[java-idp-plugin-duo] branch main updated: JDUO-61 - Log transactional information ahead of redirect to Duo
Phil Smart
philip.smart at jisc.ac.uk
Tue Nov 15 16:23:40 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-duo.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=2a4ca76692badcf544bca50505569373613ce372
The following commit(s) were added to refs/heads/main by this push:
new 2a4ca76 JDUO-61 - Log transactional information ahead of redirect to Duo
2a4ca76 is described below
commit 2a4ca76692badcf544bca50505569373613ce372
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Nov 15 16:23:35 2022 +0000
JDUO-61 - Log transactional information ahead of redirect to Duo
- Add seperate AuditContext for Duo
- Change default logger name
https://shibboleth.atlassian.net/browse/JDUO-61
---
.../idp/plugin/authn/duo/audit/AuditFields.java | 4 +--
...ttemptedAuthenticationFlowIdAuditExtractor.java | 34 ++++++++++++++++++++++
.../META-INF/net.shibboleth.idp/postconfig.xml | 9 +++---
.../flows/authn/DuoOIDC/duo-oidc-authn-beans.xml | 26 ++++++++++++++---
4 files changed, 62 insertions(+), 11 deletions(-)
diff --git a/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/audit/AuditFields.java b/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/audit/AuditFields.java
index 37b295b..025829c 100644
--- a/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/audit/AuditFields.java
+++ b/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/audit/AuditFields.java
@@ -32,8 +32,8 @@ public final class AuditFields {
// no op
}
- /** Duo Transaction log discriminator. */
- @Nonnull @NotEmpty public static final String DISCRIMINATOR = "DuoDISC";
+ /** The id of the currently attempted flow. */
+ @Nonnull @NotEmpty public static final String ATTEMPTED_AUTHN_FLOW_ID = "AAF";
/** Duo Transaction ID. */
@Nonnull @NotEmpty public static final String TXID = "DuoTXID";
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/audit/impl/AttemptedAuthenticationFlowIdAuditExtractor.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/audit/impl/AttemptedAuthenticationFlowIdAuditExtractor.java
new file mode 100644
index 0000000..53b6f90
--- /dev/null
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/audit/impl/AttemptedAuthenticationFlowIdAuditExtractor.java
@@ -0,0 +1,34 @@
+package net.shibboleth.idp.plugin.authn.duo.audit.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.authn.AuthenticationFlowDescriptor;
+import net.shibboleth.idp.authn.context.AuthenticationContext;
+
+/** An audit extractor to pull out the attempted authentication flow ID from the current authentication context.*/
+public class AttemptedAuthenticationFlowIdAuditExtractor implements Function<ProfileRequestContext, String> {
+
+ @Override
+ public String apply(@Nullable final ProfileRequestContext profileRequestContext) {
+
+ if (profileRequestContext == null) {
+ return null;
+ }
+
+ final AuthenticationContext authContext =
+ profileRequestContext.getSubcontext(AuthenticationContext.class);
+ if (authContext != null) {
+ final AuthenticationFlowDescriptor afd = authContext.getAttemptedFlow();
+ if (afd != null) {
+ return afd.getId();
+ }
+ }
+ return null;
+
+ }
+
+}
diff --git a/idp-duo-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-duo-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 807d5f6..208d944 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -38,20 +38,19 @@
<!-- Default audit format and extractors -->
<util:map id="shibboleth.authn.DuoOIDC.DefaultAuditFormattingMap">
- <entry key="Shibboleth-Audit" value="%a|%ST|%T|%DuoDISC|%DuoU|%DuoReqS|%DuoRespS|%DuoTXID|%DuoDID|%DuoDN|%DuoR|%DuoF" />
+ <entry key="Shibboleth-Audit.DuoOIDC" value="%AAF|%a|%T|%DuoU|%DuoReqS|%DuoRespS|%DuoTXID|%DuoDID|%DuoDN|%DuoR|%DuoF" />
</util:map>
<bean id="shibboleth.authn.DuoOIDC.DefaultPreDuoPopulateAuditExtractors" lazy-init="true"
class="org.springframework.beans.factory.config.MapFactoryBean">
<property name="sourceMap">
- <map>
+ <map>
<entry>
<key>
- <util:constant static-field="net.shibboleth.idp.plugin.authn.duo.audit.AuditFields.DISCRIMINATOR"/>
