[java-idp-plugin-duo] branch main updated: JDUO-24 Duo's WebSDK now requests the authorization code as 'duo_code'
Phil Smart
philip.smart at jisc.ac.uk
Wed Dec 16 11:40:39 UTC 2020
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-duo.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=5a4936191e11f4b43228f678d0e1fa8946d9f3e9
The following commit(s) were added to refs/heads/main by this push:
new 5a49361 JDUO-24 Duo's WebSDK now requests the authorization code as 'duo_code'
5a49361 is described below
commit 5a4936191e11f4b43228f678d0e1fa8946d9f3e9
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Dec 16 11:40:25 2020 +0000
JDUO-24 Duo's WebSDK now requests the authorization code as 'duo_code'
Now supports both code or duo_code in the callback controller. Hope to
remove this when Duo's WebSDK allows setting it back to code.
https://issues.shibboleth.net/jira/browse/JDUO-24
---
.../authn/duo/impl/DuoOIDCAuthnController.java | 18 ++++++++-
.../authn/duo/impl/DuoOIDCAuthnControllerTest.java | 44 ++++++++++++++++++++++
idp-duo-sdk-client-impl/pom.xml | 2 +-
3 files changed, 61 insertions(+), 3 deletions(-)
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnController.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnController.java
index 1cc7b01..bfe6079 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnController.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnController.java
@@ -61,6 +61,12 @@ public class DuoOIDCAuthnController extends AbstractInitializableComponent{
/** The name of the Http parameter that stores the authorisation code.*/
@Nonnull @NotEmpty public static final String CODE_PARAMETER = "code";
+ /**
+ * The name of the Http parameter that stores the authorisation code
+ * when using the Duo WebSDK client.
+ */
+ @Nonnull @NotEmpty public static final String DUO_CODE_PARAMETER = "duo_code";
+
/** The name of the Http parameter that stores the state value.*/
@Nonnull @NotEmpty public static final String STATE_PARAMETER = "state";
@@ -164,9 +170,17 @@ public class DuoOIDCAuthnController extends AbstractInitializableComponent{
final String code = httpRequest.getParameter(CODE_PARAMETER);
final String state = httpRequest.getParameter(STATE_PARAMETER);
- if (state == null || code == null) {
+
+ //if duo's webSDK becomes OAuth2.0 complaint again, remove this
+ final String duoCode = httpRequest.getParameter(DUO_CODE_PARAMETER);
+
+ if (state == null || (code == null && duoCode == null)) {
throw new ExternalAuthenticationException("Duo response must contain a 'code' and 'state' parameter");
}
+ if (code != null && duoCode != null) {
+ throw new ExternalAuthenticationException("Duo response can not contain both a 'code' and "
+ + "'duo_code' parameter");
+ }
final String key;
final String nonce;
@@ -188,7 +202,7 @@ public class DuoOIDCAuthnController extends AbstractInitializableComponent{
return;
}
- duoContext.setAuthorizationCode(code);
+ duoContext.setAuthorizationCode(code != null ? code : duoCode);
duoContext.setResponseState(nonce);
ExternalAuthentication.finishExternalAuthentication(key, httpRequest, httpResponse);
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnControllerTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnControllerTest.java
index 5dd0741..9f1dc13 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnControllerTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnControllerTest.java
@@ -127,6 +127,50 @@ public class DuoOIDCAuthnControllerTest extends AbstractTestNGSpringContextTests
//add and mock attributes of the servlet context.
exportServletContextAttributes();
}
+
+ /**
+ * Test specific to the Duo WebSDK's use of the duo_code parameter to store the
+ * OAuth2.0 auth code.
+ *
+ * @throws Exception on error.
+ */
+ @Test
+ public void testCallbackDuoCode() throws Exception {
+
+ mockMvc.perform(get("/Authn/Duo/2FA/duo-callback").
+ param("duo_code", CODE).
+ param("state",state)).
+ andDo(print()).
+ andExpect(status().
+ is3xxRedirection());
+
+ //check the duo context is populated correctly.
+ DuoOIDCAuthenticationContext duoContext = extractDuoContext();
+ assertEquals(CODE,duoContext.getAuthorizationCode());
+ //the state we aim to preserve is just the nonce component of the state parameter
+ assertEquals(NONCE, duoContext.getResponseState());
+ }
+
+ /**
+ * Test specific to the Duo WebSDK's use of the duo_code parameter to store the
+ * OAuth2.0 auth code. The controller should not accept both a duo_code and code
+ * parameter at the same time.
+ *
+ * @throws Exception on error.
+ */
+ @Test
+ public void testCallbackDuoCodeAndCode() throws Exception {
+ try {
+ mockMvc.perform(get("/Authn/Duo/2FA/duo-callback").
+ param("duo_code", CODE).
+ param("code", CODE).
+ param("state",state)).
+ andDo(print());
+ } catch (final NestedServletException e) {
+ assertTrue(e.getCause() instanceof ExternalAuthenticationException);
+ }
+
+ }
/**
* Start a Duo 2FA request.
diff --git a/idp-duo-sdk-client-impl/pom.xml b/idp-duo-sdk-client-impl/pom.xml
index 9bfb536..f578d22 100644
--- a/idp-duo-sdk-client-impl/pom.xml
+++ b/idp-duo-sdk-client-impl/pom.xml
@@ -10,7 +10,7 @@
</parent>
<artifactId>idp-plugin-duo-sdk-client-impl</artifactId>
- <name>Shibboleth IdP :: Plugins :: Duo 2FA Web SDK implementation</name>
+ <name>Shibboleth IdP :: Plugins :: Duo 2FA Web SDK client implementation</name>
<description>IdP Duo OIDC 2FA native Duo SDK implementation.</description>
<packaging>jar</packaging>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list