[java-idp-plugin-duo] branch main updated: JDUO-32 - Remove clientFactoryBean selection from duo-oidc properties file
Phil Smart
philip.smart at jisc.ac.uk
Mon Feb 15 16:39:14 UTC 2021
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-duo.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=cc6975f6114efb2161234da13f5cb2dc5134a643
The following commit(s) were added to refs/heads/main by this push:
new cc6975f JDUO-32 - Remove clientFactoryBean selection from duo-oidc properties file
cc6975f is described below
commit cc6975f6114efb2161234da13f5cb2dc5134a643
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Feb 15 16:39:12 2021 +0000
JDUO-32 - Remove clientFactoryBean selection from duo-oidc properties
file
- Removed the property - and references to the property - from the user
facing properties file.
- Aliased the DuoWeb SDK and Nimbus clients to the same default name.
Spring will now inject whichever exists on the classpath. If more than
one, the last loaded is injected.
- Kept reference to the property in the XML config in case one needs to
be explicitly set e.g. for testing.
https://issues.shibboleth.net/jira/browse/JDUO-32
---
.../plugin/authn/duo/impl/ValidateTokenSignature.java | 9 +++++----
.../idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml | 18 ++++++++++++------
.../idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml | 4 ++--
.../idp/plugin/authn/duo/duo-client-factory-bean.xml | 3 ++-
.../authn/duo/nimbus/conf/authn/duo-oidc.properties | 2 --
.../idp/plugin/authn/duo/duo-client-factory-bean.xml | 6 +++---
.../authn/duo/sdk/conf/authn/duo-oidc.properties | 2 --
7 files changed, 24 insertions(+), 20 deletions(-)
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignature.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignature.java
index 7ca9d80..1cfa2f5 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignature.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignature.java
@@ -52,11 +52,12 @@ import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
/**
* Action to validate the JWT signature. The JWT **must** be signed using the HMAC_SHA family,
- * any other type including 'none', emits an error back to the flow.
+ * any other type, including 'none', emits an error back to the flow.
*
*
* @event {@link net.shibboleth.idp.authn.AuthnEventIds#NO_CREDENTIALS}
* @event {@link net.shibboleth.idp.authn.AuthnEventIds#INVALID_AUTHN_CTX}
+ * @event {@link net.shibboleth.idp.authn.AuthnEventIds#AUTHN_EXCEPTION}
* @pre <pre>
* ProfileRequestContext.getSubcontext(AuthenticationContext.class, false) != null
* </pre>
@@ -79,8 +80,8 @@ public class ValidateTokenSignature extends AbstractDuoAuthenticationAction {
/**
* The signature algorithm used. This is fixed and not taken from the JWS.
- * There is not reason in the Duo case to determine the algorithm from the JWS,
- * as HMAC is the only required algorithm - hence this is safer.
+ * There is no reason, in the Duo case, to determine the algorithm from the JWS
+ * as HS512 is the only required algorithm.
*/
@Nonnull private Algorithm signatureAlgorithm;
@@ -95,7 +96,7 @@ public class ValidateTokenSignature extends AbstractDuoAuthenticationAction {
/** Constructor.*/
public ValidateTokenSignature() {
- //this is the default HMAC algorithm Duo support, and no other
+ //this is the default HMAC algorithm Duo support.
signatureAlgorithm = JWSAlgorithm.HS512;
}
diff --git a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
index b2efad2..fa8e830 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
@@ -48,12 +48,18 @@
class="net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy" />
<!-- Duo Client factory and bean registry -->
- <bean id="shibboleth.authn.DuoOIDC.clientRegistry" scope="singleton"
- class="net.shibboleth.idp.plugin.authn.duo.impl.DefaultDuoOIDCClientRegistry"
- p:clientFactory-ref="%{idp.duo.oidc.clientFactoryBean:shibboleth.authn.DuoOIDC.sdk.clientFactory}" />
+ <bean id="shibboleth.authn.DuoOIDC.clientRegistry" scope="singleton"
+ class="net.shibboleth.idp.plugin.authn.duo.impl.DefaultDuoOIDCClientRegistry"
+ p:clientFactory-ref="%{idp.duo.oidc.clientFactoryBean:shibboleth.authn.DuoOIDC.clientFactory}"/>
- <!-- Load all (or none) factory bean definitions from the classpath. The actual factory bean to use is
- defined in the client registry and overridable by the property idp.duo.oidc.clientFactoryBean -->
+ <!--
+ Load all (or none) factory bean definitions from the classpath. The defaulted factory bean must be called
+ 'shibboleth.authn.DuoOIDC.clientFactory' for it to be auto-loaded.
+
+ If there is more than one default on the classpath, the 'last' loaded will override all others.
+ If this is the case and you would like to explicitly specify which to use you can add the bean
+ ID/name to a property idp.duo.oidc.clientFactoryBean.
