[java-idp-plugin-duo] branch main updated: JDUO-60 - idp.authn.DuoOIDC.addDefaultPrincipals property should be supported

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-duo.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=d5dee4073463328d4c5b4a21cbc7cd7c6338a9aa

The following commit(s) were added to refs/heads/main by this push:
     new d5dee40  JDUO-60 - idp.authn.DuoOIDC.addDefaultPrincipals property should be supported
d5dee40 is described below

commit d5dee4073463328d4c5b4a21cbc7cd7c6338a9aa
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Nov 16 10:04:32 2022 +0000

    JDUO-60 - idp.authn.DuoOIDC.addDefaultPrincipals property should be
    supported
    
     - added support for the property and included defaults in properties
    file
    
    https://shibboleth.atlassian.net/browse/JDUO-60
---
 .../authn/duo/impl/ValidateDuoTokenAuthenticationResult.java     | 9 ++++-----
 .../shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml  | 2 +-
 .../idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties   | 4 ++++
 .../idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties      | 4 ++++
 4 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
index fdd2bcc..2895789 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
@@ -245,14 +245,13 @@ public class ValidateDuoTokenAuthenticationResult extends AbstractValidationActi
     /** {@inheritDoc} */
     @Override protected Subject populateSubject(@Nonnull final Subject subject) {
         
-        //Always add the custom Duo principal
+        // Always add the custom Duo principal
         subject.getPrincipals().add(new DuoPrincipal(username));
-        //Always add any principals specified on the integration
+        // Always add any principals specified on the integration
         subject.getPrincipals().addAll(duoContext.getIntegration().getSupportedPrincipals(Principal.class));
         
-        //add any further principals from a function hook that can inspect the Duo response.
-        //If the mapping strategy is set, the defaults should not be copied over from the flow. Hence,
-        //these will be added only to those added above (this is configured in the XML).
+        // add any further principals from a function hook that can inspect the Duo response if the
+        // mapping strategy is set.
         if (getContextToPrincipalMappingStrategy() != null) {
             final Collection<Principal> mapped = getContextToPrincipalMappingStrategy().apply(prc);
             if (mapped != null) {
diff --git a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
index 7d4e669..092a2de 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
@@ -275,7 +275,7 @@
         p:resultCachingPredicate="#{getObject('shibboleth.authn.DuoOIDC.resultCachingPredicate')}"
         p:cleanupHook="#{getObject('shibboleth.authn.DuoOIDC.CleanUpHook') ?: getObject('shibboleth.authn.DuoOIDC.DefaultCleanupHook')}"
         p:contextToPrincipalMappingStrategy="#{getObject('shibboleth.authn.DuoOIDC.ContextToPrincipalMappingStrategy')}" 
-        p:addDefaultPrincipals="#{getObject('shibboleth.authn.DuoOIDC.ContextToPrincipalMappingStrategy') == null}"/>
+        p:addDefaultPrincipals="#{%{idp.authn.DuoOIDC.addDefaultPrincipals:true} and getObject('shibboleth.authn.DuoOIDC.ContextToPrincipalMappingStrategy') == null}"/>
 
 
     <!-- Audit System Setup Specific to Duo -->
diff --git a/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties b/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties
index 1533dd5..9fd0c1b 100644
--- a/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties
+++ b/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties
@@ -31,6 +31,10 @@ idp.duo.oidc.redirectURL = https://<hostname>:<port>/idp/profile/Authn/Duo/2FA/d
 # using the default ports.
 #idp.duo.oidc.redirecturl.allowedOrigins = https://localhost
 
+## If false this will prevent the addition of the default principals even if a ContextToPrincipalMappingStrategy
+## is not set.
+#idp.authn.DuoOIDC.addDefaultPrincipals = true
+
 # Non-Browser AuthAPI integration if desired
 #idp.duo.oidc.nonbrowser.apiHost = %{idp.duo.oidc.apiHost}
 #idp.duo.oidc.nonbrowser.integrationKey = ikey
diff --git a/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties b/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties
index 6d787d7..364b4cb 100644
--- a/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties
+++ b/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties
@@ -31,6 +31,10 @@ idp.duo.oidc.redirectURL = https://<hostname>:<port>/idp/profile/Authn/Duo/2FA/d
 # the port when using default ports.
 #idp.duo.oidc.redirecturl.allowedOrigins = https://localhost
 
+## If false this will prevent the addition of the default principals even if a ContextToPrincipalMappingStrategy
+## is not set.
+#idp.authn.DuoOIDC.addDefaultPrincipals = true
+
 # Non-Browser AuthAPI integration if desired
 #idp.duo.oidc.nonbrowser.apiHost = %{idp.duo.oidc.apiHost}
 #idp.duo.oidc.nonbrowser.integrationKey = ikey

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.