[java-idp-plugin-duo] branch main updated: Javadoc fixes, plugin improvements, namespace improvements
Phil Smart
philip.smart at jisc.ac.uk
Fri Dec 11 11:33:05 UTC 2020
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-duo.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=66b7832644e677422b960b64a16c5caa5872ae0c
The following commit(s) were added to refs/heads/main by this push:
new 66b7832 Javadoc fixes, plugin improvements, namespace improvements
66b7832 is described below
commit 66b7832644e677422b960b64a16c5caa5872ae0c
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Dec 11 11:32:59 2020 +0000
Javadoc fixes, plugin improvements, namespace improvements
---
.../authn/duo/DefaultDuoOIDCIntegration.java | 4 ++--
.../idp/plugin/authn/duo/DuoOIDCClient.java | 2 +-
.../authn/duo/impl/DuoOIDCAuthnController.java | 2 +-
.../impl/ValidateDuoTokenAuthenticationResult.java | 3 +--
.../plugin/authn/duo/impl/ValidateTokenClaims.java | 6 ++---
.../flows/authn/DuoOIDC/duo-oidc-authn-beans.xml | 4 ++--
.../authn/duo/sdk/impl/DuoSDKClientAdaptor.java | 2 ++
.../plugin/authn/duo/duo-client-factory-bean.xml | 6 ++---
.../authn/duo/sdk/conf/authn/duo-oidc.properties | 6 ++---
.../idp/plugin/authn/duo/sdk/module.properties | 17 ++++++++------
.../idp/plugin/authn/duo/sdk/plugin.properties | 2 +-
.../plugin/authn/duo/nimbus/impl/NimbusClient.java | 2 ++
.../plugin/authn/duo/duo-client-factory-bean.xml | 26 +++++++++++-----------
.../duo/nimbus/conf/authn/duo-oidc.properties | 4 ++--
.../idp/plugin/authn/duo/nimbus/module.properties | 17 ++++++++------
.../idp/plugin/authn/duo/nimbus/plugin.properties | 2 +-
16 files changed, 57 insertions(+), 48 deletions(-)
diff --git a/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/DefaultDuoOIDCIntegration.java b/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/DefaultDuoOIDCIntegration.java
index 2c0f26f..7884188 100644
--- a/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/DefaultDuoOIDCIntegration.java
+++ b/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/DefaultDuoOIDCIntegration.java
@@ -37,9 +37,9 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
/**
- * Wrapper for use with Duo OIDC integrations. Class is made effectively immutable once initialized.
+ * Wrapper for use with Duo OIDC integrations. Class is an initializable component and is hence
+ * made effectively immutable once initialized.
*/
-//TODO: would need more explanation as to why this becomes immutable - otherwise remove.
public class DefaultDuoOIDCIntegration extends AbstractInitializableComponent implements DuoOIDCIntegration{
/** API host. */
diff --git a/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/DuoOIDCClient.java b/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/DuoOIDCClient.java
index 96dc7c9..f5605c1 100644
--- a/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/DuoOIDCClient.java
+++ b/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/DuoOIDCClient.java
@@ -26,7 +26,7 @@ import net.shibboleth.idp.plugin.authn.duo.model.DuoHealthCheck;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
/**
- * A client for handling Duo OIDC 2FA interactions.
+ * A client for handling Duo OIDC 2FA interactions. Clients are required to be thread-safe.
*/
public interface DuoOIDCClient extends DuoOIDCClientCapabilities{
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnController.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnController.java
index 2c70cd9..1cc7b01 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnController.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnController.java
@@ -55,7 +55,7 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
*
*/
@Controller
- at RequestMapping("%{idp.authn.DuoOIDC.externalAuthnPath:/Authn/Duo/2FA}")
+ at RequestMapping("%{idp.duo.oidc.externalAuthnPath:/Authn/Duo/2FA}")
public class DuoOIDCAuthnController extends AbstractInitializableComponent{
/** The name of the Http parameter that stores the authorisation code.*/
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
index 5d24390..b4115b4 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
@@ -241,8 +241,7 @@ public class ValidateDuoTokenAuthenticationResult extends AbstractValidationActi
@Nonnull final AuthenticationContext authenticationContext) {
super.buildAuthenticationResult(profileRequestContext, authenticationContext);
- //TODO: is this still the case for this MFA plugin? or should it support a mode where the username is not already supplied c14n'ed.
