[java-identity-provider] branch main updated: Module for Duo login flow.
Scott Cantor
cantor.2 at osu.edu
Fri Sep 11 19:27:10 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=5245e08e235c7a5b78abff076604f50a28051f01
The following commit(s) were added to refs/heads/main by this push:
new 5245e08e2 Module for Duo login flow.
5245e08e2 is described below
commit 5245e08e235c7a5b78abff076604f50a28051f01
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Sep 11 15:27:02 2020 -0400
Module for Duo login flow.
---
.../net/shibboleth/idp/module/authn/impl/Duo.java | 41 ++++++++++++++++++++++
.../shibboleth/idp/flows/authn/duo-authn-beans.xml | 23 ++++++------
.../idp/module/authn/impl/module.properties | 7 ++++
.../idp/module}/conf/authn/duo-authn-config.xml | 0
.../src/main/resources/conf/authn/authn.properties | 3 ++
.../src/main/resources/conf/authn/duo.properties | 3 --
6 files changed, 63 insertions(+), 14 deletions(-)
diff --git a/idp-conf-impl/src/main/java/net/shibboleth/idp/module/authn/impl/Duo.java b/idp-conf-impl/src/main/java/net/shibboleth/idp/module/authn/impl/Duo.java
new file mode 100644
index 000000000..81228e090
--- /dev/null
+++ b/idp-conf-impl/src/main/java/net/shibboleth/idp/module/authn/impl/Duo.java
@@ -0,0 +1,41 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.module.authn.impl;
+
+import java.io.IOException;
+
+import net.shibboleth.idp.module.IdPModule;
+import net.shibboleth.idp.module.ModuleException;
+import net.shibboleth.idp.module.PropertyDrivenIdPModule;
+
+/**
+ * {@link IdPModule} implementation.
+ */
+public final class Duo extends PropertyDrivenIdPModule {
+
+ /**
+ * Constructor.
+ *
+ * @throws ModuleException on error
+ * @throws IOException on error
+ */
+ public Duo() throws IOException, ModuleException {
+ super(Duo.class);
+ }
+
+}
\ No newline at end of file
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/duo-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/duo-authn-beans.xml
index f4973c13d..cf61262ce 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/duo-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/duo-authn-beans.xml
@@ -37,8 +37,18 @@
<bean id="shibboleth.authn.Duo.UsernameLookupStrategy"
class="net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy" />
+ <!-- Default message map. -->
+ <util:map id="shibboleth.authn.Duo.ClassifiedMessageMap">
+ <entry key="AccountLocked">
+ <list>
+ <value>locked_out</value>
+ <value>Your two-factor account is disabled.</value>
+ </list>
+ </entry>
+ </util:map>
+
<!-- Can override one or more of the beans above. -->
- <import resource="%{idp.home}/conf/authn/duo-authn-config.xml" />
+ <import resource="conditional:%{idp.home}/conf/authn/duo-authn-config.xml" />
<alias name="shibboleth.authn.Duo.UsernameLookupStrategy" alias="CanonicalUsernameStrategy" />
@@ -72,15 +82,6 @@
p:httpClient="#{getObject('shibboleth.authn.Duo.NonBrowser.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
p:httpClientSecurityParameters="#{getObject('shibboleth.authn.Duo.NonBrowser.HttpClientSecurityParameters')}" />
- <util:map id="shibboleth.authn.Duo.DefaultClassifiedMessageMap">
- <entry key="AccountLocked">
- <list>
- <value>locked_out</value>
- <value>Your two-factor account is disabled.</value>
- </list>
- </entry>
- </util:map>
-
<bean id="ValidateDuoAuthAPI" scope="prototype"
class="net.shibboleth.idp.authn.duo.impl.ValidateDuoAuthAPI"
p:usernameLookupStrategy-ref="shibboleth.authn.Duo.UsernameLookupStrategy"
@@ -88,7 +89,7 @@
