[java-idp-plugin-duo] branch main updated: JDUO-73 - Null Handling Task
Phil Smart
philip.smart at jisc.ac.uk
Tue Aug 22 15:53:29 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-duo.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=69bc3bf7ae5ba3cbae7c58c1e17f72aa44157b66
The following commit(s) were added to refs/heads/main by this push:
new 69bc3bf JDUO-73 - Null Handling Task
69bc3bf is described below
commit 69bc3bf7ae5ba3cbae7c58c1e17f72aa44157b66
Author: philipsmart <philipsmart at 192.168.1.120>
AuthorDate: Tue Aug 22 16:53:27 2023 +0100
JDUO-73 - Null Handling Task
https://shibboleth.atlassian.net/browse/JDUO-73
---
.../authn/duo/AbstractDuoAuthenticationAction.java | 6 +--
.../authn/duo/DefaultDuoOIDCIntegration.java | 2 +-
.../plugin/authn/duo/SimpleDuoOIDCIntegration.java | 2 +-
.../AbstractDuoTokenClaimsAuditExtractor.java | 12 ++++--
.../duo/audit/impl/DuoClientIdAuditExtractor.java | 10 +++--
.../audit/impl/DuoRedirectUriAuditExtractor.java | 10 +++--
.../duo/impl/DefaultDuoOIDCClientRegistry.java | 9 +++--
.../impl/DefaultRedirectURICreationStrategy.java | 10 +++--
.../duo/impl/DuoAudienceClaimLookupStrategy.java | 8 ++--
.../duo/impl/DuoIssuerClaimLookupStrategy.java | 7 +++-
.../duo/impl/DuoNonceClaimLookupStrategy.java | 8 ++--
.../authn/duo/impl/DuoOIDCAuthnController.java | 28 ++++++++-----
.../duo/impl/DuoUsernameClaimLookupStrategy.java | 8 ++--
.../authn/duo/impl/ExchangeCodeForDuoToken.java | 2 +-
.../authn/duo/impl/HealthCheckDuoOIDCAuthAPI.java | 2 +-
.../duo/impl/PopulateDuoAuthenticationContext.java | 11 +++---
.../authn/duo/impl/ValidateDuoResponseState.java | 8 ++--
.../impl/ValidateDuoTokenAuthenticationResult.java | 39 +++++++++++++-----
.../ValidateExternalAuthenticationContext.java | 21 +++++-----
.../plugin/authn/duo/impl/ValidateTokenClaims.java | 5 ++-
.../authn/duo/impl/ValidateTokenSignature.java | 14 +++----
.../impl/AbstractAuthnXmlFlowExecutionTests.java | 14 ++++---
.../authn/duo/impl/AbstractDuoActionTest.java | 4 +-
.../authn/duo/impl/DualDuoIntegrationStrategy.java | 1 +
.../impl/DuoAudienceClaimLookupStrategyTest.java | 10 +++--
.../plugin/authn/duo/impl/DuoAuthnFlowTest.java | 4 +-
.../duo/impl/DuoIssuerClaimLookupStrategyTest.java | 10 +++--
.../duo/impl/DuoNonceClaimLookupStrategyTest.java | 4 +-
.../authn/duo/impl/DuoOIDCAuthnControllerTest.java | 29 ++++++--------
.../impl/DuoUsernameClaimLookupStrategyTest.java | 5 +--
.../duo/impl/ExchangeCodeForDuoTokenTest.java | 18 +++++++--
.../duo/impl/HealthCheckDuoOIDCAuthAPITest.java | 16 ++++++--
.../duo/impl/InMemoryCredentialValidator.java | 2 +-
.../impl/PopulateDuoAuthenticationContextTest.java | 12 ++++--
.../ValidateDuoTokenAuthenticationResultTest.java | 46 +++++++++++++++++-----
.../authn/duo/impl/ValidateTokenSignatureTest.java | 6 ++-
.../plugin/authn/duo/nimbus/impl/NimbusClient.java | 4 +-
.../duo/nimbus/impl/NimbusClientFactoryTest.java | 11 +++---
.../duo/nimbus/impl/NimbusClientSupportTest.java | 23 +++++------
.../authn/duo/nimbus/impl/NimbusClientTest.java | 10 +++--
.../authn/duo/sdk/impl/DuoSDKClientAdaptor.java | 11 ++++--
.../authn/duo/sdk/impl/DuoSDKClientFactory.java | 8 +---
.../duo/sdk/impl/DuoSDKClientFactoryTest.java | 5 ++-
43 files changed, 304 insertions(+), 171 deletions(-)
diff --git a/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/AbstractDuoAuthenticationAction.java b/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/AbstractDuoAuthenticationAction.java
index 8cca2a3..72c5669 100644
--- a/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/AbstractDuoAuthenticationAction.java
+++ b/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/AbstractDuoAuthenticationAction.java
@@ -17,20 +17,20 @@ package net.shibboleth.idp.plugin.authn.duo;
import java.util.function.Function;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.authn.AbstractAuthenticationAction;
import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.plugin.authn.duo.context.DuoOIDCAuthenticationContext;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* <p>A base class for Duo 2FA authentication related actions.</p>
