[java-idp-plugin-duo] branch main updated: JDUO-18 - Add a Trust Engine with pinned root CA certificates to the Duo Nimbus HTTP Client
Phil Smart
philip.smart at jisc.ac.uk
Fri Nov 6 14:02:06 UTC 2020
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-duo.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=872b722ff22ca8ce79b2c4dc49c3bf20d90a9705
The following commit(s) were added to refs/heads/main by this push:
new 872b722 JDUO-18 - Add a Trust Engine with pinned root CA certificates to the Duo Nimbus HTTP Client
872b722 is described below
commit 872b722ff22ca8ce79b2c4dc49c3bf20d90a9705
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Nov 6 14:01:47 2020 +0000
JDUO-18 - Add a Trust Engine with pinned root CA certificates to the Duo
Nimbus HTTP Client
Allow injection of a TrustEvaluator and ValidationOptions to force
revocation checking.
https://issues.shibboleth.net/jira/browse/JDUO-18
---
.../idp/plugin/authn/duo/impl/DuoJWTClaimsVerifier.java | 2 --
.../plugin/authn/duo/impl/DuoOIDCAuthnController.java | 1 -
.../plugin/authn/duo/impl/ValidateTokenSignature.java | 2 ++
.../authn/duo/module/conf/authn/duo-oidc.properties | 4 ++++
.../idp/plugin/authn/duo/duo-client-factory-bean.xml | 16 ++++++++++++----
5 files changed, 18 insertions(+), 7 deletions(-)
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoJWTClaimsVerifier.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoJWTClaimsVerifier.java
index 93fde05..23d7499 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoJWTClaimsVerifier.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoJWTClaimsVerifier.java
@@ -34,11 +34,9 @@ import com.nimbusds.jwt.proc.BadJWTException;
import com.nimbusds.jwt.proc.DefaultJWTClaimsVerifier;
import net.shibboleth.idp.authn.context.AuthenticationContext;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
/**
- *
* Extension of the {@link DefaultJWTClaimsVerifier} that also checks:
* <ol>
* <li>The IssuedAt claim exists, and is within a specified window from the current time.</li>
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnController.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnController.java
index 3226279..579c17a 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnController.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnController.java
@@ -39,7 +39,6 @@ import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.plugin.authn.duo.DuoClientException;
import net.shibboleth.idp.plugin.authn.duo.DuoException;
import net.shibboleth.idp.plugin.authn.duo.DuoOIDCClient;
-import net.shibboleth.idp.plugin.authn.duo.DuoOIDCIntegration;
import net.shibboleth.idp.plugin.authn.duo.context.DuoOIDCAuthenticationContext;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.component.AbstractInitializableComponent;
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignature.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignature.java
index b1d3c08..7d6edd6 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignature.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignature.java
@@ -46,6 +46,8 @@ import net.shibboleth.idp.plugin.authn.duo.context.DuoOIDCAuthenticationContext;
/**
* Action to validate the JWT signature. The JWT **must** be signed using the HMAC_SHA family,
* any other type including 'none', emits an error back to the flow.
+ *
+ * TODO: conditions
*/
public class ValidateTokenSignature extends AbstractDuoAuthenticationAction {
diff --git a/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/module/conf/authn/duo-oidc.properties b/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/module/conf/authn/duo-oidc.properties
index 6182791..d470342 100644
--- a/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/module/conf/authn/duo-oidc.properties
+++ b/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/module/conf/authn/duo-oidc.properties
@@ -25,3 +25,7 @@ idp.duo.oidc.redirectURL = https://something
#idp.duo.oidc.socketTimeout = PT1M
#idp.duo.oidc.maxConnectionsTotal = 100
#idp.duo.oidc.maxConnectionsPerRoute = 100
+# If you want to enable certificate revocation checking with the Nimbus "client",
+# you need to enable this property in addition to configuring a suitable means to
+# locate a revocation response, see the plugin documentation.
+#idp.duo.oidc.nimbus.checkRevocation=false
diff --git a/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/duo-client-factory-bean.xml b/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/duo-client-factory-bean.xml
index 0ba54e2..6712532 100644
--- a/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/duo-client-factory-bean.xml
+++ b/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/duo-client-factory-bean.xml
@@ -17,7 +17,7 @@
</bean>
- <!-- Create a default HTTP Client using the global http settings overrides -->
+ <!-- Create a default HTTP Client with the option to override the settings -->
<bean id="shibboleth.authn.DuoOIDC.InternalHttpClient"
class="net.shibboleth.idp.plugin.authn.duo.nimbus.DuoHttpClientFactoryBean" lazy-init="true"
p:tLSSocketFactory-ref="shibboleth.SecurityEnhancedTLSSocketFactory"
@@ -33,13 +33,21 @@
class="org.opensaml.security.httpclient.HttpClientSecurityParameters">
<property name="tLSTrustEngine">
<bean parent="shibboleth.StaticPKIXTrustEngine"
- p:certificates="#{getObject('shibboleth.authn.DuoOIDC.DuoTrustedCertificates') ?: getObject('shibboleth.authn.DuoOIDC.DefaultDuoTrustedCertificates')}"
- p:checkNames="false" />
+ p:certificates="#{getObject('shibboleth.authn.DuoOIDC.TrustedCertificates') ?: getObject('shibboleth.authn.DuoOIDC.DefaultTrustedCertificates')}"
+ p:trustEvaluator="#{getObject('shibboleth.authn.DuoOIDC.TrustEvaluator') ?: getObject('shibboleth.authn.DuoOIDC.DefaultTrustEvaluator')}"
+ p:checkNames="false"/>
</property>
</bean>
+ <bean id="shibboleth.authn.DuoOIDC.DefaultTrustEvaluator" class="org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator">
+ <property name="pKIXValidationOptions">
+ <bean class="org.opensaml.security.x509.impl.CertPathPKIXValidationOptions"
+ p:forceRevocationEnabled="%{idp.duo.oidc.nimbus.checkRevocation:false}"/>
+ </property>
+ </bean>
+
<!-- Default set of trusted CAs -->
- <util:list id="shibboleth.authn.DuoOIDC.DefaultDuoTrustedCertificates" value-type="java.lang.String">
+ <util:list id="shibboleth.authn.DuoOIDC.DefaultTrustedCertificates" value-type="java.lang.String">
<value>classpath:/net/shibboleth/idp/plugin/authn/duo/trust/AmazonRootCA1.crt</value>
<value>classpath:/net/shibboleth/idp/plugin/authn/duo/trust/AmazonRootCA2.crt</value>
<value>classpath:/net/shibboleth/idp/plugin/authn/duo/trust/AmazonRootCA3.crt</value>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list