+ -->
<import resource="classpath*:/net/shibboleth/idp/plugin/authn/duo/duo-client-factory-bean.xml" />
<!-- Can override one or more of the beans above. Note, the property override is mostly to allow tests
@@ -95,7 +101,7 @@
p:classifiedMessages="#{getObject('shibboleth.authn.DuoOIDC.ClassifiedMessageMap')}"
p:resultCachingPredicate="#{getObject('shibboleth.authn.DuoOIDC.resultCachingPredicate')}" />
- <!-- Prototype per conversation beans -->
+ <!-- Duo OIDC AuthAPI beans -->
<bean id="PopulateDuoAuthenticationContext" scope="prototype"
class="net.shibboleth.idp.plugin.authn.duo.impl.PopulateDuoAuthenticationContext"
p:duoIntegrationLookupStrategy-ref="shibboleth.authn.DuoOIDC.DuoIntegrationStrategy"
diff --git a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml
index 9b95f96..33c4246 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml
@@ -2,7 +2,7 @@
xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
parent="authn.abstract">
- <!-- This is a login flow for the Duo OIDC authentication flow -->
+ <!-- This is a login flow for the Duo OIDC Authn API authentication flow -->
<action-state id="ExtractDuoAuthenticationFromHeaders">
<evaluate expression="ExtractDuoAuthenticationFromHeaders" />
@@ -51,7 +51,7 @@
<action-state id="ExchangeCodeForDuoToken">
<evaluate expression="ExchangeCodeForDuoToken"/>
- <!-- validate the token and set principal -->
+ <!-- validate the token signature and claims -->
<evaluate expression="ValidateTokenSignature"/>
<evaluate expression="ValidateTokenClaims"/>
<!-- final validation of the response status to build an authn result -->
diff --git a/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/duo-client-factory-bean.xml b/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/duo-client-factory-bean.xml
index f004742..788e405 100644
--- a/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/duo-client-factory-bean.xml
+++ b/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/duo-client-factory-bean.xml
@@ -9,7 +9,8 @@
default-init-method="initialize" default-destroy-method="destroy">
- <bean id="shibboleth.authn.DuoOIDC.nimbus.clientFactory"
+ <!-- Client factory with is own unique ID but common (default) alias/name -->
+ <bean id="shibboleth.authn.DuoOIDC.nimbus.clientFactory" name="shibboleth.authn.DuoOIDC.clientFactory"
class="net.shibboleth.idp.plugin.authn.duo.nimbus.impl.NimbusClientFactory" scope="singleton"
p:httpClient="#{getObject('shibboleth.authn.DuoOIDC.nimbus.HttpClient') ?: getObject('shibboleth.authn.DuoOIDC.nimbus.InternalHttpClient')}"
p:httpClientSecurityParameters="#{getObject('shibboleth.authn.DuoOIDC.nimbus.HttpClientSecurityParameters')}"
diff --git a/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties b/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties
index 8197251..87faac3 100644
--- a/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties
+++ b/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties
@@ -31,8 +31,6 @@ idp.duo.oidc.redirectURL = https://<hostname>:<port>/idp/profile/Authn/Duo/2FA/d
#idp.duo.oidc.endpoint.token = /oauth/v1/token
#idp.duo.oidc.endpoint.authorize = /oauth/v1/authorize
-idp.duo.oidc.clientFactoryBean = shibboleth.authn.DuoOIDC.nimbus.clientFactory
-
# With the Nimbus "client" impl, controls for HttpClient behavior
# These default to the global HttpClient options in services.properties
#idp.duo.oidc.connectionTimeout = PT1M
diff --git a/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/duo-client-factory-bean.xml b/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/duo-client-factory-bean.xml
index 79766a2..a8d1600 100644
--- a/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/duo-client-factory-bean.xml
+++ b/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/duo-client-factory-bean.xml
@@ -8,9 +8,9 @@
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
default-init-method="initialize" default-destroy-method="destroy">
-
-
- <bean id="shibboleth.authn.DuoOIDC.sdk.clientFactory"
+
+ <!-- Client factory with is own unique ID but common (default) alias/name -->
+ <bean id="shibboleth.authn.DuoOIDC.sdk.clientFactory" name="shibboleth.authn.DuoOIDC.clientFactory"
class="net.shibboleth.idp.plugin.authn.duo.sdk.impl.DuoSDKClientFactory" scope="singleton"
p:caCerts="#{getObject('shibboleth.authn.DuoOIDC.sdk.TrustedCertificates') ?: getObject('shibboleth.authn.DuoOIDC.sdk.DefaultTrustedCertificates')}">
diff --git a/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties b/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties
index dedcefc..d5e0ef2 100644
--- a/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties
+++ b/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties
@@ -31,8 +31,6 @@ idp.duo.oidc.redirectURL = https://<hostname>:<port>/idp/profile/Authn/Duo/2FA/d
#idp.duo.oidc.endpoint.token = /oauth/v1/token
#idp.duo.oidc.endpoint.authorize = /oauth/v1/authorize
-idp.duo.oidc.clientFactoryBean = shibboleth.authn.DuoOIDC.sdk.clientFactory
-
# Shouldn't need changing, controls the OIDC id_token claims verification
#idp.duo.oidc.jwt.verifier.clockSkew = PT60S
#idp.duo.oidc.jwt.verifier.iatWindow = PT60S
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list