- // Bypass c14n. We already operate on a canonical name, so just re-confirm it.
+ // Bypass c14n. We already operate on a canonical name, so just re-confirm it.
profileRequestContext.getSubcontext(SubjectCanonicalizationContext.class, true).setPrincipalName(username);
}
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenClaims.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenClaims.java
index 8e14b4d..057b1dc 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenClaims.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenClaims.java
@@ -45,8 +45,8 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
/**
* Action that validates the claims of the Duo id_token using the supplied {@link JWTClaimsSetVerifier}. The
* verifier <b>must</b> be thread-safe and validate the claims set against the OpenID Connect core 1.0
- * section 3.1.3.7 specification, and those required by Duo. However, the action can not guarantee the
- * verifier behaves in this way.
+ * section 3.1.3.7 specification, and those required by Duo. However, the action can not guarantee
+ * verification behaves in this way.
*
* @pre
*
@@ -83,7 +83,7 @@ public class ValidateTokenClaims extends AbstractDuoAuthenticationAction {
/** The parsed claimset. */
@Nullable private JWTClaimsSet claimsSet;
- /** The JWT claims verify use to verify the claimsset.*/
+ /** The JWT claims verify used to verify the claimsset.*/
@NonnullAfterInit private JWTClaimsSetVerifier<ProfileRequestJWTSecurityContext> claimsVerifier;
/** {@inheritDoc} */
diff --git a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
index e5ad12b..5f34aad 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
@@ -17,7 +17,7 @@
<bean class="net.shibboleth.idp.profile.impl.ProfileActionBeanPostProcessor" />
<bean id="shibboleth.authn.DuoOIDC.externalAuthnPath" class="java.lang.String"
- c:_0="servletRelative:%{idp.authn.DuoOIDC.externalAuthnPath:/Authn/Duo/2FA/}" />
+ c:_0="servletRelative:%{idp.duo.oidc.externalAuthnPath:/Authn/Duo/2FA/}" />
<!-- Default strategy function to obtain the external path. -->
<bean id="shibboleth.authn.DuoOIDC.externalAuthnPathStrategy" parent="shibboleth.Functions.Constant"
@@ -42,7 +42,7 @@
<!-- Duo Client factory and bean registry -->
<bean id="shibboleth.authn.DuoOIDC.clientRegistry" scope="singleton"
class="net.shibboleth.idp.plugin.authn.duo.impl.DefaultDuoOIDCClientRegistry"
- p:clientFactory-ref="%{idp.duo.oidc.clientFactoryBean:shibboleth.authn.DuoOIDC.native.sdk.clientFactory}" />
+ p:clientFactory-ref="%{idp.duo.oidc.clientFactoryBean:shibboleth.authn.DuoOIDC.sdk.clientFactory}" />
<!-- Load all (or none) factory bean definitions from the classpath. The actual factory bean to use is defined in the
client registry and overridable by the property idp.duo.oidc.clientFactoryBean -->
diff --git a/idp-duo-native-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/sdk/impl/DuoSDKClientAdaptor.java b/idp-duo-native-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/sdk/impl/DuoSDKClientAdaptor.java
index fcef7fd..9d2d5c6 100644
--- a/idp-duo-native-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/sdk/impl/DuoSDKClientAdaptor.java
+++ b/idp-duo-native-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/sdk/impl/DuoSDKClientAdaptor.java
@@ -25,6 +25,7 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import javax.annotation.concurrent.ThreadSafe;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -59,6 +60,7 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
*
* <p>This is package private, and can/should only be instantiated by the {@link DuoSDKClientFactory}.</p>
*/
+ at ThreadSafe
final class DuoSDKClientAdaptor extends AbstractDuoOIDCClient{
/** Class logger. */
