[java-idp-plugin-duo] branch main updated: JDUO-62 - Flag to disable Duo Health Check

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-duo.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=ded9b6c1b1240de307a4c5d0b4308e214d47e478

The following commit(s) were added to refs/heads/main by this push:
     new ded9b6c  JDUO-62 - Flag to disable Duo Health Check
ded9b6c is described below

commit ded9b6c1b1240de307a4c5d0b4308e214d47e478
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Nov 9 17:46:21 2022 +0000

    JDUO-62 - Flag to disable Duo Health Check
    
    Add a flag to allow disabling of the Duo Health Check.
    
    https://shibboleth.atlassian.net/browse/JDUO-62
---
 .../net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml   | 4 +++-
 .../idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties        | 4 ++++
 .../idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties           | 4 ++++
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
index abfe45b..102b10f 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
@@ -120,7 +120,9 @@
         />       
 
     <bean id="HealthCheckDuoOIDCAuthAPI" scope="prototype"
-        class="net.shibboleth.idp.plugin.authn.duo.impl.HealthCheckDuoOIDCAuthAPI" />
+        class="net.shibboleth.idp.plugin.authn.duo.impl.HealthCheckDuoOIDCAuthAPI"
+        p:activationCondition="%{idp.duo.oidc.healthcheck.enabled:true}">
+    </bean>
         
     <bean id="ValidateExternalAuthenticationContext" scope="prototype"
         class="net.shibboleth.idp.plugin.authn.duo.impl.ValidateExternalAuthenticationContext" />
diff --git a/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties b/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties
index 1b87aec..436aee4 100644
--- a/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties
+++ b/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties
@@ -21,6 +21,10 @@ idp.duo.oidc.redirectURL = https://<hostname>:<port>/idp/profile/Authn/Duo/2FA/d
 # We suggest defining this in credentials/secrets.properties
 #idp.duo.oidc.secretKey = key
 
+## Enable the Duo health check for every 2FA request. Defaults to true to tightly follow 
+## the Duo described workflow. However, it is not *strictly* required. 
+#idp.duo.oidc.healthcheck.enabled=true
+
 # If a redirect_uri is not explicitly declared above, one can be inferred from each
 # request's Host header. To avoid Host header injection attacks, the allowed origins
 # must be specified here. Origins are comma seperated. Do not specify the port when
diff --git a/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties b/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties
index e9d7847..f0abb74 100644
--- a/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties
+++ b/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties
@@ -21,6 +21,10 @@ idp.duo.oidc.redirectURL = https://<hostname>:<port>/idp/profile/Authn/Duo/2FA/d
 # We suggest defining this in credentials/secrets.properties
 #idp.duo.oidc.secretKey = key
 
+## Enable the Duo health check for every 2FA request. Defaults to true to tightly follow 
+## the Duo described workflow. However, it is not *strictly* required. 
+#idp.duo.oidc.healthcheck.enabled=true
+
 # If a redirect_uri is not explicitly declared above, one can be inferred from the
 # Host header of the 'first' request. To avoid Host header injection attacks, the 
 # allowed origins must be specified here. Origins are comma seperated. Do not specify 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.