[java-idp-plugin-duo] branch main updated: Add default cleanup hook on successful authentication

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-duo.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=65f2d273748aa04781902c2649d252bc39f480b5

The following commit(s) were added to refs/heads/main by this push:
       new  65f2d27   Add default cleanup hook on successful authentication
65f2d27 is described below

commit 65f2d273748aa04781902c2649d252bc39f480b5
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Dec 21 12:14:20 2020 +0000

    Add default cleanup hook on successful authentication
    
    Removes the DuoOIDCAuthenticationContext by default, can be overridden
---
 .../impl/ValidateDuoTokenAuthenticationResult.java  | 21 +++++++++++++++++++++
 .../flows/authn/DuoOIDC/duo-oidc-authn-beans.xml    |  5 ++++-
 .../impl/AbstractAuthnXmlFlowExecutionTests.java    | 10 ++++++++++
 3 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
index 53f73bd..04435b0 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
@@ -21,6 +21,7 @@ import java.security.Principal;
 import java.text.ParseException;
 import java.util.Collection;
 import java.util.Map;
+import java.util.function.Consumer;
 import java.util.function.Function;
 import java.util.stream.Collectors;
 
@@ -41,6 +42,7 @@ import net.shibboleth.idp.authn.AuthenticationResult;
 import net.shibboleth.idp.authn.AuthnEventIds;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
+import net.shibboleth.idp.authn.context.UsernamePasswordContext;
 import net.shibboleth.idp.authn.duo.DuoPrincipal;
 import net.shibboleth.idp.plugin.authn.duo.DuoException;
 import net.shibboleth.idp.plugin.authn.duo.DuoOIDCAuthAPI;
@@ -244,5 +246,24 @@ public class ValidateDuoTokenAuthenticationResult extends AbstractValidationActi
          // Bypass c14n. We already operate on a canonical name, so just re-confirm it.
         profileRequestContext.getSubcontext(SubjectCanonicalizationContext.class, true).setPrincipalName(username);
     }
+    
+    /**
+     * A default cleanup hook that removes the {@link DuoOIDCAuthenticationContext} from the tree.
+     */
+    public static class DuoOIDCCleanupHook implements Consumer<ProfileRequestContext> {
+
+        /** {@inheritDoc} */
+        public void accept(@Nullable final ProfileRequestContext input) {
+            if (input != null) {
+                final AuthenticationContext authnCtx = input.getSubcontext(AuthenticationContext.class);
+                if (authnCtx != null) {
+                    final DuoOIDCAuthenticationContext duoCtx = authnCtx.getSubcontext(DuoOIDCAuthenticationContext.class);
+                    if (duoCtx != null) {
+                        authnCtx.removeSubcontext(duoCtx);
+                    }
+                }
+            }
+        }
+    }
 
 }
diff --git a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
index 5f34aad..555812d 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
@@ -93,12 +93,15 @@
 
     <bean id="ExchangeCodeForDuoToken" scope="prototype"
         class="net.shibboleth.idp.plugin.authn.duo.impl.ExchangeCodeForDuoToken" />
+        
+    <bean id="shibboleth.authn.DuoOIDC.DefaultCleanupHook" 
+        class="net.shibboleth.idp.plugin.authn.duo.impl.ValidateDuoTokenAuthenticationResult.DuoOIDCCleanupHook" />
 
     <bean id="ValidateDuoTokenAuthenticationResult" scope="prototype"
         class="net.shibboleth.idp.plugin.authn.duo.impl.ValidateDuoTokenAuthenticationResult"        
         p:classifiedMessages="#{getObject('shibboleth.authn.DuoOIDC.ClassifiedMessageMap') ?: getObject('shibboleth.authn.DuoOIDC.DefaultClassifiedMessageMap')}"
         p:resultCachingPredicate="#{getObject('shibboleth.authn.DuoOIDC.resultCachingPredicate')}"
-        p:cleanupHook="#{getObject('shibboleth.authn.DuoOIDC.CleanUpHook')}"
+        p:cleanupHook="#{getObject('shibboleth.authn.DuoOIDC.CleanUpHook') ?: getObject('shibboleth.authn.DuoOIDC.DefaultCleanupHook')}"
         p:contextToPrincipalMappingStrategy="#{getObject('shibboleth.authn.DuoOIDC.ContextToPrincipalMappingStrategy')}" 
         p:addDefaultPrincipals="#{getObject('shibboleth.authn.DuoOIDC.ContextToPrincipalMappingStrategy') == null}"/>
 
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractAuthnXmlFlowExecutionTests.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractAuthnXmlFlowExecutionTests.java
index 3d12a4a..bf6ae9c 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractAuthnXmlFlowExecutionTests.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractAuthnXmlFlowExecutionTests.java
@@ -23,6 +23,7 @@ import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
+import java.util.function.Consumer;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -312,6 +313,15 @@ public abstract class AbstractAuthnXmlFlowExecutionTests extends CustomAbstractX
             //register the client factory
             builderContext.registerBean("shibboleth.authn.DuoOIDC.test.clientFactory", clientFactory);
         }
+        
+        //create a no-op cleanup hook, so the DuoOIDCAuthenticationContext is not removed for testing
+        builderContext.registerBean("shibboleth.authn.DuoOIDC.CleanUpHook", new Consumer<ProfileRequestContext>() {
+
+            @Override
+            public void accept(ProfileRequestContext t) {
+               return;
+                
+            }});
                        
     }
     

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.