diff --git a/idp-duo-native-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/duo-client-factory-bean.xml b/idp-duo-native-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/duo-client-factory-bean.xml
index 724fe05..79766a2 100644
--- a/idp-duo-native-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/duo-client-factory-bean.xml
+++ b/idp-duo-native-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/duo-client-factory-bean.xml
@@ -10,14 +10,14 @@
default-init-method="initialize" default-destroy-method="destroy">
- <bean id="shibboleth.authn.DuoOIDC.native.sdk.clientFactory"
+ <bean id="shibboleth.authn.DuoOIDC.sdk.clientFactory"
class="net.shibboleth.idp.plugin.authn.duo.sdk.impl.DuoSDKClientFactory" scope="singleton"
- p:caCerts="#{getObject('shibboleth.authn.DuoOIDC.native.sdk.caCerts') ?: getObject('shibboleth.authn.DuoOIDC.native.sdk.defaultCaCerts')}">
+ p:caCerts="#{getObject('shibboleth.authn.DuoOIDC.sdk.TrustedCertificates') ?: getObject('shibboleth.authn.DuoOIDC.sdk.DefaultTrustedCertificates')}">
</bean>
<!-- The Default set of CA Certificate Pins used by the Duo SDK -->
- <util:list id="shibboleth.authn.DuoOIDC.native.sdk.defaultCaCerts" value-type="java.lang.String"
+ <util:list id="shibboleth.authn.DuoOIDC.sdk.DefaultTrustedCertificates" value-type="java.lang.String"
list-class="java.util.ArrayList">
<value>sha256/I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o=</value>
<value>sha256/r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E=</value>
diff --git a/idp-duo-native-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties b/idp-duo-native-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties
index d1a87b9..04a6e41 100644
--- a/idp-duo-native-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties
+++ b/idp-duo-native-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties
@@ -3,7 +3,7 @@
# Configure for your particular integration settings
idp.duo.oidc.apiHost = hostname
idp.duo.oidc.clientId = clientid
-idp.duo.oidc.redirectURL = https://something
+idp.duo.oidc.redirectURL = https://<hostname>:<port>/idp/profile/Authn/Duo/2FA/duo-callback
# We suggest defining this in credentials/secrets.properties
#idp.duo.oidc.secretKey = key
@@ -14,9 +14,9 @@ idp.duo.oidc.redirectURL = https://something
#idp.duo.oidc.endpoint.authorize = /oauth/v1/authorize
# Controls the "back-end" OIDC implementation.
-# shibboleth.authn.DuoOIDC.native.sdk.clientFactory (Duo WebSDK-based)
+# shibboleth.authn.DuoOIDC.sdk.clientFactory (Duo WebSDK-based)
# shibboleth.authn.DuoOIDC.nimbus.clientFactory (Shibboleth Nimbus-based)
-idp.duo.oidc.clientFactoryBean = shibboleth.authn.DuoOIDC.native.sdk.clientFactory
+idp.duo.oidc.clientFactoryBean = shibboleth.authn.DuoOIDC.sdk.clientFactory
# With the Nimbus "client" impl, controls for HttpClient behavior
# These default to the global HttpClient options in services.properties
diff --git a/idp-duo-native-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/module.properties b/idp-duo-native-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/module.properties
index fe455f0..b0d7367 100644
--- a/idp-duo-native-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/module.properties
+++ b/idp-duo-native-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/module.properties
@@ -3,10 +3,13 @@
# Class to Module ID mappings
net.shibboleth.idp.plugin.authn.duo.sdk.DuoOIDCWebSDKModule = idp.authn.DuoOIDC
-idp.authn.Duo.name = Duo "Universal Prompt" OIDC-based Authentication
-idp.authn.Duo.desc = Login flow for Duo Security's second-factor authentication service using the OIDC-based Universal Prompt via Duo's WebSDK
-idp.authn.Duo.url = /DuoOIDCAuthnConfiguration
-idp.authn.Duo.1.src = /net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc-authn-config.xml