@@ -55,7 +55,7 @@ public abstract class AbstractDuoAuthenticationAction extends AbstractAuthentica
@Nonnull private Function<ProfileRequestContext,DuoOIDCAuthenticationContext> duoContextLookupStrategy;
/** The Duo authentication Context.*/
- @Nullable private DuoOIDCAuthenticationContext duoContext;
+ @NonnullBeforeExec private DuoOIDCAuthenticationContext duoContext;
/** Constructor.*/
diff --git a/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/DefaultDuoOIDCIntegration.java b/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/DefaultDuoOIDCIntegration.java
index 3c87aef..5e983db 100644
--- a/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/DefaultDuoOIDCIntegration.java
+++ b/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/DefaultDuoOIDCIntegration.java
@@ -27,7 +27,6 @@ import javax.annotation.concurrent.ThreadSafe;
import javax.security.auth.Subject;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
@@ -37,6 +36,7 @@ import net.shibboleth.shared.annotation.constraint.Unmodifiable;
import net.shibboleth.shared.component.AbstractInitializableComponent;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
diff --git a/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/SimpleDuoOIDCIntegration.java b/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/SimpleDuoOIDCIntegration.java
index 9b8ab4e..8bd8aca 100644
--- a/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/SimpleDuoOIDCIntegration.java
+++ b/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/SimpleDuoOIDCIntegration.java
@@ -26,7 +26,6 @@ import javax.annotation.concurrent.ThreadSafe;
import javax.security.auth.Subject;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
@@ -35,6 +34,7 @@ import net.shibboleth.shared.annotation.constraint.Unmodifiable;
import net.shibboleth.shared.component.AbstractInitializableComponent;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
diff --git a/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/audit/AbstractDuoTokenClaimsAuditExtractor.java b/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/audit/AbstractDuoTokenClaimsAuditExtractor.java
index deab466..98cb4f9 100644
--- a/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/audit/AbstractDuoTokenClaimsAuditExtractor.java
+++ b/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/audit/AbstractDuoTokenClaimsAuditExtractor.java
@@ -22,6 +22,7 @@ import javax.annotation.concurrent.ThreadSafe;
import org.opensaml.profile.context.ProfileRequestContext;
+import com.nimbusds.jwt.JWT;
import com.nimbusds.jwt.JWTClaimsSet;
import net.shibboleth.idp.authn.context.AuthenticationContext;
@@ -50,12 +51,13 @@ public abstract class AbstractDuoTokenClaimsAuditExtractor<T> extends AbstractDu
return null;
}
final DuoOIDCAuthenticationContext duoContext = authnContext.getSubcontext(DuoOIDCAuthenticationContext.class);
- if (duoContext == null || duoContext.getAuthToken() == null) {
+ final JWT authToken = duoContext != null ? duoContext.getAuthToken() : null;
+ if (authToken == null) {
return null;
}
JWTClaimsSet claimsSet = null;
try {
- claimsSet = duoContext.getAuthToken().getJWTClaimsSet();
+ claimsSet = authToken.getJWTClaimsSet();
if (claimsSet == null) {
return null;
}
@@ -69,7 +71,11 @@ public abstract class AbstractDuoTokenClaimsAuditExtractor<T> extends AbstractDu
@Nullable protected T doLookup(@Nonnull final DuoOIDCAuthenticationContext duoContext) {
JWTClaimsSet claimsSet = null;
try {
- claimsSet = duoContext.getAuthToken().getJWTClaimsSet();
+ final JWT authToken = duoContext.getAuthToken();
+ if (authToken == null) {
+ return null;
+ }
+ claimsSet = authToken.getJWTClaimsSet();
if (claimsSet == null) {
return null;
}
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/audit/impl/DuoClientIdAuditExtractor.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/audit/impl/DuoClientIdAuditExtractor.java
