[java-idp-plugin-duo] branch main updated: JDUO-59 - Decode the raw JWT and log at DEBUG level in the Nimbus client

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-duo.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=0332a73f8de832aadcb5ea60c32be331dba45d1e

The following commit(s) were added to refs/heads/main by this push:
     new 0332a73  JDUO-59 - Decode the raw JWT and log at DEBUG level in the Nimbus client
0332a73 is described below

commit 0332a73f8de832aadcb5ea60c32be331dba45d1e
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Mar 25 15:12:19 2022 +0000

    JDUO-59 - Decode the raw JWT and log at DEBUG level in the Nimbus client
    
     - Base64url decoded and logged the JWT payload in the
    ExchangeCodeForDuoToken action. This works for both Nimbus and DuoSDK
    clients.
    
    https://shibboleth.atlassian.net/browse/JDUO-59
---
 .../authn/duo/impl/ExchangeCodeForDuoToken.java    | 24 +++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ExchangeCodeForDuoToken.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ExchangeCodeForDuoToken.java
index 354cdbe..e3cac25 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ExchangeCodeForDuoToken.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ExchangeCodeForDuoToken.java
@@ -20,12 +20,14 @@ package net.shibboleth.idp.plugin.authn.duo.impl;
 import java.text.ParseException;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import org.opensaml.profile.action.ActionSupport;
 import org.opensaml.profile.context.ProfileRequestContext;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import com.nimbusds.jwt.EncryptedJWT;
 import com.nimbusds.jwt.JWT;
 
 import net.shibboleth.idp.authn.AuthnEventIds;
@@ -86,6 +88,7 @@ public class ExchangeCodeForDuoToken extends AbstractDuoAuthenticationAction{
                 //debug is not enabled!
                 log.debug("{} Duo 2FA token received for subject '{}'",getLogPrefix(),
                         token.getJWTClaimsSet().getSubject());
+                logDecodedTokenPayload(token);
             }
             duoContext.setAuthToken(token);            
             //success
@@ -93,8 +96,27 @@ public class ExchangeCodeForDuoToken extends AbstractDuoAuthenticationAction{
             log.error("{} Unable to exchange authorisation code for 2FA result",getLogPrefix(),e);
             ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.AUTHN_EXCEPTION);
             return;
+        }   
+    }
+    
+    /**
+     * If the token is not encrypted, and the original parsed parts exist, log the payload
+     * base64url decoded. Otherwise do nothing.
+     * 
+     * @param token the JWT
+     */
+    private void logDecodedTokenPayload(@Nullable final JWT token) {
+        if (token == null || token instanceof EncryptedJWT) {
+            // Should never been encrypted, but just check in case, we can not log the payload
+        } else {
+            // We can base64url decode the payload and log
+            if (token.getParsedParts() != null && token.getParsedParts().length == 3 && 
+                    token.getParsedParts()[1] != null) {
+                final String decodedPayload = token.getParsedParts()[1].decodeToString();
+                log.debug("{} JWT payload base64url decoded: '{}'", getLogPrefix(), decodedPayload);
+            }
+            
         }
-        
     }
 
 }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.