[java-identity-provider] branch main updated: Allow for no application key due to AuthAPI.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=c9471a6931bec7c4648f2eb078df35ec571d95a1

The following commit(s) were added to refs/heads/main by this push:
       new  c9471a693 Allow for no application key due to AuthAPI.
c9471a693 is described below

commit c9471a6931bec7c4648f2eb078df35ec571d95a1
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Feb 12 13:11:33 2021 -0500

    Allow for no application key due to AuthAPI.
---
 .../java/net/shibboleth/idp/authn/duo/BasicDuoIntegration.java | 10 +++++-----
 .../main/java/net/shibboleth/idp/authn/duo/DuoIntegration.java |  3 ++-
 .../java/net/shibboleth/idp/authn/duo/impl/DuoSupport.java     |  5 +++++
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/BasicDuoIntegration.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/BasicDuoIntegration.java
index f18014a10..d3aacadd3 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/BasicDuoIntegration.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/BasicDuoIntegration.java
@@ -46,7 +46,7 @@ public class BasicDuoIntegration extends AbstractInitializableComponent implemen
     @NonnullAfterInit @NotEmpty private String apiHost;
     
     /** Application key. */
-    @NonnullAfterInit @NotEmpty private String applicationKey;
+    @Nullable @NotEmpty private String applicationKey;
     
     /** Integration key. */
     @NonnullAfterInit @NotEmpty private String integrationKey;
@@ -79,7 +79,7 @@ public class BasicDuoIntegration extends AbstractInitializableComponent implemen
     }
 
     /** {@inheritDoc} */
-    @Nonnull @NotEmpty public String getApplicationKey() {
+    @Nullable @NotEmpty public String getApplicationKey() {
         return applicationKey;
     }
     
@@ -88,10 +88,10 @@ public class BasicDuoIntegration extends AbstractInitializableComponent implemen
      * 
      * @param key application key
      */
-    public void setApplicationKey(@Nonnull @NotEmpty final String key) {
+    public void setApplicationKey(@Nullable @NotEmpty final String key) {
         ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
         
-        applicationKey = Constraint.isNotNull(StringSupport.trimOrNull(key), "Application key cannot be null or empty");
+        applicationKey = StringSupport.trimOrNull(key);
     }
 
     /** {@inheritDoc} */
@@ -155,7 +155,7 @@ public class BasicDuoIntegration extends AbstractInitializableComponent implemen
     /** {@inheritDoc} */
     @Override
     protected void doInitialize() throws ComponentInitializationException {
-        if (apiHost == null || applicationKey == null || integrationKey == null || secretKey == null) {
+        if (apiHost == null || integrationKey == null || secretKey == null) {
             throw new ComponentInitializationException("API host and integration keys must be set");
         }
     }
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/DuoIntegration.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/DuoIntegration.java
index 1b96f5f2c..014324b7a 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/DuoIntegration.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/DuoIntegration.java
@@ -21,6 +21,7 @@ import net.shibboleth.idp.authn.principal.PrincipalSupportingComponent;
 import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 /**
  * Interface to a particular Duo integration point.
@@ -41,7 +42,7 @@ public interface DuoIntegration extends PrincipalSupportingComponent {
      * 
      * @return the application key
      */
-    @Nonnull @NotEmpty String getApplicationKey();
+    @Nullable @NotEmpty String getApplicationKey();
 
     /**
      * Get the integration key.
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/DuoSupport.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/DuoSupport.java
index 76a50a44f..6faf6b627 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/DuoSupport.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/DuoSupport.java
@@ -75,6 +75,8 @@ public final class DuoSupport {
         
         if (username == null) {
             signedRequestToken = DuoWeb.ERR_USER;
+        } else if (duo.getApplicationKey() == null) {
+            signedRequestToken = DuoWeb.ERR_AKEY;
         } else {
             signedRequestToken = DuoWeb.signRequest(duo.getIntegrationKey(), duo.getSecretKey(),
                     duo.getApplicationKey(), username);
@@ -102,6 +104,9 @@ public final class DuoSupport {
             @Nonnull @NotEmpty final String signedResponseToken)
         throws DuoWebException, InvalidKeyException, IOException, NoSuchAlgorithmException {
         try {
+            if (duo.getApplicationKey() == null) {
+                throw new DuoWebException(DuoWeb.ERR_AKEY);
+            }
             final String username = DuoWeb.verifyResponse(duo.getIntegrationKey(), duo.getSecretKey(),
                     duo.getApplicationKey(), signedResponseToken);
             return username;

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.