index e6fad4f..252e323 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/audit/impl/DuoClientIdAuditExtractor.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/audit/impl/DuoClientIdAuditExtractor.java
@@ -14,6 +14,9 @@
package net.shibboleth.idp.plugin.authn.duo.audit.impl;
+import javax.annotation.Nonnull;
+
+import net.shibboleth.idp.plugin.authn.duo.DuoOIDCIntegration;
import net.shibboleth.idp.plugin.authn.duo.audit.AbstractDuoAuditExtractor;
import net.shibboleth.idp.plugin.authn.duo.context.DuoOIDCAuthenticationContext;
@@ -21,9 +24,10 @@ import net.shibboleth.idp.plugin.authn.duo.context.DuoOIDCAuthenticationContext;
public class DuoClientIdAuditExtractor extends AbstractDuoAuditExtractor<String> {
@Override
- protected String doLookup(final DuoOIDCAuthenticationContext context) {
- if (context.getIntegration() != null) {
- return context.getIntegration().getClientId();
+ protected String doLookup(@Nonnull final DuoOIDCAuthenticationContext context) {
+ final DuoOIDCIntegration integration = context.getIntegration();
+ if (integration != null) {
+ return integration.getClientId();
}
return null;
}
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/audit/impl/DuoRedirectUriAuditExtractor.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/audit/impl/DuoRedirectUriAuditExtractor.java
index 7a95845..3c8bc89 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/audit/impl/DuoRedirectUriAuditExtractor.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/audit/impl/DuoRedirectUriAuditExtractor.java
@@ -14,6 +14,9 @@
package net.shibboleth.idp.plugin.authn.duo.audit.impl;
+import javax.annotation.Nonnull;
+
+import net.shibboleth.idp.plugin.authn.duo.DuoOIDCIntegration;
import net.shibboleth.idp.plugin.authn.duo.audit.AbstractDuoAuditExtractor;
import net.shibboleth.idp.plugin.authn.duo.context.DuoOIDCAuthenticationContext;
@@ -21,10 +24,11 @@ import net.shibboleth.idp.plugin.authn.duo.context.DuoOIDCAuthenticationContext;
public class DuoRedirectUriAuditExtractor extends AbstractDuoAuditExtractor<String> {
@Override
- protected String doLookup(final DuoOIDCAuthenticationContext context) {
- if (context.getIntegration() != null) {
+ protected String doLookup(@Nonnull final DuoOIDCAuthenticationContext context) {
+ final DuoOIDCIntegration integration = context.getIntegration();
+ if (integration != null) {
return context.getRedirectURIOverride() != null ?
- context.getRedirectURIOverride() : context.getIntegration().getRedirectURI();
+ context.getRedirectURIOverride() : integration.getRedirectURI();
}
return context.getRedirectURIOverride();
}
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DefaultDuoOIDCClientRegistry.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DefaultDuoOIDCClientRegistry.java
index e5a93d3..6c7b077 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DefaultDuoOIDCClientRegistry.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DefaultDuoOIDCClientRegistry.java
@@ -25,7 +25,6 @@ import javax.annotation.concurrent.GuardedBy;
import javax.annotation.concurrent.ThreadSafe;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.plugin.authn.duo.DefaultDuoOIDCIntegration;
import net.shibboleth.idp.plugin.authn.duo.DuoClientException;
@@ -40,6 +39,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* <p>The default Duo Client registry for mapping a {@link DuoOIDCIntegration} to either a new
@@ -70,7 +70,7 @@ public class DefaultDuoOIDCClientRegistry extends AbstractIdentifiableInitializa
@Nonnull private final Logger log = LoggerFactory.getLogger(DefaultDuoOIDCClientRegistry.class);
/** Factory to produce Duo clients.*/
- @GuardedBy("this") @Nullable @NonnullAfterInit private DuoOIDCClientFactory clientFactory;
+ @GuardedBy("this") @NonnullAfterInit private DuoOIDCClientFactory clientFactory;
/** Registry of Duo client to Duo integration.*/
@Nonnull @NonnullElements private final ConcurrentMap<DuoOIDCIntegration, DuoOIDCClient> clientRegistry;
@@ -102,7 +102,7 @@ public class DefaultDuoOIDCClientRegistry extends AbstractIdentifiableInitializa
*
* @return the client factory.
