[java-idp-plugin-duo] branch main updated: JDUO-47 - No Duo Context in shibboleth.authn.DuoOIDC.ContextToPrincipalMappingStrategy?

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-duo.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=7b835d5aa29763d86bfa7e66f4ccc5d7936bf1b7

The following commit(s) were added to refs/heads/main by this push:
       new  7b835d5   JDUO-47 - No Duo Context in shibboleth.authn.DuoOIDC.ContextToPrincipalMappingStrategy?
7b835d5 is described below

commit 7b835d5aa29763d86bfa7e66f4ccc5d7936bf1b7
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Jun 24 12:29:31 2021 +0100

    JDUO-47 - No Duo Context in
    shibboleth.authn.DuoOIDC.ContextToPrincipalMappingStrategy?
    
    Reordered the call to recordSuccess so it runs the cleanup hook after
    the authentication result is built. Hence the Duo context will still be
    available to the contextToPrincipalMappingStrategy.
    
    https://issues.shibboleth.net/jira/browse/JDUO-47
---
 .../plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java  | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
index ca350c5..2a91e6c 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
@@ -184,8 +184,11 @@ public class ValidateDuoTokenAuthenticationResult extends AbstractValidationActi
             
             if (DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW.equalsIgnoreCase(authResultStatus)){
                 log.info("{} Duo 2FA authentication succeeded for '{}'",getLogPrefix(),duoContext.getUsername());
-                recordSuccess(profileRequestContext);
+                //must build authentication before recording success. recordSuccess runs
+                //the cleanup hook which removes the Duo context and prevents useful operation
+                //of the contextToPrincipalMappingStrategy.
                 buildAuthenticationResult(profileRequestContext, authenticationContext);
+                recordSuccess(profileRequestContext);
                 return;
             } else if (DuoOIDCAuthAPI.DUO_AUTH_RESULT_DENY.equalsIgnoreCase(authResultStatus)) {
                 log.error("{} Duo 2FA failed for '{}', 2FA status '{}'",getLogPrefix(), username,

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.