[java-idp-plugin-duo] branch main updated: Catch controller errors
Phil Smart
philip.smart at jisc.ac.uk
Thu Mar 11 12:38:13 UTC 2021
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-duo.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=25f583c69c8e88a5aa9cda4f9292389c2635f3f9
The following commit(s) were added to refs/heads/main by this push:
new 25f583c Catch controller errors
25f583c is described below
commit 25f583c69c8e88a5aa9cda4f9292389c2635f3f9
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Mar 11 12:38:10 2021 +0000
Catch controller errors
- Some of which are now possible because of the change to the
DuoOIDCIntegration interface and defaults.
---
.../ValidateExternalAuthenticationContext.java | 82 ++++++++++++++++++++++
.../flows/authn/DuoOIDC/duo-oidc-authn-beans.xml | 3 +
.../flows/authn/DuoOIDC/duo-oidc-authn-flow.xml | 4 +-
3 files changed, 87 insertions(+), 2 deletions(-)
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateExternalAuthenticationContext.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateExternalAuthenticationContext.java
new file mode 100644
index 0000000..a45d0f3
--- /dev/null
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateExternalAuthenticationContext.java
@@ -0,0 +1,82 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.duo.impl;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import net.shibboleth.idp.authn.AbstractAuthenticationAction;
+import net.shibboleth.idp.authn.AuthnEventIds;
+import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.authn.context.ExternalAuthenticationContext;
+
+import org.opensaml.profile.action.ActionSupport;
+import org.opensaml.profile.action.EventIds;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * An action that checks for an {@link ExternalAuthenticationContext} for a signaled event via the
+ * {@link ExternalAuthenticationContext#getAuthnError()} method.
+ *
+ * @event {@link EventIds#PROCEED_EVENT_ID}
+ * @event {@link AuthnEventIds#INVALID_AUTHN_CTX}
+ * @event various
+ */
+public class ValidateExternalAuthenticationContext extends AbstractAuthenticationAction {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(ValidateExternalAuthenticationContext.class);
+
+ /** Context containing the result to examine. */
+ @Nullable private ExternalAuthenticationContext extContext;
+
+ /** {@inheritDoc} */
+ @Override
+ protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext,
+ @Nonnull final AuthenticationContext authenticationContext) {
+
+ if (!super.doPreExecute(profileRequestContext, authenticationContext)) {
+ return false;
+ }
+
+ extContext = authenticationContext.getSubcontext(ExternalAuthenticationContext.class);
+ if (extContext == null) {
+ log.debug("{} No ExternalAuthenticationContext available within authentication context", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_AUTHN_CTX);
+ return false;
+ }
+
+ return true;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
+ @Nonnull final AuthenticationContext authenticationContext) {
+
+ if (extContext.getAuthnError() != null) {
+ log.info("{} Duo 2FA authentication attempt signaled an error: {}", getLogPrefix(),
+ extContext.getAuthnError());
+ ActionSupport.buildEvent(profileRequestContext, extContext.getAuthnError());
+ }
+
+ }
+
+}
diff --git a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
index bc5688a..5d87770 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
@@ -121,6 +121,9 @@
<bean id="HealthCheckDuoOIDCAuthAPI" scope="prototype"
class="net.shibboleth.idp.plugin.authn.duo.impl.HealthCheckDuoOIDCAuthAPI" />
+
+ <bean id="ValidateExternalAuthenticationContext" scope="prototype"
+ class="net.shibboleth.idp.plugin.authn.duo.impl.ValidateExternalAuthenticationContext" />
<bean id="ValidateDuoResponseState" scope="prototype"
class="net.shibboleth.idp.plugin.authn.duo.impl.ValidateDuoResponseState" />
diff --git a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml
index 978fa27..ca568ce 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml
@@ -22,8 +22,7 @@
<transition on="proceed" to="proceed" />
</action-state>
-
- <!-- TODO: throws an AuthnException if the endpoint is not healthy, no backoff etc. -->
+
<action-state id="CheckDuoOIDCAuthAPI">
<evaluate expression="PopulateDuoAuthenticationContext" />
<evaluate expression="HealthCheckDuoOIDCAuthAPI" />
@@ -44,6 +43,7 @@
<!-- match the response state to the request state, fail if error -->
<action-state id="ValidateDuoResponse">
+ <evaluate expression="ValidateExternalAuthenticationContext"/>
<evaluate expression="ValidateDuoResponseState"/>
<evaluate expression="'proceed'" />
<transition on="proceed" to="ExchangeCodeForDuoToken" />
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list