*/
- @Nullable private synchronized DuoOIDCClientFactory getClientFactory() {
+ @NonnullAfterInit private synchronized DuoOIDCClientFactory getClientFactory() {
return clientFactory;
}
@@ -144,9 +144,10 @@ public class DefaultDuoOIDCClientRegistry extends AbstractIdentifiableInitializa
@Nonnull private final Logger log = LoggerFactory.getLogger(CreateNewClientMappingFunction.class);
@Override
- @Nonnull public DuoOIDCClient apply(@Nonnull final DuoOIDCIntegration integration){
+ @Nonnull public DuoOIDCClient apply(@Nullable final DuoOIDCIntegration integration){
try {
+ assert integration != null;
log.debug("Creating a new Duo client for integration '{}', using factory type '{}'",integration
,getClientFactory().getClass().getTypeName());
return getClientFactory().createInstance(integration);
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DefaultRedirectURICreationStrategy.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DefaultRedirectURICreationStrategy.java
index d53ae63..eef7ff9 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DefaultRedirectURICreationStrategy.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DefaultRedirectURICreationStrategy.java
@@ -24,7 +24,6 @@ import javax.annotation.concurrent.Immutable;
import javax.annotation.concurrent.ThreadSafe;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import jakarta.servlet.http.HttpServletRequest;
import net.shibboleth.idp.plugin.authn.duo.DynamicDuoOIDCIntegration;
@@ -32,6 +31,7 @@ import net.shibboleth.idp.plugin.authn.duo.URISupport;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Constructive, pure, function that returns a redirect_uri from one of (ordered):
@@ -69,9 +69,13 @@ public final class DefaultRedirectURICreationStrategy
}
@Override
- @Nullable public String apply(@Nonnull final HttpServletRequest request,
- @Nonnull final DynamicDuoOIDCIntegration integration) {
+ @Nullable public String apply(@Nullable final HttpServletRequest request,
+ @Nullable final DynamicDuoOIDCIntegration integration) {
+ if (integration == null || request == null) {
+ log.warn("Duo Integration or http request was null");
+ return null;
+ }
final String redirectFromIntegration = integration.getRegisteredRedirectURI();
if (redirectFromIntegration != null) {
log.trace("Using redirect_uri '{}' from the Duo integration settings", redirectFromIntegration);
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoAudienceClaimLookupStrategy.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoAudienceClaimLookupStrategy.java
index 5096559..7ff46b0 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoAudienceClaimLookupStrategy.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoAudienceClaimLookupStrategy.java
@@ -16,7 +16,6 @@ package net.shibboleth.idp.plugin.authn.duo.impl;
import java.util.function.BiFunction;
-import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import javax.annotation.concurrent.ThreadSafe;
@@ -35,9 +34,12 @@ import net.shibboleth.idp.plugin.authn.duo.context.DuoOIDCAuthenticationContext;
@ThreadSafe
public final class DuoAudienceClaimLookupStrategy implements BiFunction<ProfileRequestContext, JWTClaimsSet, String> {
- @Override @Nullable public String apply(@Nonnull final ProfileRequestContext context,
- @Nonnull final JWTClaimsSet cliams) {
+ @Override @Nullable public String apply(@Nullable final ProfileRequestContext context,
+ @Nullable final JWTClaimsSet cliams) {
+ if (context == null) {
+ return null;
+ }
final AuthenticationContext authnContext = context.getSubcontext(AuthenticationContext.class);
if (authnContext == null) {
return null;
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoIssuerClaimLookupStrategy.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoIssuerClaimLookupStrategy.java
index e7ad3c1..f1ac160 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoIssuerClaimLookupStrategy.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoIssuerClaimLookupStrategy.java
@@ -63,9 +63,12 @@ public final class DuoIssuerClaimLookupStrategy implements BiFunction<ProfileReq
}
/** {@inheritDoc} */
- @Override @Nullable public String apply(@Nonnull final ProfileRequestContext context,
- @Nonnull final JWTClaimsSet cliams) {
+ @Override @Nullable public String apply(@Nullable final ProfileRequestContext context,
+ @Nullable final JWTClaimsSet cliams) {
+ if (context == null) {
+ return null;
+ }
final AuthenticationContext authnContext = context.getSubcontext(AuthenticationContext.class);
if (authnContext == null) {
return null;
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoNonceClaimLookupStrategy.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoNonceClaimLookupStrategy.java
index 00ef4e3..d365be2 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoNonceClaimLookupStrategy.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoNonceClaimLookupStrategy.java
@@ -16,7 +16,6 @@ package net.shibboleth.idp.plugin.authn.duo.impl;
import java.util.function.BiFunction;
-import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import javax.annotation.concurrent.ThreadSafe;
@@ -33,9 +32,12 @@ import net.shibboleth.idp.plugin.authn.duo.context.DuoOIDCAuthenticationContext;
@ThreadSafe
public final class DuoNonceClaimLookupStrategy implements BiFunction<ProfileRequestContext,JWTClaimsSet, String> {
- @Override @Nullable public String apply(@Nonnull final ProfileRequestContext context,
- @Nonnull final JWTClaimsSet cliams) {
+ @Override @Nullable public String apply(@Nullable final ProfileRequestContext context,
+ @Nullable final JWTClaimsSet cliams) {
+ if (context == null) {
+ return null;
+ }
final AuthenticationContext authnContext = context.getSubcontext(AuthenticationContext.class);
if (authnContext == null) {
return null;
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnController.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnController.java
