[java-idp-plugin-duo] branch main updated: JDUO-14 - Review 'local' v 'not local' error events
Phil Smart
philip.smart at jisc.ac.uk
Wed Sep 9 10:38:43 UTC 2020
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-duo.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=e4ebed283bde824a648ef522412655543e4ecce3
The following commit(s) were added to refs/heads/main by this push:
new e4ebed2 JDUO-14 - Review 'local' v 'not local' error events
e4ebed2 is described below
commit e4ebed283bde824a648ef522412655543e4ecce3
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Sep 9 11:38:36 2020 +0100
JDUO-14 - Review 'local' v 'not local' error events
- Error events adjusted where appropriate. There are no local error
events explicit in the flow.
https://issues.shibboleth.net/jira/browse/JDUO-14
---
.../authn/duo/impl/HealthCheckDuoOIDCAuthAPI.java | 6 +-----
.../duo/impl/PopulateDuoAuthenticationContext.java | 3 ++-
.../plugin/authn/duo/impl/ValidateDuoResponseState.java | 9 +++++----
.../plugin/authn/duo/impl/ValidateDuoTokenAudience.java | 8 ++++----
.../duo/impl/ValidateDuoTokenAuthenticationTime.java | 11 ++++++-----
.../authn/duo/impl/ValidateDuoTokenExpirationTime.java | 4 ++--
.../plugin/authn/duo/impl/ValidateDuoTokenIssuedAt.java | 4 ++--
.../plugin/authn/duo/impl/ValidateDuoTokenIssuer.java | 17 ++++++++++-------
.../plugin/authn/duo/impl/ValidateDuoTokenSubject.java | 5 +++--
.../idp/plugin/authn/duo/impl/DuoAuthnFlowTest.java | 2 +-
.../authn/duo/impl/ValidateDuoResponseStateTest.java | 8 ++++----
.../authn/duo/impl/ValidateDuoTokenAudienceTest.java | 2 +-
.../impl/ValidateDuoTokenAuthenticationTimeTest.java | 4 ++--
.../duo/impl/ValidateDuoTokenExpirationTimeTest.java | 4 ++--
.../authn/duo/impl/ValidateDuoTokenIssuedAtTest.java | 4 ++--
.../authn/duo/impl/ValidateDuoTokenIssuerTest.java | 4 ++--
16 files changed, 49 insertions(+), 46 deletions(-)
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/HealthCheckDuoOIDCAuthAPI.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/HealthCheckDuoOIDCAuthAPI.java
index cb5848d..79c9acf 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/HealthCheckDuoOIDCAuthAPI.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/HealthCheckDuoOIDCAuthAPI.java
@@ -49,11 +49,7 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
* AuthenticationContext.getSubcontext(DuoOIDCAuthenticationContext.class, false) != null
* </pre>
*/
-public class HealthCheckDuoOIDCAuthAPI extends AbstractDuoAuthenticationAction{
-
- /** Event signalling that the Duo 2FA endpoints are not available. */
- //TODO: Unused?
- @Nonnull @NotEmpty public static final String DUO_UNAVAILABLE = "DuoUnavailable";
+public class HealthCheckDuoOIDCAuthAPI extends AbstractDuoAuthenticationAction{
/** Class logger. */
@Nonnull @NotEmpty private final Logger log = LoggerFactory.getLogger(HealthCheckDuoOIDCAuthAPI.class);
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/PopulateDuoAuthenticationContext.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/PopulateDuoAuthenticationContext.java
index 6f83b86..55dca14 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/PopulateDuoAuthenticationContext.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/PopulateDuoAuthenticationContext.java
@@ -51,6 +51,7 @@ import net.shibboleth.utilities.java.support.logic.FunctionSupport;
* @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
* @event {@link org.opensaml.profile.action.EventIds#INVALID_PROFILE_CTX}
* @event {@link net.shibboleth.idp.authn.AuthnEventIds#NO_CREDENTIALS}
+ * @event {@link net.shibboleth.idp.authn.AuthnEventIds#AUTHN_EXCEPTION}
* @post See above.
