[java-idp-plugin-duo] 08/16: Start native Nimbus client
Phil Smart
philip.smart at jisc.ac.uk
Fri Oct 2 10:40:59 UTC 2020
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-duo.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=bf94af79b327324b49f4922216dcf9f9cee8b33a
commit bf94af79b327324b49f4922216dcf9f9cee8b33a
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Sep 22 17:28:12 2020 +0100
Start native Nimbus client
---
.../authn/duo/impl/DuoJWTClaimsVerifier.java | 14 ++++-
idp-plugin-duo-nimbus-client/pom.xml | 64 ++++++++++++++++++++++
.../idp/plugin/authn/duo/nimbus/NimbusClient.java | 29 ++++++++++
.../authn/duo/nimbus/NimbusClientFactory.java | 18 ++++++
pom.xml | 1 +
5 files changed, 124 insertions(+), 2 deletions(-)
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoJWTClaimsVerifier.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoJWTClaimsVerifier.java
index 52f987b..93fde05 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoJWTClaimsVerifier.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoJWTClaimsVerifier.java
@@ -43,12 +43,13 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
* <ol>
* <li>The IssuedAt claim exists, and is within a specified window from the current time.</li>
* <li>If the auth_time (when the End-User authentication took place) claim
- * is within a valid expiration window. Only when forced authentication is requested.</li>
+ * is within a valid expiration window. Only applies when forced authentication is requested.</li>
* </ol>
*/
@ThreadSafe
public class DuoJWTClaimsVerifier extends DefaultJWTClaimsVerifier<ProfileRequestJWTSecurityContext>{
+ //TODO: move this to the DuoOIDAuthAPI constants?
/** The name of the authentication time claim.*/
@Nonnull public static final String AUTH_TIME_CLAIM_NAME = "auth_time";
@@ -108,13 +109,22 @@ public class DuoJWTClaimsVerifier extends DefaultJWTClaimsVerifier<ProfileReques
public void verify(@Nonnull final JWTClaimsSet claimsSet, @Nonnull final ProfileRequestJWTSecurityContext context)
throws BadJWTException {
if (context == null) {
- throw new BadJWTException("Duo claims verifier requires the IdP security context");
+ throw new BadJWTException("Duo claims verifier requires the ProfileRequest security context");
}
super.verify(claimsSet,context);
verifyIat(claimsSet);
verifyAuthenticationTime(claimsSet,context);
}
+ /**
+ * Verifies if the auth_time (when the End-User authentication took place) is within a
+ * valid expiration window. Only applies to forced authentications.
+ *
+ * @param claimsSet the JWT claimset.
+ * @param context the profile request security context.
+ *
+ * @throws BadJWTException if the auth_time is invalid.
+ */
private void verifyAuthenticationTime(@Nonnull final JWTClaimsSet claimsSet,
@Nonnull final ProfileRequestJWTSecurityContext context) throws BadJWTException {
diff --git a/idp-plugin-duo-nimbus-client/pom.xml b/idp-plugin-duo-nimbus-client/pom.xml
new file mode 100644
index 0000000..add6f0f
--- /dev/null
+++ b/idp-plugin-duo-nimbus-client/pom.xml
@@ -0,0 +1,64 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+ <modelVersion>4.0.0</modelVersion>
+
+ <parent>
+ <groupId>net.shibboleth.idp.plugin</groupId>
+ <artifactId>idp-plugin-duo-parent</artifactId>
+ <version>0.0.1-SNAPSHOT</version>
+ </parent>
+
+ <artifactId>idp-plugin-duo-nimbus-client</artifactId>
+ <name>Shibboleth IdP :: Plugins :: Duo 2FA Nimbus client implementation</name>
+ <description>IdP Duo OIDC 2FA Nimbus client implementation.</description>
+ <packaging>jar</packaging>
+
+ <properties>
+ <checkstyle.configLocation>${project.basedir}/../checkstyle.xml</checkstyle.configLocation>
+ <automatic.module.name>net.shibboleth.idp.plugin.duo.sdk.impl</automatic.module.name>