index bdc6905..dd83b2a 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnController.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnController.java
@@ -25,7 +25,6 @@ import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
@@ -39,10 +38,12 @@ import net.shibboleth.idp.plugin.authn.duo.DuoClientException;
import net.shibboleth.idp.plugin.authn.duo.DuoException;
import net.shibboleth.idp.plugin.authn.duo.DuoOIDCAuthAPI;
import net.shibboleth.idp.plugin.authn.duo.DuoOIDCClient;
+import net.shibboleth.idp.plugin.authn.duo.DuoOIDCIntegration;
import net.shibboleth.idp.plugin.authn.duo.context.DuoOIDCAuthenticationContext;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.component.AbstractInitializableComponent;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
@@ -134,23 +135,29 @@ public class DuoOIDCAuthnController extends AbstractInitializableComponent{
if (client == null) {
throw new DuoClientException("Duo client is null, has the context been created correctly?");
}
+ final String requestState = duoContext.getRequestState();
+ final DuoOIDCIntegration integration = duoContext.getIntegration();
+ final String username = duoContext.getUsername();
+ if (requestState == null || integration == null || username == null) {
+ throw new DuoClientException("Duo request state, username, or integration not set");
+ }
- final String state = DuoSupport.generateState(duoContext.getRequestState(), key);
+ final String state = DuoSupport.generateState(requestState, key);
log.info("Starting Duo 2FA for client '{}', user '{}', and unique request state '{}'",
- duoContext.getIntegration() != null ? duoContext.getIntegration().getClientId():
+ duoContext.getIntegration() != null ? integration.getClientId():
"none", duoContext.getUsername(), duoContext.getRequestState());
String authURL;
//if an OIDC id_token nonce is supported, add it to the authz request and context
if (client.getCapabilities().isSupportsNonce()) {
final String oidcNonce = DuoSupport.generateNonce(36);
- authURL = client.createAuthUrl(duoContext.getUsername(), state, oidcNonce,
+ authURL = client.createAuthUrl(username, state, oidcNonce,
duoContext.getRedirectURIOverride());
duoContext.setNonce(oidcNonce);
} else {
- authURL = client.createAuthUrl(duoContext.getUsername(), state, null,
+ authURL = client.createAuthUrl(username, state, null,
duoContext.getRedirectURIOverride());
}
@@ -206,10 +213,13 @@ public class DuoOIDCAuthnController extends AbstractInitializableComponent{
}
duoContext.setAuthorizationCode(code);
duoContext.setResponseState(nonce);
-
- log.info("Finished Duo 2FA for client '{}', user '{}', and unique request state '{}'",
- duoContext.getIntegration() != null ? duoContext.getIntegration().getClientId():
- "none", duoContext.getUsername(), nonce);
+
+ if (log.isInfoEnabled()) {
+ final DuoOIDCIntegration integration = duoContext.getIntegration();
+ log.info("Finished Duo 2FA for client '{}', user '{}', and unique request state '{}'",
+ integration != null ? integration.getClientId():
+ "none", duoContext.getUsername(), nonce);
+ }
ExternalAuthentication.finishExternalAuthentication(key, httpRequest, httpResponse);
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoUsernameClaimLookupStrategy.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoUsernameClaimLookupStrategy.java
index 9718139..4f3ec05 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoUsernameClaimLookupStrategy.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoUsernameClaimLookupStrategy.java
@@ -16,7 +16,6 @@ package net.shibboleth.idp.plugin.authn.duo.impl;
import java.util.function.BiFunction;
-import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import javax.annotation.concurrent.ThreadSafe;
@@ -33,9 +32,12 @@ import net.shibboleth.idp.plugin.authn.duo.context.DuoOIDCAuthenticationContext;
@ThreadSafe
public final class DuoUsernameClaimLookupStrategy implements BiFunction<ProfileRequestContext,JWTClaimsSet, String> {
- @Override @Nullable public String apply(@Nonnull final ProfileRequestContext context,
- @Nonnull final JWTClaimsSet cliams) {
+ @Override @Nullable public String apply(@Nullable final ProfileRequestContext context,
+ @Nullable final JWTClaimsSet cliams) {
+ if (context == null) {
+ return null;
+ }
final AuthenticationContext authnContext = context.getSubcontext(AuthenticationContext.class);
if (authnContext == null) {
return null;
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ExchangeCodeForDuoToken.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ExchangeCodeForDuoToken.java
index e2d25ea..ce5a59d 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ExchangeCodeForDuoToken.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ExchangeCodeForDuoToken.java
@@ -22,7 +22,6 @@ import javax.annotation.Nullable;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.EncryptedJWT;
import com.nimbusds.jwt.JWT;
@@ -33,6 +32,7 @@ import net.shibboleth.idp.plugin.authn.duo.AbstractDuoAuthenticationAction;
import net.shibboleth.idp.plugin.authn.duo.DuoClientException;
import net.shibboleth.idp.plugin.authn.duo.DuoOIDCClient;
import net.shibboleth.idp.plugin.authn.duo.context.DuoOIDCAuthenticationContext;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/HealthCheckDuoOIDCAuthAPI.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/HealthCheckDuoOIDCAuthAPI.java
index 751687a..73283e8 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/HealthCheckDuoOIDCAuthAPI.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/HealthCheckDuoOIDCAuthAPI.java
@@ -20,7 +20,6 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.AuthenticationContext;
@@ -31,6 +30,7 @@ import net.shibboleth.idp.plugin.authn.duo.DuoOIDCClient;
import net.shibboleth.idp.plugin.authn.duo.context.DuoOIDCAuthenticationContext;
import net.shibboleth.idp.plugin.authn.duo.model.DuoHealthCheck;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An action that checks the health of the Duo 2FA endpoint for the established Duo integration.
