[java-idp-plugin-duo] branch main updated: Improve JavaDoc, fix Nimbus pom
Phil Smart
philip.smart at jisc.ac.uk
Fri Oct 2 13:58:13 UTC 2020
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-duo.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=78606d4939a865e95b216a81b8507a36a23b448b
The following commit(s) were added to refs/heads/main by this push:
new 78606d4 Improve JavaDoc, fix Nimbus pom
78606d4 is described below
commit 78606d4939a865e95b216a81b8507a36a23b448b
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Oct 2 14:58:08 2020 +0100
Improve JavaDoc, fix Nimbus pom
---
.../idp/plugin/authn/duo/DuoOIDCClient.java | 5 ++-
.../plugin/authn/duo/impl/ValidateTokenClaims.java | 50 ++++++++++++++++------
idp-duo-nimbus-client-impl/pom.xml | 20 +++++----
.../authn/duo/nimbus/DuoHttpClientFactoryBean.java | 1 -
4 files changed, 51 insertions(+), 25 deletions(-)
diff --git a/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/DuoOIDCClient.java b/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/DuoOIDCClient.java
index 78a588c..7f2fbec 100644
--- a/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/DuoOIDCClient.java
+++ b/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/DuoOIDCClient.java
@@ -50,8 +50,9 @@ public interface DuoOIDCClient {
@Nonnull String createAuthUrl(@Nonnull final String username, @Nonnull final String state) throws DuoClientException;
/**
- * Verifies the code returned by Duo and exchanges it for a Json Web Token which contains information pertaining to
- * the authentication. The JWT **must** be signed.
+ * Exchanges the authorizaton code for a Json Web Token (JWT) which contains information pertaining to
+ * the authentication. There is no requirement on the client to verify the tokens authenticity or
+ * claims - these should be performed elsewhere in the flow. The JWT **must** be signed.
*
* @param code An authentication identifier which is exchanged (per OAuth2.0 spec) with Duo for a token.
* the token can be used to determine if authentication was successful as well as obtain meta-data
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenClaims.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenClaims.java
index 28b8ed0..8c372a7 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenClaims.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenClaims.java
@@ -48,20 +48,44 @@ import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
/**
* Action that validates the claims of the Duo id_token. More specifically:
* <ul>
- * <li>Verifies the Audience (aud) claim contains the client_id of this client (as
- * registered at the issuer). See section 3.1.3.7 of OpenID Connect core 1.0.</li>
- * <li>Verifies if the auth_time (when the End-User authentication took place)
- * is within a valid expiration window. Only for forced authentications.</li>
- * <li>Verifies the expiration time (exp). If the expiration time has past,
- * the token must not be accepted. A few minutes of {@code clockSkew} is allowed.
- * See section 3.1.3.7 of OpenID Connect core 1.0.</li>
- * <li>Rejects tokens that were issued (iat) to far away from the current time.
- * See section 3.1.3.7 of OpenID Connect core 1.0.</li>
- * <li>Verifies the issuer (iss) of the token exactly matches that of the configured
- * Duo token provider. See section 3.1.3.7 of OpenID Connect core 1.0.</li>
- * <li>Verifies the Subject (sub) claim in the token matches the user who
- * is currently authenticating</li>
+ * <li>Verifies the Audience (aud) claim contains the client_id of this client (as registered at the issuer). See
+ * section 3.1.3.7 of OpenID Connect core 1.0.</li>
+ * <li>Verifies if the auth_time (when the End-User authentication took place) is within a valid expiration window. Only
+ * for forced authentications.</li>
+ * <li>Verifies the expiration time (exp). If the expiration time has past, the token must not be accepted. A few
+ * minutes of {@code clockSkew} is allowed. See section 3.1.3.7 of OpenID Connect core 1.0.</li>
+ * <li>Rejects tokens that were issued (iat) to far away from the current time. See section 3.1.3.7 of OpenID Connect
+ * core 1.0.</li>
+ * <li>Verifies the issuer (iss) of the token exactly matches that of the configured Duo token provider. See section
+ * 3.1.3.7 of OpenID Connect core 1.0.</li>
+ * <li>Verifies the Subject (sub) claim in the token matches the user who is currently authenticating</li>
* </ul>
+ *
+ * @pre
+ *
+ * <pre>
+ * ProfileRequestContext.getSubcontext(AuthenticationContext.class, false) != null
+ * </pre>
+ *
+ * @pre
+ *
+ * <pre>
+ * AuthenticationContext.getSubcontext(DuoOIDCAuthenticationContext.class, false) != null
+ * </pre>
+ *
+ * @pre
+ *
+ * <pre>
+ * DuoOIDCAuthenticationContext.getAuthToken() != null
+ * </pre>
+ * @pre
+ *
+ * <pre>
+ * DuoOIDCAuthenticationContext.getIntegration() != null
+ * </pre>
+ *
+ * @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
+ * @event {@link net.shibboleth.idp.authn.AuthnEventIds#AUTHN_EXCEPTION}
*/
public class ValidateTokenClaims extends AbstractDuoAuthenticationAction {
diff --git a/idp-duo-nimbus-client-impl/pom.xml b/idp-duo-nimbus-client-impl/pom.xml
index 9f5fc68..fb416d6 100644
--- a/idp-duo-nimbus-client-impl/pom.xml
+++ b/idp-duo-nimbus-client-impl/pom.xml
@@ -27,15 +27,7 @@
<groupId>com.nimbusds</groupId>
<artifactId>nimbus-jose-jwt</artifactId>
<version>9.0</version>
- </dependency>
- <dependency>
- <groupId>com.fasterxml.jackson.core</groupId>
- <artifactId>jackson-databind</artifactId>
- </dependency>
- <dependency>
- <groupId>com.fasterxml.jackson.datatype</groupId>
- <artifactId>jackson-datatype-jsr310</artifactId>
- </dependency>
+ </dependency>
<!-- provided dependencies -->
<dependency>
<groupId>com.google.code.findbugs</groupId>
@@ -47,6 +39,16 @@
<artifactId>java-support</artifactId>
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>com.fasterxml.jackson.core</groupId>
+ <artifactId>jackson-databind</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>com.fasterxml.jackson.datatype</groupId>
+ <artifactId>jackson-datatype-jsr310</artifactId>
+ <scope>provided</scope>
+ </dependency>
<dependency> <!-- required for the DuoIntegration -->
<groupId>${idp.groupId}</groupId>
<artifactId>idp-authn-api</artifactId>
diff --git a/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/DuoHttpClientFactoryBean.java b/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/DuoHttpClientFactoryBean.java
index a8d76de..d2e98fd 100644
--- a/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/DuoHttpClientFactoryBean.java
+++ b/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/DuoHttpClientFactoryBean.java
@@ -11,7 +11,6 @@ public class DuoHttpClientFactoryBean extends net.shibboleth.ext.spring.factory.
public DuoHttpClientFactoryBean() {
final StringBuilder stringBuilder = new StringBuilder("ShibbolethIdPDuoPlugin/");
stringBuilder.append(Version.getVersion());
- System.out.println("User Agent: "+stringBuilder.toString());
setUserAgent(stringBuilder.toString());
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list