*/
public class PopulateDuoAuthenticationContext extends AbstractAuthenticationAction {
@@ -170,7 +171,7 @@ public class PopulateDuoAuthenticationContext extends AbstractAuthenticationActi
} catch (final DuoRegistryException e) {
log.warn("{} No DuoClient established (located or created) for "
+ "this integration", getLogPrefix(),e);
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_AUTHN_CTX);
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.AUTHN_EXCEPTION);
return;
}
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoResponseState.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoResponseState.java
index 1f2de4e..e3b7491 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoResponseState.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoResponseState.java
@@ -35,7 +35,7 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
* matches that in the 2FA request.
*
* @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
- * @event {@link AuthnEventIds#INVALID_CREDENTIALS}
+ * @event {@link AuthnEventIds#NO_CREDENTIALS}
* @pre <pre>
* ProfileRequestContext.getSubcontext(AuthenticationContext.class, false) != null
* </pre>
@@ -61,13 +61,13 @@ public class ValidateDuoResponseState extends AbstractDuoAuthenticationAction {
if (duoContext.getRequestState() == null || duoContext.getResponseState() == null) {
log.error("{} The state parameter was not present in either the request or response, "
+ "state is mandatory for Duo 2FA requests",getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_CREDENTIALS);
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
if (!duoContext.getRequestState().equals(duoContext.getResponseState())) {
log.error("{} Duo request state did not match response state, has it been tampered with!",
getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_CREDENTIALS);
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
//blank request and response for safety
blankState(duoContext);
return;
@@ -79,7 +79,8 @@ public class ValidateDuoResponseState extends AbstractDuoAuthenticationAction {
}
/**
- * Set the request and response states to null.
+ * Set the request and response states to null so they can't be reused. It is less
+ * relevant if they are removed (GC'd) from memory.
*
* @param context the duo context.
*/
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAudience.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAudience.java
index b426786..87b4316 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAudience.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAudience.java
@@ -48,7 +48,7 @@ import net.shibboleth.idp.plugin.authn.duo.model.DuoAuthToken;
* </pre>
*
* @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
- * @event {@link net.shibboleth.idp.authn.AuthnEventIds#AUTHN_EXCEPTION}
+ * @event {@link net.shibboleth.idp.authn.AuthnEventIds#NO_CREDENTIALS}
*/
public class ValidateDuoTokenAudience extends AbstractDuoAuthenticationAction {
@@ -81,17 +81,17 @@ public class ValidateDuoTokenAudience extends AbstractDuoAuthenticationAction {
final String audience = token.getAud();
if (audience == null) {
log.error("{} No audience found in the token response", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.AUTHN_EXCEPTION);
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
if (duoContext.getIntegration() == null) {
log.error("{} No Duo integration found in the Duo context", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.AUTHN_EXCEPTION);
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
if (!audience.equals(duoContext.getIntegration().getClientId())) {
log.error("{} Client is not the intended audience", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.AUTHN_EXCEPTION);
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
log.trace("{} Token has the correct audience '{}' for this client",getLogPrefix(),audience);
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationTime.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationTime.java
index cf3c26a..036c632 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationTime.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationTime.java
@@ -57,7 +57,7 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
*
* @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
* @event {@link net.shibboleth.idp.authn.AuthnEventIds#INVALID_AUTHN_CTX}
- * @event {@link net.shibboleth.idp.authn.AuthnEventIds#AUTHN_EXCEPTION}
+ * @event {@link net.shibboleth.idp.authn.AuthnEventIds#NO_CREDENTIALS}
*/
public class ValidateDuoTokenAuthenticationTime extends AbstractDuoAuthenticationAction {
@@ -133,7 +133,7 @@ public class ValidateDuoTokenAuthenticationTime extends AbstractDuoAuthenticatio
final Integer authTimeEpochSeconds = token.getAuthTime();
if (authTimeEpochSeconds == null) {
log.error("{} No auth_time found in the token response", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.AUTHN_EXCEPTION);
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
@@ -146,16 +146,17 @@ public class ValidateDuoTokenAuthenticationTime extends AbstractDuoAuthenticatio
if (authTime.isAfter(latestValid)) {
log.warn("{} Authentication is not yet valid: auth_time was {}, latest valid is: {}", getLogPrefix(),
authTime, latestValid);
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.AUTHN_EXCEPTION);
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
// Check time of authentication has not expired
if (expiration.isBefore(now)) {
log.warn(
- "{} Authentication required (forced) but has expired: auth_time was '{}', expired at: '{}', current time: '{}'",
+ "{} Authentication required (forced) but has expired: auth_time was '{}', "
+ + "expired at: '{}', current time: '{}'",
getLogPrefix(), authTime, expiration, now);
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.AUTHN_EXCEPTION);
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
//is OK.
