[java-idp-plugin-duo] branch main updated: Improve handleError messages. Remove default classified messages

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-duo.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=ea5443f7595f8971845aba667c0cd6656f0fe22a

The following commit(s) were added to refs/heads/main by this push:
       new  ea5443f   Improve handleError messages. Remove default classified messages
ea5443f is described below

commit ea5443f7595f8971845aba667c0cd6656f0fe22a
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Jan 6 15:06:30 2021 +0000

    Improve handleError messages. Remove default classified messages
    
    Duo 2FA terminates on their site and only 'allow' status is ever
    returned, hence a default classified messages map makes no sense at this
    stage.
---
 .../net/shibboleth/idp/plugin/authn/duo/impl/DuoSupport.java |  3 ++-
 .../authn/duo/impl/ValidateDuoTokenAuthenticationResult.java |  6 +++---
 .../idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml         | 12 +-----------
 3 files changed, 6 insertions(+), 15 deletions(-)

diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoSupport.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoSupport.java
index 774e006..1966ffb 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoSupport.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoSupport.java
@@ -63,7 +63,8 @@ public final class DuoSupport {
      * <p>The nonce is separated from the key by a dot e.g. {@literal <nonce>.<keyHex>}.</p>
      * 
      *  <p>The nonce is assumed to be already encoded in its transmission format e.g. Hex. The key is
-     *  hex encoded before it is combined with the nonce.</p>
+     *  hex encoded before it is combined with the nonce. The result is assumed URL encoded e.g. inside
+     *  the allowed set of URI characters or, no character in the state is from the URI reserved set.</p>
      * 
      * @param nonce the nonce component. 
      * @param key the key component. The key is hex encoded before it is added to the generated state.
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
index 04435b0..88b175b 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
@@ -167,7 +167,7 @@ public class ValidateDuoTokenAuthenticationResult extends AbstractValidationActi
             }
         } catch (final ParseException | DuoException e) {
             log.error("{} Duo 2FA access failed for '{}', auth_result missing",getLogPrefix(), username);
-            handleError(profileRequestContext, authenticationContext,"Unexepected Authentication Response", 
+            handleError(profileRequestContext, authenticationContext,AuthnEventIds.AUTHN_EXCEPTION, 
                     AuthnEventIds.AUTHN_EXCEPTION);
             recordFailure(profileRequestContext);
             return;
@@ -195,14 +195,14 @@ public class ValidateDuoTokenAuthenticationResult extends AbstractValidationActi
                 return;
             } else {        
                 log.error("{} Duo 2FA access failed for '{}', unknown response", getLogPrefix(), username);
-                handleError(profileRequestContext, authenticationContext,"Unexepected Authentication Response", 
+                handleError(profileRequestContext, authenticationContext,AuthnEventIds.AUTHN_EXCEPTION, 
                         AuthnEventIds.AUTHN_EXCEPTION);
                 recordFailure(profileRequestContext);
                 return;
             }
         } else {
             log.error("{} Duo 2FA access failed for '{}', auth_results missing",getLogPrefix(), username);
-            handleError(profileRequestContext, authenticationContext,"Unexepected Authentication Response", 
+            handleError(profileRequestContext, authenticationContext,AuthnEventIds.AUTHN_EXCEPTION, 
                     AuthnEventIds.AUTHN_EXCEPTION);
             recordFailure(profileRequestContext);
             return;
diff --git a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
index 480d5ce..f536054 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
@@ -103,21 +103,11 @@
 
     <bean id="ValidateDuoTokenAuthenticationResult" scope="prototype"
         class="net.shibboleth.idp.plugin.authn.duo.impl.ValidateDuoTokenAuthenticationResult"        
-        p:classifiedMessages="#{getObject('shibboleth.authn.DuoOIDC.ClassifiedMessageMap') ?: getObject('shibboleth.authn.DuoOIDC.DefaultClassifiedMessageMap')}"
+        p:classifiedMessages="#{getObject('shibboleth.authn.DuoOIDC.ClassifiedMessageMap')}"
         p:resultCachingPredicate="#{getObject('shibboleth.authn.DuoOIDC.resultCachingPredicate')}"
         p:cleanupHook="#{getObject('shibboleth.authn.DuoOIDC.CleanUpHook') ?: getObject('shibboleth.authn.DuoOIDC.DefaultCleanupHook')}"
         p:contextToPrincipalMappingStrategy="#{getObject('shibboleth.authn.DuoOIDC.ContextToPrincipalMappingStrategy')}" 
         p:addDefaultPrincipals="#{getObject('shibboleth.authn.DuoOIDC.ContextToPrincipalMappingStrategy') == null}"/>
 
 
-    <!-- TODO may not be the correct values for the new API -->
-    <util:map id="shibboleth.authn.DuoOIDC.DefaultClassifiedMessageMap">
-        <entry key="AccountLocked">
-            <list>
-                <value>locked_out</value>
-                <value>Your two-factor account is disabled.</value>
-            </list>
-        </entry>
-    </util:map>
-
 </beans>
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.