+ <util:constant static-field="net.shibboleth.idp.plugin.authn.duo.audit.AuditFields.ATTEMPTED_AUTHN_FLOW_ID"/>
</key>
- <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.FixedStringAuditExtractor"
- c:value="Duo2FA"/>
+ <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.AttemptedAuthenticationFlowIdAuditExtractor" />
</entry>
<entry>
<key>
diff --git a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
index fc970c2..7d4e669 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
@@ -55,6 +55,20 @@
<bean id="shibboleth.authn.DuoOIDC.clientRegistry" scope="singleton"
class="net.shibboleth.idp.plugin.authn.duo.impl.DefaultDuoOIDCClientRegistry"
p:clientFactory-ref="%{idp.duo.oidc.clientFactoryBean:shibboleth.authn.DuoOIDC.clientFactory}"/>
+
+ <!-- Some function beans -->
+ <bean id="shibboleth.authn.DuoOIDC.ChildLookup.AuditContext"
+ parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g">
+ <bean id="shibboleth.ChildLookup.AuditContext"
+ class="org.opensaml.messaging.context.navigate.ChildContextLookup"
+ c:type="#{ T(net.shibboleth.idp.profile.context.AuditContext) }"
+ c:createContext="true" />
+ </constructor-arg>
+ <constructor-arg name="f">
+ <ref bean="shibboleth.ChildLookup.AuthenticationContext" />
+ </constructor-arg>
+ </bean>
<!--
Load all (or none) factory bean definitions from the classpath. The defaulted factory bean must be called
@@ -125,7 +139,8 @@
</bean>
<bean id="PreDuoPopulateAuditContext" parent="shibboleth.authn.DuoOIDC.AbstractPopulateAuditContext"
- p:fieldExtractors="#{getObject('shibboleth.authn.DuoOIDC.PreDuoPopulateAuditExtractors') ?: getObject('shibboleth.authn.DuoOIDC.DefaultPreDuoPopulateAuditExtractors')}" />
+ p:fieldExtractors="#{getObject('shibboleth.authn.DuoOIDC.PreDuoPopulateAuditExtractors') ?: getObject('shibboleth.authn.DuoOIDC.DefaultPreDuoPopulateAuditExtractors')}"
+ p:auditContextCreationStrategy-ref="shibboleth.authn.DuoOIDC.ChildLookup.AuditContext"/>
<bean id="ValidateExternalAuthenticationContext" scope="prototype"
@@ -238,18 +253,21 @@
<bean id="PreStateValidationPopulateAuditContext" parent="shibboleth.authn.DuoOIDC.AbstractPopulateAuditContext"
- p:fieldExtractors="#{getObject('shibboleth.authn.DuoOIDC.PreStateValidationPopulateAuditExtractors') ?: getObject('shibboleth.authn.DuoOIDC.DefaultPreStateValidationPopulateAuditExtractors')}" />
+ p:fieldExtractors="#{getObject('shibboleth.authn.DuoOIDC.PreStateValidationPopulateAuditExtractors') ?: getObject('shibboleth.authn.DuoOIDC.DefaultPreStateValidationPopulateAuditExtractors')}"
+ p:auditContextCreationStrategy-ref="shibboleth.authn.DuoOIDC.ChildLookup.AuditContext"/>
<bean id="PostDuoPopulateAuditContext" parent="shibboleth.authn.DuoOIDC.AbstractPopulateAuditContext"
- p:fieldExtractors="#{getObject('shibboleth.authn.DuoOIDC.PostDuoPopulateAuditExtractors') ?: getObject('shibboleth.authn.DuoOIDC.DefaultPostDuoPopulateAuditExtractors')}" />
+ p:fieldExtractors="#{getObject('shibboleth.authn.DuoOIDC.PostDuoPopulateAuditExtractors') ?: getObject('shibboleth.authn.DuoOIDC.DefaultPostDuoPopulateAuditExtractors')}"
+ p:auditContextCreationStrategy-ref="shibboleth.authn.DuoOIDC.ChildLookup.AuditContext"/>
<bean id="WriteAuditLog" class="net.shibboleth.idp.profile.audit.impl.WriteAuditLog" scope="prototype"
p:formattingMap="#{getObject('shibboleth.authn.DuoOIDC.AuditFormattingMap') ?: getObject('shibboleth.authn.DuoOIDC.DefaultAuditFormattingMap')}"
p:dateTimeFormat="#{getObject('shibboleth.AuditDateTimeFormat')}"
p:useDefaultTimeZone="#{getObject('shibboleth.AuditDefaultTimeZone') ?: false}"
p:httpServletRequest-ref="shibboleth.HttpServletRequest"
- p:activationCondition="%{idp.duo.oidc.writeaudit:false}"/>
+ p:activationCondition="%{idp.duo.oidc.writeaudit:false}"
+ p:auditContextLookupStrategy-ref="shibboleth.authn.DuoOIDC.ChildLookup.AuditContext"/>
<bean id="ValidateDuoTokenAuthenticationResult" scope="prototype"
class="net.shibboleth.idp.plugin.authn.duo.impl.ValidateDuoTokenAuthenticationResult"
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list