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/PopulateDuoAuthenticationContext.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/PopulateDuoAuthenticationContext.java
index 4a9aaac..4447da1 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/PopulateDuoAuthenticationContext.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/PopulateDuoAuthenticationContext.java
@@ -25,7 +25,6 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import jakarta.servlet.http.HttpServletRequest;
import net.shibboleth.idp.authn.AbstractAuthenticationAction;
@@ -42,6 +41,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
@@ -249,15 +249,14 @@ public class PopulateDuoAuthenticationContext extends AbstractAuthenticationActi
@Nonnull final HttpServletRequest request,
@Nonnull final DuoOIDCAuthenticationContext context) throws DuoException {
- if (duoIntegration instanceof DynamicDuoOIDCIntegration) {
+ if (duoIntegration instanceof final DynamicDuoOIDCIntegration integration) {
if (redirectURICreationStrategy == null) {
throw new DuoException("A dynamic DuoOIDC integration was supplied, but the redirect URI"
+ " creation strategy was null. Please set a redirect URI creation strategy.");
}
-
- final String redirectURI = redirectURICreationStrategy.apply(request,
- (DynamicDuoOIDCIntegration)duoIntegration);
+ assert redirectURICreationStrategy != null;
+ final String redirectURI = redirectURICreationStrategy.apply(request,integration);
if (redirectURI == null) {
throw new DuoException("A redirect_uri was not registered or could not be computed");
}
@@ -266,7 +265,7 @@ public class PopulateDuoAuthenticationContext extends AbstractAuthenticationActi
// request (whichever thread gets here first), but not thereafter. This allows it to be
// computed from the request, and is compatible with clients that do not support per-request
// redirect_uri overrides (if required).
- ((DynamicDuoOIDCIntegration)duoIntegration).setRedirectURIIfAbsent(redirectURI);
+ integration.setRedirectURIIfAbsent(redirectURI);
//always add to the context for the client to use if it supports dynamic redirect_uris
log.trace("{} Adding a dynamic redirect_uri '{}' to the context for the DuoClient to use if "
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoResponseState.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoResponseState.java
index 97c9d71..85a623f 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoResponseState.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoResponseState.java
@@ -19,13 +19,13 @@ import javax.annotation.Nonnull;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.plugin.authn.duo.AbstractDuoAuthenticationAction;
import net.shibboleth.idp.plugin.authn.duo.context.DuoOIDCAuthenticationContext;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Authentication action that validates the Duo response state parameter (which is <b>required</b> in the Duo flow)
@@ -55,13 +55,15 @@ public class ValidateDuoResponseState extends AbstractDuoAuthenticationAction {
log.trace("{} Duo 2FA request state '{}' was returned in the response as '{}'",
getLogPrefix(),duoContext.getRequestState(),duoContext.getResponseState() );
- if (duoContext.getRequestState() == null || duoContext.getResponseState() == null) {
+ final String requestState = duoContext.getRequestState();
+ final String responseState = duoContext.getResponseState();
+ if (requestState == null || responseState == null) {
log.error("{} The state parameter was not present in either the request or response, "
+ "state is mandatory for Duo 2FA requests",getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
- if (!duoContext.getRequestState().equals(duoContext.getResponseState())) {
+ if (!requestState.equals(responseState)) {
log.error("{} Duo request state did not match response state, has it been tampered with!",
getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
index b497e24..2e68a72 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
@@ -29,7 +29,6 @@ import javax.security.auth.Subject;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWT;
import com.nimbusds.jwt.JWTClaimsSet;
@@ -42,8 +41,11 @@ import net.shibboleth.idp.authn.duo.DuoPrincipal;
import net.shibboleth.idp.authn.impl.AbstractAuditingValidationAction;
import net.shibboleth.idp.plugin.authn.duo.DuoException;
import net.shibboleth.idp.plugin.authn.duo.DuoOIDCAuthAPI;
+import net.shibboleth.idp.plugin.authn.duo.DuoOIDCIntegration;
import net.shibboleth.idp.plugin.authn.duo.context.DuoOIDCAuthenticationContext;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A validation action that checks for a valid Duo authentication token and directly produces an
@@ -69,16 +71,19 @@ public class ValidateDuoTokenAuthenticationResult extends AbstractAuditingValida
@Nonnull private final Logger log = LoggerFactory.getLogger(ValidateDuoTokenAuthenticationResult.class);
/** Duo authentiction context. */
- @Nullable private DuoOIDCAuthenticationContext duoContext;
+ @NonnullBeforeExec private DuoOIDCAuthenticationContext duoContext;
+
+ /** The Duo integration.*/
+ @NonnullBeforeExec private DuoOIDCIntegration duoIntegration;
/** The profile request context.*/
@Nullable private ProfileRequestContext prc;
/** The parsed claimset. */
- @Nullable private JWTClaimsSet claimsSet;
+ @NonnullBeforeExec private JWTClaimsSet claimsSet;
/** Attempted username. */
- @Nullable @NotEmpty private String username;
+ @NonnullBeforeExec @NotEmpty private String username;
/** Hook to map context information (often Duo factors in the Duo token) to principal collections.*/
@Nullable private Function<ProfileRequestContext,Collection<Principal>> contextToPrincipalMappingStrategy;
@@ -131,9 +136,24 @@ public class ValidateDuoTokenAuthenticationResult extends AbstractAuditingValida
AuthnEventIds.INVALID_AUTHN_CTX);
recordFailure(profileRequestContext);
return false;
- }
+ }
+ duoIntegration = duoContext.getIntegration();
+ if (duoIntegration == null) {
+ log.error("{} No Duo Integration available", getLogPrefix());
+ handleError(profileRequestContext, authenticationContext, "No Duo integration available",
+ AuthnEventIds.INVALID_AUTHN_CTX);
+ recordFailure(profileRequestContext);
+ return false;
+ }
+
//we get username from the original context, not the duo response.
