[java-idp-plugin-duo] 07/16: Import cleanup. Improve signature validation error handling

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-duo.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=db3b942124fe6fa43a858b84d19c8a0d975d3bf0

commit db3b942124fe6fa43a858b84d19c8a0d975d3bf0
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Sep 21 09:13:16 2020 +0100

    Import cleanup. Improve signature validation error handling
---
 .../idp/plugin/authn/duo/impl/ValidateTokenSignature.java | 14 ++++++++++----
 .../idp/plugin/authn/duo/impl/AbstractDuoActionTest.java  | 15 ---------------
 2 files changed, 10 insertions(+), 19 deletions(-)

diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignature.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignature.java
index 11eb9e7..d4f4d6d 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignature.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignature.java
@@ -123,9 +123,12 @@ public class ValidateTokenSignature extends AbstractDuoAuthenticationAction {
                                 claimSet.getSubject(),integration.getClientId());
                         ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
                         return;
+                    } else {
+                        log.debug("{} Token signature is valid; using algorithm '{}' for client '{}'",
+                                getLogPrefix(),SUPPORTED_SIGNATURE_FAMILY, integration.getClientId());
+                        //is valid
+                        return;
                     }
-                    log.debug("{} Token signature is valid; using algorithm '{}' for client '{}'",
-                            getLogPrefix(),SUPPORTED_SIGNATURE_FAMILY, integration.getClientId());
                 } else {
                     log.error("{} Invalid token. Token signature algorithm not supported, token algorithm '{}',"
                             + " supported algorithms '{}', for client '{}'",getLogPrefix(),
@@ -141,8 +144,11 @@ public class ValidateTokenSignature extends AbstractDuoAuthenticationAction {
                 return;
             }
             
-        } 
-        //all good.   
+        }
+        log.error("{} Unable to validate token, unkown token type",getLogPrefix());
+        ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.AUTHN_EXCEPTION);
+        return;
+           
     }
 
 }
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractDuoActionTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractDuoActionTest.java
index abe125a..d8715b5 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractDuoActionTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractDuoActionTest.java
@@ -24,23 +24,18 @@ import static org.testng.Assert.fail;
 
 import java.text.ParseException;
 import java.time.Instant;
-import java.time.temporal.ChronoUnit;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import org.opensaml.core.config.ConfigurationService;
-import org.opensaml.core.metrics.FilteredMetricRegistry;
 import org.opensaml.profile.context.EventContext;
 import org.opensaml.profile.context.ProfileRequestContext;
 import org.springframework.webflow.execution.Event;
 import org.springframework.webflow.execution.RequestContext;
 
-import com.codahale.metrics.MetricRegistry;
 import com.nimbusds.jose.JOSEException;
 import com.nimbusds.jose.JWSHeader;
 import com.nimbusds.jose.JWSSigner;
-import com.nimbusds.jose.KeyLengthException;
 import com.nimbusds.jose.PlainHeader;
 import com.nimbusds.jose.crypto.MACSigner;
 import com.nimbusds.jose.util.Base64URL;
@@ -52,13 +47,7 @@ import com.nimbusds.jwt.SignedJWT;
 import net.shibboleth.idp.authn.AuthenticationFlowDescriptor;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.plugin.authn.duo.DefaultDuoOIDCIntegration;
-import net.shibboleth.idp.plugin.authn.duo.DuoClientException;
 import net.shibboleth.idp.plugin.authn.duo.context.DuoOIDCAuthenticationContext;
-import net.shibboleth.idp.plugin.authn.duo.model.DuoAccessDevice;
-import net.shibboleth.idp.plugin.authn.duo.model.DuoApplication;
-import net.shibboleth.idp.plugin.authn.duo.model.DuoAuthContext;
-import net.shibboleth.idp.plugin.authn.duo.model.DuoAuthDevice;
-import net.shibboleth.idp.plugin.authn.duo.model.DuoAuthToken;
 import net.shibboleth.idp.profile.RequestContextBuilder;
 
 import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
@@ -104,10 +93,6 @@ public abstract class AbstractDuoActionTest {
         ac = new AuthenticationContext();
         
         prc.addSubcontext(ac);
-        
-        //setup required for IdP 4.0.0, is no longer required in 4.0.1.
-        FilteredMetricRegistry registry = new FilteredMetricRegistry();
-        ConfigurationService.register(MetricRegistry.class, registry);
 
     }
     

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.