p:addDefaultPrincipals="#{getObject('shibboleth.authn.Duo.addDefaultPrincipals') ?: true}"
p:preauthAuthenticator-ref="DuoPreauthAuthenticator"
p:authAuthenticator-ref="DuoAuthAuthenticator"
- p:classifiedMessages="#{getObject('shibboleth.authn.Duo.ClassifiedMessageMap') ?: getObject('shibboleth.authn.Duo.DefaultClassifiedMessageMap')}"
+ p:classifiedMessages="#{getObject('shibboleth.authn.Duo.ClassifiedMessageMap')}"
p:resultCachingPredicate="#{getObject('shibboleth.authn.Duo.resultCachingPredicate')}" />
</beans>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/authn/impl/module.properties b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/authn/impl/module.properties
index 5279ac601..1a8cb1a7d 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/authn/impl/module.properties
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/authn/impl/module.properties
@@ -1,6 +1,7 @@
# Properties defining authn modules
# Class to Module ID mappings
+net.shibboleth.idp.module.authn.impl.Duo = idp.authn.Duo
net.shibboleth.idp.module.authn.impl.External = idp.authn.External
net.shibboleth.idp.module.authn.impl.Function = idp.authn.Function
net.shibboleth.idp.module.authn.impl.IPAddress = idp.authn.IPAddress
@@ -10,6 +11,12 @@ net.shibboleth.idp.module.authn.impl.SPNEGO = idp.authn.SPNEGO
net.shibboleth.idp.module.authn.impl.X509 = idp.authn.X509
net.shibboleth.idp.module.authn.impl.X509Internal = idp.authn.X509Internal
+idp.authn.Duo.name = Duo Authentication
+idp.authn.Duo.desc = Login flow for Duo Security's second-factor authentication service.
+idp.authn.Duo.url = https://wiki.shibboleth.net/confluence/display/IDP4/DuoAuthnConfiguration
+idp.authn.Duo.1.src = /net/shibboleth/idp/module/conf/authn/duo-authn-config.xml
+idp.authn.Duo.1.dest = conf/authn/duo-authn-config.xml
+
idp.authn.External.name = External Authentication
idp.authn.External.desc = Login flow that delegates authentication to a servlet/JSP.
idp.authn.External.url = https://wiki.shibboleth.net/confluence/display/IDP4/ExternalAuthnConfiguration
diff --git a/idp-conf/src/main/resources/conf/authn/duo-authn-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/duo-authn-config.xml
similarity index 100%
rename from idp-conf/src/main/resources/conf/authn/duo-authn-config.xml
rename to idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/duo-authn-config.xml
diff --git a/idp-conf/src/main/resources/conf/authn/authn.properties b/idp-conf/src/main/resources/conf/authn/authn.properties
index 453a3f779..65fde982d 100644
--- a/idp-conf/src/main/resources/conf/authn/authn.properties
+++ b/idp-conf/src/main/resources/conf/authn/authn.properties
@@ -110,6 +110,9 @@ idp.authn.flows = Password
idp.authn.Duo.supportedPrincipals = \
saml2/http://example.org/ac/classes/mfa, \
saml1/http://example.org/ac/classes/mfa
+# Default Duo integration settings are defined separately
+# in duo.properties due to the sensitivity of the secret key.
+
#### SAML ####
diff --git a/idp-conf/src/main/resources/conf/authn/duo.properties b/idp-conf/src/main/resources/conf/authn/duo.properties
index ffe050a17..da75c8e79 100644
--- a/idp-conf/src/main/resources/conf/authn/duo.properties
+++ b/idp-conf/src/main/resources/conf/authn/duo.properties
@@ -1,8 +1,5 @@
## Duo integration settings
-## Note: If upgrading from pre-3.3 IdP versions, you will need to manually add a pointer
-## to this property file to idp.properties.
-
## The first set of properties support DuoWeb "iframe" integration.
idp.duo.apiHost = hostname
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list