-idp.authn.Duo.1.dest = conf/authn/duo-oidc-authn-config.xml
-idp.authn.Duo.2.src = /net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties
-idp.authn.Duo.2.dest = conf/authn/duo-oidc.properties
+# Module Owner
+idp.authn.DuoOIDC.plugin = net.shibboleth.idp.plugin.authn.duo.sdk
+
+idp.authn.DuoOIDC.name = Duo "Universal Prompt" OIDC-based Authentication
+idp.authn.DuoOIDC.desc = Login flow for Duo Security's second-factor authentication service using the OIDC-based Universal Prompt via Duo's WebSDK
+idp.authn.DuoOIDC.url = /DuoOIDCAuthnConfiguration
+idp.authn.DuoOIDC.1.src = /net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc-authn-config.xml
+idp.authn.DuoOIDC.1.dest = conf/authn/duo-oidc-authn-config.xml
+idp.authn.DuoOIDC.2.src = /net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties
+idp.authn.DuoOIDC.2.dest = conf/authn/duo-oidc.properties
diff --git a/idp-duo-native-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/plugin.properties b/idp-duo-native-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/plugin.properties
index 9bd7b37..a4020ee 100644
--- a/idp-duo-native-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/plugin.properties
+++ b/idp-duo-native-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/plugin.properties
@@ -2,7 +2,7 @@
plugin.id = net.shibboleth.idp.plugin.authn.duo.sdk
# Only used when package manifest is not available
-plugin.version = 1.0.0
+plugin.version = 0.0.1
# No prereqs
#plugin.modules.required =
diff --git a/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClient.java b/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClient.java
index 81c5ebc..2856588 100644
--- a/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClient.java
+++ b/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClient.java
@@ -24,6 +24,7 @@ import java.text.ParseException;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import javax.annotation.concurrent.ThreadSafe;
import org.apache.http.HttpResponse;
import org.apache.http.HttpStatus;
@@ -53,6 +54,7 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
/**
* A Duo client using the Nimbus OIDC library. Can/should only be instantiated by the corresponding factory method.
*/
+ at ThreadSafe
final class NimbusClient extends AbstractDuoOIDCClient{
/** The only supported client assertion type.*/
diff --git a/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/duo-client-factory-bean.xml b/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/duo-client-factory-bean.xml
index cacbf6e..d10b6b9 100644
--- a/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/duo-client-factory-bean.xml
+++ b/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/duo-client-factory-bean.xml
@@ -11,14 +11,14 @@
<bean id="shibboleth.authn.DuoOIDC.nimbus.clientFactory"
class="net.shibboleth.idp.plugin.authn.duo.nimbus.impl.NimbusClientFactory" scope="singleton"
- p:httpClient="#{getObject('shibboleth.authn.DuoOIDC.HttpClient') ?: getObject('shibboleth.authn.DuoOIDC.InternalHttpClient')}"
- p:httpClientSecurityParameters="#{getObject('shibboleth.authn.DuoOIDC.HttpClientSecurityParameters')}"
- p:objectMapper-ref="shibboleth.authn.DuoOIDC.JSONObjectMapper">
+ p:httpClient="#{getObject('shibboleth.authn.DuoOIDC.nimbus.HttpClient') ?: getObject('shibboleth.authn.DuoOIDC.nimbus.InternalHttpClient')}"
+ p:httpClientSecurityParameters="#{getObject('shibboleth.authn.DuoOIDC.nimbus.HttpClientSecurityParameters')}"
+ p:objectMapper-ref="shibboleth.authn.DuoOIDC.nimbus.JSONObjectMapper">
</bean>
<!-- Create a default HTTP Client with the option to override the settings -->
- <bean id="shibboleth.authn.DuoOIDC.InternalHttpClient"
+ <bean id="shibboleth.authn.DuoOIDC.nimbus.InternalHttpClient"