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenExpirationTime.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenExpirationTime.java
index 6464e3b..3d6a9a2 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenExpirationTime.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenExpirationTime.java
@@ -109,7 +109,7 @@ public class ValidateDuoTokenExpirationTime extends AbstractDuoAuthenticationAct
final Integer expEpochSeconds = token.getExp();
if (expEpochSeconds == null) {
log.error("{} No expiry found in the token response", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.AUTHN_EXCEPTION);
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
@@ -120,7 +120,7 @@ public class ValidateDuoTokenExpirationTime extends AbstractDuoAuthenticationAct
if (now.isAfter(latestExpired)) {
log.warn("{} Token is past expiry date: message expired at: '{}', current time: '{}'", getLogPrefix(),
latestExpired, now);
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.AUTHN_EXCEPTION);
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
//has not expired.
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuedAt.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuedAt.java
index c46a27c..0adee90 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuedAt.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuedAt.java
@@ -115,7 +115,7 @@ public class ValidateDuoTokenIssuedAt extends AbstractDuoAuthenticationAction {
final Double iatEpochSeconds = token.getIat();
if (iatEpochSeconds == null) {
log.error("{} No expiry found in the token response", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.AUTHN_EXCEPTION);
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
@@ -132,7 +132,7 @@ public class ValidateDuoTokenIssuedAt extends AbstractDuoAuthenticationAction {
log.error("{} Token issued at '{}' was too far away from the current time '{}' with acceptable "
+ " deviation of '{}', difference is '{}'",
getLogPrefix(), iat, now, iatMaxClockSkew, iatDifference);
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.AUTHN_EXCEPTION);
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
//is within token lifetime window.
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuer.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuer.java
index 9243ce6..10c7d96 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuer.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuer.java
@@ -59,13 +59,16 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
* </pre>
*
* @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
- * @event {@link net.shibboleth.idp.authn.AuthnEventIds#AUTHN_EXCEPTION}
+ * @event {@link net.shibboleth.idp.authn.AuthnEventIds#NO_CREDENTIALS}
*
*/
public class ValidateDuoTokenIssuer extends AbstractDuoAuthenticationAction {
/** HTTPS scheme protocol.*/
- private static final String HTTPS = "https://";
+ @Nonnull @NotEmpty public static final String HTTPS = "https://";
+
+ /** The default issuer path, specific to the v1 Duo flow.*/
+ @Nonnull @NotEmpty public static final String DEFAULT_ISSUER_PATH = "/oauth/v1/token";
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(ValidateDuoTokenIssuer.class);
@@ -78,7 +81,7 @@ public class ValidateDuoTokenIssuer extends AbstractDuoAuthenticationAction {
/** Constructor.*/
public ValidateDuoTokenIssuer() {
- issuerPath = "/oauth/v1/token";
+ issuerPath = DEFAULT_ISSUER_PATH;
}
/**
@@ -116,18 +119,18 @@ public class ValidateDuoTokenIssuer extends AbstractDuoAuthenticationAction {
final String issuer = token.getIss();
if (issuer == null) {
log.error("{} No issuer found in the token response", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.AUTHN_EXCEPTION);
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
if (duoContext.getIntegration() == null) {
log.error("{} No Duo integration found in the Duo context", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.AUTHN_EXCEPTION);
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
final String apiHost = duoContext.getIntegration().getAPIHost();
if (apiHost == null) {
log.error("{} No Duo integration API host found", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.AUTHN_EXCEPTION);
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
@@ -136,7 +139,7 @@ public class ValidateDuoTokenIssuer extends AbstractDuoAuthenticationAction {
if (!issuer.equals(issuerFromIntegration)) {
log.error("{} Token issuer differs from that expected, issuer is '{}', expected '{}'",getLogPrefix(),
issuer,issuerFromIntegration);
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.AUTHN_EXCEPTION);
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
//issuer is fine.