- username = duoContext.getUsername();
+ username = duoContext.getUsername();
+ if (username == null) {
+ log.error("{} Duo username is not available", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_AUTHN_CTX);
+ recordFailure(profileRequestContext);
+ return false;
+ }
final JWT token = duoContext.getAuthToken();
if (token == null) {
@@ -252,12 +272,13 @@ public class ValidateDuoTokenAuthenticationResult extends AbstractAuditingValida
// Always add the custom Duo principal
subject.getPrincipals().add(new DuoPrincipal(username));
// Always add any principals specified on the integration
- subject.getPrincipals().addAll(duoContext.getIntegration().getSupportedPrincipals(Principal.class));
+ subject.getPrincipals().addAll(duoIntegration.getSupportedPrincipals(Principal.class));
// add any further principals from a function hook that can inspect the Duo response if the
// mapping strategy is set.
- if (getContextToPrincipalMappingStrategy() != null) {
- final Collection<Principal> mapped = getContextToPrincipalMappingStrategy().apply(prc);
+ final var contextToPrincipalStrategy = getContextToPrincipalMappingStrategy();
+ if (contextToPrincipalStrategy != null) {
+ final Collection<Principal> mapped = contextToPrincipalStrategy.apply(prc);
if (mapped != null) {
subject.getPrincipals().addAll(mapped);
if (log.isDebugEnabled()) {
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateExternalAuthenticationContext.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateExternalAuthenticationContext.java
index c48aef1..b8a0301 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateExternalAuthenticationContext.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateExternalAuthenticationContext.java
@@ -15,18 +15,18 @@
package net.shibboleth.idp.plugin.authn.duo.impl;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.authn.AbstractAuthenticationAction;
-import net.shibboleth.idp.authn.AuthnEventIds;
-import net.shibboleth.idp.authn.context.AuthenticationContext;
-import net.shibboleth.idp.authn.context.ExternalAuthenticationContext;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.idp.authn.AbstractAuthenticationAction;
+import net.shibboleth.idp.authn.AuthnEventIds;
+import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.authn.context.ExternalAuthenticationContext;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An action that checks for an {@link ExternalAuthenticationContext} for a signaled event via the
@@ -42,7 +42,7 @@ public class ValidateExternalAuthenticationContext extends AbstractAuthenticatio
@Nonnull private final Logger log = LoggerFactory.getLogger(ValidateExternalAuthenticationContext.class);
/** Context containing the result to examine. */
- @Nullable private ExternalAuthenticationContext extContext;
+ @NonnullBeforeExec private ExternalAuthenticationContext extContext;
/** {@inheritDoc} */
@Override
@@ -68,10 +68,11 @@ public class ValidateExternalAuthenticationContext extends AbstractAuthenticatio
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@Nonnull final AuthenticationContext authenticationContext) {
- if (extContext.getAuthnError() != null) {
+ final String error = extContext.getAuthnError();
+ if (error != null) {
log.info("{} Duo 2FA authentication attempt signaled an error: {}", getLogPrefix(),
extContext.getAuthnError());
- ActionSupport.buildEvent(profileRequestContext, extContext.getAuthnError());
+ ActionSupport.buildEvent(profileRequestContext, error);
}
}
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenClaims.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenClaims.java
index c3856a8..e63c9f2 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenClaims.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenClaims.java
@@ -23,7 +23,6 @@ import javax.annotation.Nullable;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWT;
import com.nimbusds.jwt.JWTClaimsSet;
@@ -36,8 +35,10 @@ import net.shibboleth.idp.plugin.authn.duo.context.DuoOIDCAuthenticationContext;
import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
import net.shibboleth.oidc.jwt.claims.JWTValidationException;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Action that validates the claims of the Duo id_token using the supplied {@link ClaimsValidator}.