class="net.shibboleth.idp.plugin.authn.duo.nimbus.impl.DuoHttpClientFactoryBean" lazy-init="true"
p:tLSSocketFactory-ref="shibboleth.SecurityEnhancedTLSSocketFactory"
p:connectionDisregardTLSCertificate="%{idp.duo.oidc.connectionDisregardTLSCertificate:false}"
@@ -29,18 +29,18 @@
p:maxConnectionsPerRoute="%{idp.duo.oidc.maxConnectionsPerRoute:%{idp.httpclient.maxConnectionsPerRoute:100}}" />
<!-- Pinned Duo endpoint root CA certificate TrustEngine -->
- <bean id="shibboleth.authn.DuoOIDC.HttpClientSecurityParameters"
+ <bean id="shibboleth.authn.DuoOIDC.nimbus.HttpClientSecurityParameters"
class="org.opensaml.security.httpclient.HttpClientSecurityParameters">
<property name="tLSTrustEngine">
<bean parent="shibboleth.StaticPKIXTrustEngine"
- p:certificates="#{getObject('shibboleth.authn.DuoOIDC.TrustedCertificates') ?: getObject('shibboleth.authn.DuoOIDC.DefaultTrustedCertificates')}"
- p:trustEvaluator="#{getObject('shibboleth.authn.DuoOIDC.TrustEvaluator') ?: getObject('shibboleth.authn.DuoOIDC.DefaultTrustEvaluator')}"
+ p:certificates="#{getObject('shibboleth.authn.DuoOIDC.nimbus.TrustedCertificates') ?: getObject('shibboleth.authn.DuoOIDC.nimbus.DefaultTrustedCertificates')}"
+ p:trustEvaluator="#{getObject('shibboleth.authn.DuoOIDC.nimbus.TrustEvaluator') ?: getObject('shibboleth.authn.DuoOIDC.nimbus.DefaultTrustEvaluator')}"
p:CRLs="#{getObject('shibboleth.authn.DuoOIDC.tls.CRLs')}"
p:checkNames="false"/>
</property>
</bean>
- <bean id="shibboleth.authn.DuoOIDC.DefaultTrustEvaluator" class="org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator">
+ <bean id="shibboleth.authn.DuoOIDC.nimbus.DefaultTrustEvaluator" class="org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator">
<property name="pKIXValidationOptions">
<bean class="org.opensaml.security.x509.impl.CertPathPKIXValidationOptions"
p:forceRevocationEnabled="%{idp.duo.oidc.nimbus.checkRevocation:false}"/>
@@ -48,7 +48,7 @@
</bean>
<!-- Default set of trusted CAs -->
- <util:list id="shibboleth.authn.DuoOIDC.DefaultTrustedCertificates" value-type="java.lang.String">
+ <util:list id="shibboleth.authn.DuoOIDC.nimbus.DefaultTrustedCertificates" value-type="java.lang.String">
<value>classpath:/net/shibboleth/idp/plugin/authn/duo/trust/AmazonRootCA1.crt</value>
<value>classpath:/net/shibboleth/idp/plugin/authn/duo/trust/AmazonRootCA2.crt</value>
<value>classpath:/net/shibboleth/idp/plugin/authn/duo/trust/AmazonRootCA3.crt</value>
@@ -63,24 +63,24 @@
<!-- Create a default object mapper. Setup should not change once injected -->
- <bean id="shibboleth.authn.DuoOIDC.JSONObjectMapper" class="com.fasterxml.jackson.databind.ObjectMapper" />
+ <bean id="shibboleth.authn.DuoOIDC.nimbus.JSONObjectMapper" class="com.fasterxml.jackson.databind.ObjectMapper" />
<bean class="org.springframework.beans.factory.config.MethodInvokingBean"
- p:targetObject-ref="shibboleth.authn.DuoOIDC.JSONObjectMapper" p:targetMethod="setSerializationInclusion">
+ p:targetObject-ref="shibboleth.authn.DuoOIDC.nimbus.JSONObjectMapper" p:targetMethod="setSerializationInclusion">
<property name="arguments">
<util:constant static-field="com.fasterxml.jackson.annotation.JsonInclude.Include.NON_NULL" />
</property>
</bean>
<bean class="org.springframework.beans.factory.config.MethodInvokingBean"
- p:targetObject-ref="shibboleth.authn.DuoOIDC.JSONObjectMapper" p:targetMethod="registerModule">
+ p:targetObject-ref="shibboleth.authn.DuoOIDC.nimbus.JSONObjectMapper" p:targetMethod="registerModule">
<property name="arguments">
<bean class="com.fasterxml.jackson.datatype.jsr310.JavaTimeModule" />
</property>
</bean>
<bean class="org.springframework.beans.factory.config.MethodInvokingBean"
