now().minus(1,ChronoUnit.SECONDS),Instant.now(), Instant.now(), "api.duosecurity.com"));
+ Instant.now().minus(1,ChronoUnit.SECONDS),Instant.now(), Instant.now(), "api.duosecurity.com", "duo_push"));
action.initialize();
final Event event = action.execute(src);
assertEventId(event, AuthnEventIds.AUTHN_EXCEPTION);
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuedAtTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuedAtTest.java
index 1a971f0..bab9cf0 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuedAtTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuedAtTest.java
@@ -59,7 +59,7 @@ public class ValidateDuoTokenIssuedAtTest extends AbstractDuoActionTest {
addDuoIntegrationToContext();
addAttemptedFlow("authn/DuoOIDC");
dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW,"Login Succesful",CLIENT_ID,
- Instant.now(),Instant.now(), Instant.now(), "api.duosecurity.com"));
+ Instant.now(),Instant.now(), Instant.now(), "api.duosecurity.com", "duo_push"));
action.initialize();
final Event event = action.execute(src);
// null event is success.
@@ -79,7 +79,7 @@ public class ValidateDuoTokenIssuedAtTest extends AbstractDuoActionTest {
addAttemptedFlow("authn/DuoOIDC");
action.setIatMaxClockSkew(Duration.of(1, ChronoUnit.MINUTES));
dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW,"Login Succesful",CLIENT_ID,
- Instant.now(),Instant.now().minus(3,ChronoUnit.MINUTES), Instant.now(), "api.duosecurity.com"));
+ Instant.now(),Instant.now().minus(3,ChronoUnit.MINUTES), Instant.now(), "api.duosecurity.com", "duo_push"));
action.initialize();
final Event event = action.execute(src);
@@ -99,7 +99,7 @@ public class ValidateDuoTokenIssuedAtTest extends AbstractDuoActionTest {
addAttemptedFlow("authn/DuoOIDC");
action.setIatMaxClockSkew(Duration.of(1, ChronoUnit.MINUTES));
dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW,"Login Succesful",CLIENT_ID,
- Instant.now(),Instant.now().plus(3,ChronoUnit.MINUTES), Instant.now(), "api.duosecurity.com"));
+ Instant.now(),Instant.now().plus(3,ChronoUnit.MINUTES), Instant.now(), "api.duosecurity.com", "duo_push"));
action.initialize();
final Event event = action.execute(src);
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuerTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuerTest.java
index 8048d76..01add29 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuerTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuerTest.java
@@ -38,7 +38,7 @@ public class ValidateDuoTokenIssuerTest extends AbstractDuoActionTest {
dc.setUsername("jdoe");
dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW,"Login Succesful",CLIENT_ID,
- Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "api.duosecurity.com"));
+ Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "api.duosecurity.com", "duo_push"));
action.initialize();
final Event event = action.execute(src);
// null event is success.
@@ -58,7 +58,7 @@ public class ValidateDuoTokenIssuerTest extends AbstractDuoActionTest {
dc.setUsername("jdoe");
dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW,"Login Succesful",CLIENT_ID,
- Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "different.host.com"));
+ Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "different.host.com", "duo_push"));
action.initialize();
final Event event = action.execute(src);
// null event is success.
@@ -78,7 +78,7 @@ public class ValidateDuoTokenIssuerTest extends AbstractDuoActionTest {
dc.setUsername("jdoe");
dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW,"Login Succesful",CLIENT_ID,
- Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "different.host.com"));
+ Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "different.host.com", "duo_push"));
action.initialize();
final Event event = action.execute(src);
// null event is success.
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenSubjectTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenSubjectTest.java
index 0dc31c0..b32c947 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenSubjectTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenSubjectTest.java
@@ -54,7 +54,7 @@ class ValidateDuoTokenSubjectTest extends AbstractDuoActionTest {
addAttemptedFlow("authn/DuoOIDC");
dc.setUsername("jdoe");
dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW,"Login Succesful",CLIENT_ID,
- Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "api.duosecurity.com"));
+ Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "api.duosecurity.com", "duo_push"));
action.initialize();
final Event event = action.execute(src);
// null event is success.
@@ -73,7 +73,7 @@ class ValidateDuoTokenSubjectTest extends AbstractDuoActionTest {
addAttemptedFlow("authn/DuoOIDC");
dc.setUsername("different-user");
dc.setAuthToken(createDummyToken(DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW,"Login Succesful",CLIENT_ID,
- Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "api.duosecurity.com"));
+ Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(), "api.duosecurity.com", "duo_push"));
action.initialize();
final Event event = action.execute(src);
// null event is success.
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list