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenSubject.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenSubject.java
index 207adc2..ee95ce6 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenSubject.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenSubject.java
@@ -49,6 +49,7 @@ import net.shibboleth.idp.plugin.authn.duo.model.DuoAuthToken;
*
* @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
* @event {@link net.shibboleth.idp.authn.AuthnEventIds#INVALID_CREDENTIALS}
+ * @event {@link net.shibboleth.idp.authn.AuthnEventIds#NO_CREDENTIALS}
*/
public class ValidateDuoTokenSubject extends AbstractDuoAuthenticationAction {
@@ -83,13 +84,13 @@ public class ValidateDuoTokenSubject extends AbstractDuoAuthenticationAction {
final String subject = token.getSub();
if (subject == null) {
log.error("{} No subject found in the token response", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_CREDENTIALS);
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
final String username = duoContext.getUsername();
if (username == null) {
log.error("{} No username found in the Duo context", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_CREDENTIALS);
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
if (!username.equals(subject)) {
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoAuthnFlowTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoAuthnFlowTest.java
index 9adafd3..e0a1ac4 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoAuthnFlowTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoAuthnFlowTest.java
@@ -474,7 +474,7 @@ public class DuoAuthnFlowTest extends AbstractAuthnXmlFlowExecutionTests {
assertNotNull(prc.getSubcontext(EventContext.class));
assertNotNull(prc.getSubcontext(EventContext.class).getEvent());
assertTrue(prc.getSubcontext(EventContext.class).getEvent() instanceof String);
- assertEquals(AuthnEventIds.AUTHN_EXCEPTION, prc.getSubcontext(EventContext.class).getEvent());
+ assertEquals(AuthnEventIds.NO_CREDENTIALS, prc.getSubcontext(EventContext.class).getEvent());
}
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoResponseStateTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoResponseStateTest.java
index f4a3f98..0f7abb2 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoResponseStateTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoResponseStateTest.java
@@ -64,7 +64,7 @@ public class ValidateDuoResponseStateTest extends AbstractDuoActionTest{
addAttemptedFlow("authn/DuoOIDC");
action.initialize();
final Event event = action.execute(src);
- assertEventId(event,AuthnEventIds.INVALID_CREDENTIALS);
+ assertEventId(event,AuthnEventIds.NO_CREDENTIALS);
}
/* Test Duo 2FA response validation, no state in response. */
@@ -76,19 +76,19 @@ public class ValidateDuoResponseStateTest extends AbstractDuoActionTest{
dc.setRequestState(DuoSupport.generateNonce(32));
action.initialize();
final Event event = action.execute(src);
- assertEventId(event,AuthnEventIds.INVALID_CREDENTIALS);
+ assertEventId(event,AuthnEventIds.NO_CREDENTIALS);
}
/* Test Duo 2FA response validation, no state in request.*/
@Test
- public void testExecuteNoStateInRequest() throws ComponentInitializationException {
+ public void NO_CREDENTIALS() throws ComponentInitializationException {
addDuoContext();
addDuoIntegrationToContext();
addAttemptedFlow("authn/DuoOIDC");
dc.setResponseState(DuoSupport.generateNonce(32));
action.initialize();
final Event event = action.execute(src);
- assertEventId(event,AuthnEventIds.INVALID_CREDENTIALS);
+ assertEventId(event,AuthnEventIds.NO_CREDENTIALS);
}
}
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAudienceTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAudienceTest.java
index 59f8b60..8ff1a14 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAudienceTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAudienceTest.java
@@ -88,7 +88,7 @@ public class ValidateDuoTokenAudienceTest extends AbstractDuoActionTest {
action.initialize();
final Event event = action.execute(src);
// null event is success.