- p:targetObject-ref="shibboleth.authn.DuoOIDC.JSONObjectMapper" p:targetMethod="setDateFormat">
+ p:targetObject-ref="shibboleth.authn.DuoOIDC.nimbus.JSONObjectMapper" p:targetMethod="setDateFormat">
<property name="arguments">
<bean class="java.text.SimpleDateFormat" c:_0="YYYY-MM-dd'T'HH:mm:ss.SSSZZ" />
</property>
diff --git a/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties b/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties
index 5218962..e3bae0a 100644
--- a/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties
+++ b/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties
@@ -3,7 +3,7 @@
# Configure for your particular integration settings
idp.duo.oidc.apiHost = hostname
idp.duo.oidc.clientId = clientid
-idp.duo.oidc.redirectURL = https://something
+idp.duo.oidc.redirectURL = https://<hostname>:<port>/idp/profile/Authn/Duo/2FA/duo-callback
# We suggest defining this in credentials/secrets.properties
#idp.duo.oidc.secretKey = key
@@ -14,7 +14,7 @@ idp.duo.oidc.redirectURL = https://something
#idp.duo.oidc.endpoint.authorize = /oauth/v1/authorize
# Controls the "back-end" OIDC implementation.
-# shibboleth.authn.DuoOIDC.native.sdk.clientFactory (Duo WebSDK-based)
+# shibboleth.authn.DuoOIDC.sdk.clientFactory (Duo WebSDK-based)
# shibboleth.authn.DuoOIDC.nimbus.clientFactory (Shibboleth Nimbus-based)
idp.duo.oidc.clientFactoryBean = shibboleth.authn.DuoOIDC.nimbus.clientFactory
diff --git a/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/module.properties b/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/module.properties
index 189df6a..7865f52 100644
--- a/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/module.properties
+++ b/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/module.properties
@@ -3,10 +3,13 @@
# Class to Module ID mappings
net.shibboleth.idp.plugin.authn.duo.nimbus.DuoOIDCNimbusModule = idp.authn.DuoOIDC
-idp.authn.Duo.name = Duo "Universal Prompt" OIDC-based Authentication
-idp.authn.Duo.desc = Login flow for Duo Security's second-factor authentication service using the OIDC-based Universal Prompt via native OIDC libraries
-idp.authn.Duo.url = /DuoOIDCAuthnConfiguration
-idp.authn.Duo.1.src = /net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc-authn-config.xml
-idp.authn.Duo.1.dest = conf/authn/duo-oidc-authn-config.xml
-idp.authn.Duo.2.src = /net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties
-idp.authn.Duo.2.dest = conf/authn/duo-oidc.properties
+# Module Owner
+idp.authn.DuoOIDC.plugin = net.shibboleth.idp.plugin.authn.duo.nimbus
+
+idp.authn.DuoOIDC.name = Duo "Universal Prompt" OIDC-based Authentication
+idp.authn.DuoOIDC.desc = Login flow for Duo Security's second-factor authentication service using the OIDC-based Universal Prompt via native OIDC libraries
+idp.authn.DuoOIDC.url = /DuoOIDCAuthnConfiguration
+idp.authn.DuoOIDC.1.src = /net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc-authn-config.xml
+idp.authn.DuoOIDC.1.dest = conf/authn/duo-oidc-authn-config.xml
+idp.authn.DuoOIDC.2.src = /net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties
+idp.authn.DuoOIDC.2.dest = conf/authn/duo-oidc.properties
diff --git a/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/plugin.properties b/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/plugin.properties
index 9cf5101..6dc787a 100644
--- a/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/plugin.properties
+++ b/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/plugin.properties
@@ -2,7 +2,7 @@
plugin.id = net.shibboleth.idp.plugin.authn.duo.nimbus
# Only used when package manifest is not available
-plugin.version = 1.0.0
+plugin.version = 0.0.1
# No prereqs
#plugin.modules.required =
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list