+ </properties>
+
+ <dependencies>
+ <dependency>
+ <groupId>net.shibboleth.idp.plugin</groupId>
+ <artifactId>idp-plugin-duo-api</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>com.nimbusds</groupId>
+ <artifactId>nimbus-jose-jwt</artifactId>
+ <version>9.0</version>
+ </dependency>
+ <dependency>
+ <groupId>com.fasterxml.jackson.core</groupId>
+ <artifactId>jackson-databind</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>com.fasterxml.jackson.datatype</groupId>
+ <artifactId>jackson-datatype-jsr310</artifactId>
+ </dependency>
+
+ </dependencies>
+
+ <build>
+ <plugins>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-dependency-plugin</artifactId>
+ <executions>
+ <execution>
+ <id>copy-dependencies-test</id>
+ <phase>prepare-package</phase>
+ <goals>
+ <goal>copy-dependencies</goal>
+ </goals>
+ <configuration>
+ <outputDirectory>${project.target.directory}</outputDirectory>
+ <includeScope>runtime</includeScope>
+ </configuration>
+ </execution>
+ </executions>
+ </plugin>
+ </plugins>
+ </build>
+
+</project>
\ No newline at end of file
diff --git a/idp-plugin-duo-nimbus-client/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/NimbusClient.java b/idp-plugin-duo-nimbus-client/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/NimbusClient.java
new file mode 100644
index 0000000..20e2a5d
--- /dev/null
+++ b/idp-plugin-duo-nimbus-client/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/NimbusClient.java
@@ -0,0 +1,29 @@
+package net.shibboleth.idp.plugin.authn.duo.nimbus;
+
+import com.nimbusds.jwt.JWT;
+
+import net.shibboleth.idp.plugin.authn.duo.DuoClientException;
+import net.shibboleth.idp.plugin.authn.duo.DuoOIDCClient;
+import net.shibboleth.idp.plugin.authn.duo.model.DuoHealthCheck;
+
+public class NimbusClient implements DuoOIDCClient{
+
+ @Override
+ public DuoHealthCheck healthCheck() throws DuoClientException {
+ // TODO Auto-generated method stub
+ return null;
+ }
+
+ @Override
+ public String createAuthUrl(String username, String state) throws DuoClientException {
+ // TODO Auto-generated method stub
+ return null;
+ }
+
+ @Override
+ public JWT exchangeAuthorizationCodeFor2FAResult(String code, String username) throws DuoClientException {
+ // TODO Auto-generated method stub
+ return null;
+ }
+
+}
diff --git a/idp-plugin-duo-nimbus-client/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/NimbusClientFactory.java b/idp-plugin-duo-nimbus-client/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/NimbusClientFactory.java
new file mode 100644
index 0000000..96a20c6
--- /dev/null
+++ b/idp-plugin-duo-nimbus-client/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/NimbusClientFactory.java
@@ -0,0 +1,18 @@
+package net.shibboleth.idp.plugin.authn.duo.nimbus;
+
+import net.shibboleth.idp.plugin.authn.duo.DuoClientException;
+import net.shibboleth.idp.plugin.authn.duo.DuoOIDCClient;
+import net.shibboleth.idp.plugin.authn.duo.DuoOIDCClientFactory;
+import net.shibboleth.idp.plugin.authn.duo.DuoOIDCIntegration;
+
+
+/** Abstract factory implementation for the {@link DuoSDKClientAdaptor} for creating clients based
+ * on the Nimbus library. */
+public class NimbusClientFactory implements DuoOIDCClientFactory{
+
+ @Override
+ public DuoOIDCClient createInstance(DuoOIDCIntegration integration) throws DuoClientException {
+ return new NimbusClient();
+ }
+
+}
diff --git a/pom.xml b/pom.xml
index 78c8fff..0d00db8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -33,6 +33,7 @@
<module>idp-duo-impl</module>
<module>idp-duo-native-client-impl</module>
<module>idp-duo-distribution</module>
+ <module>idp-plugin-duo-nimbus-client</module>
</modules>
<distributionManagement>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list