- assertEventId(event,AuthnEventIds.AUTHN_EXCEPTION);
+ assertEventId(event,AuthnEventIds.NO_CREDENTIALS);
}
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationTimeTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationTimeTest.java
index 415c425..b8fb569 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationTimeTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationTimeTest.java
@@ -137,7 +137,7 @@ public class ValidateDuoTokenAuthenticationTimeTest extends AbstractDuoActionTes
Instant.now(),Instant.now(), Instant.now().minus(Duration.of(10, ChronoUnit.MINUTES)), "api.duosecurity.com", "duo_push"));
action.initialize();
final Event event = action.execute(src);
- assertEventId(event, AuthnEventIds.AUTHN_EXCEPTION);
+ assertEventId(event, AuthnEventIds.NO_CREDENTIALS);
}
@@ -158,7 +158,7 @@ public class ValidateDuoTokenAuthenticationTimeTest extends AbstractDuoActionTes
Instant.now(),Instant.now(), Instant.now().plus(Duration.of(10, ChronoUnit.MINUTES)), "api.duosecurity.com", "duo_push"));
action.initialize();
final Event event = action.execute(src);
- assertEventId(event, AuthnEventIds.AUTHN_EXCEPTION);
+ assertEventId(event, AuthnEventIds.NO_CREDENTIALS);
}
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenExpirationTimeTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenExpirationTimeTest.java
index 7f3edbc..28179d8 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenExpirationTimeTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenExpirationTimeTest.java
@@ -79,7 +79,7 @@ public class ValidateDuoTokenExpirationTimeTest extends AbstractDuoActionTest {
Instant.now().minus(1,ChronoUnit.DAYS),Instant.now(), Instant.now(), "api.duosecurity.com", "duo_push"));
action.initialize();
final Event event = action.execute(src);
- assertEventId(event, AuthnEventIds.AUTHN_EXCEPTION);
+ assertEventId(event, AuthnEventIds.NO_CREDENTIALS);
}
@@ -123,7 +123,7 @@ public class ValidateDuoTokenExpirationTimeTest extends AbstractDuoActionTest {
Instant.now().minus(1,ChronoUnit.SECONDS),Instant.now(), Instant.now(), "api.duosecurity.com", "duo_push"));
action.initialize();
final Event event = action.execute(src);
- assertEventId(event, AuthnEventIds.AUTHN_EXCEPTION);
+ assertEventId(event, AuthnEventIds.NO_CREDENTIALS);
}
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuedAtTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuedAtTest.java
index 5ff6741..8772963 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuedAtTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuedAtTest.java
@@ -83,7 +83,7 @@ public class ValidateDuoTokenIssuedAtTest extends AbstractDuoActionTest {
action.initialize();
final Event event = action.execute(src);
- assertEventId(event, AuthnEventIds.AUTHN_EXCEPTION);
+ assertEventId(event, AuthnEventIds.NO_CREDENTIALS);
}
@@ -103,7 +103,7 @@ public class ValidateDuoTokenIssuedAtTest extends AbstractDuoActionTest {
action.initialize();
final Event event = action.execute(src);
- assertEventId(event, AuthnEventIds.AUTHN_EXCEPTION);
+ assertEventId(event, AuthnEventIds.NO_CREDENTIALS);
}
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuerTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuerTest.java
index 4abe483..08978bf 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuerTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenIssuerTest.java
@@ -62,7 +62,7 @@ public class ValidateDuoTokenIssuerTest extends AbstractDuoActionTest {
action.initialize();
final Event event = action.execute(src);
// null event is success.
- assertEventId(event, AuthnEventIds.AUTHN_EXCEPTION);
+ assertEventId(event, AuthnEventIds.NO_CREDENTIALS);
}
/**
@@ -82,7 +82,7 @@ public class ValidateDuoTokenIssuerTest extends AbstractDuoActionTest {
action.initialize();
final Event event = action.execute(src);
// null event is success.
- assertEventId(event, AuthnEventIds.AUTHN_EXCEPTION);
+ assertEventId(event, AuthnEventIds.NO_CREDENTIALS);
}
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list