@@ -77,7 +78,7 @@ public class ValidateTokenClaims extends AbstractDuoAuthenticationAction {
@Nonnull private final Logger log = LoggerFactory.getLogger(ValidateTokenClaims.class);
/** The parsed claimset. */
- @Nullable private JWTClaimsSet claimsSet;
+ @NonnullBeforeExec private JWTClaimsSet claimsSet;
/** A cleanup hook to execute after either a successful or unsuccessful claims validation. */
@Nullable private Consumer<ProfileRequestContext> cleanupHook;
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignature.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignature.java
index 641d284..d90b248 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignature.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignature.java
@@ -18,13 +18,11 @@ import java.text.ParseException;
import java.util.List;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
import javax.crypto.spec.SecretKeySpec;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.Algorithm;
import com.nimbusds.jose.JWSAlgorithm;
@@ -41,8 +39,10 @@ import net.shibboleth.idp.plugin.authn.duo.context.DuoOIDCAuthenticationContext;
import net.shibboleth.oidc.security.JWSAssemblyUtils;
import net.shibboleth.oidc.security.credential.BasicJWKCredential;
import net.shibboleth.oidc.security.impl.JWTSignatureValidationUtil;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.ConstraintViolationException;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
@@ -81,13 +81,13 @@ public class ValidateTokenSignature extends AbstractDuoAuthenticationAction {
@Nonnull private Algorithm signatureAlgorithm;
/** The Duo authentication token. */
- @Nullable private JWT token;
+ @NonnullBeforeExec private JWT token;
/** The parsed claimset. */
- @Nullable private JWTClaimsSet claimSet;
+ @NonnullBeforeExec private JWTClaimsSet claimSet;
/** The Duo integration appropriate for this request.*/
- @Nullable private DuoOIDCIntegration integration;
+ @NonnullBeforeExec private DuoOIDCIntegration integration;
/** Constructor.*/
public ValidateTokenSignature() {
@@ -158,7 +158,7 @@ public class ValidateTokenSignature extends AbstractDuoAuthenticationAction {
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
- } else if (token instanceof SignedJWT) {
+ } else if (token instanceof final SignedJWT signedToken) {
final BasicJWKCredential jwkCredential = new BasicJWKCredential();
jwkCredential.setSecretKey(new SecretKeySpec(
@@ -166,7 +166,7 @@ public class ValidateTokenSignature extends AbstractDuoAuthenticationAction {
jwkCredential.setAlgorithm(signatureAlgorithm);
final String errorEventId =
JWTSignatureValidationUtil.validateSignatureEx(List.of(jwkCredential),
- (SignedJWT)token, AuthnEventIds.NO_CREDENTIALS);
+ signedToken, AuthnEventIds.NO_CREDENTIALS);
if (errorEventId != null) {
log.error("{} Token signature is invalid for subject '{}' and client '{}'",getLogPrefix(),
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractAuthnXmlFlowExecutionTests.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractAuthnXmlFlowExecutionTests.java
index 43e5c13..ba3cb1f 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractAuthnXmlFlowExecutionTests.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractAuthnXmlFlowExecutionTests.java
@@ -29,7 +29,6 @@ import javax.annotation.Nullable;
import org.mockito.Mockito;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.BeanFactory;
import org.springframework.beans.factory.config.BeanDefinition;
import org.springframework.beans.factory.support.BeanDefinitionBuilder;
@@ -71,6 +70,9 @@ import net.shibboleth.idp.session.context.SessionContext;
import net.shibboleth.idp.ui.context.RelyingPartyUIContext;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.security.impl.SecureRandomIdentifierGenerationStrategy;
import net.shibboleth.shared.servlet.impl.HttpServletRequestResponseContext;
import net.shibboleth.shared.spring.config.BooleanToPredicateConverter;
@@ -133,7 +135,7 @@ public abstract class AbstractAuthnXmlFlowExecutionTests extends CustomAbstractX
@Nonnull private final Logger log = LoggerFactory.getLogger(AbstractAuthnXmlFlowExecutionTests.class);
/** The path resource to the authentication flow to be tested. */
- @Nonnull private String flowPath;
+ @Nullable private String flowPath;
/**
* Map of additional flow resources used to support the construction of the test flow.
@@ -168,9 +170,9 @@ public abstract class AbstractAuthnXmlFlowExecutionTests extends CustomAbstractX
* @param idpEntityID The mocked entityID of this IdP instance
*/
public AbstractAuthnXmlFlowExecutionTests(@Nonnull final String idpEntityID) {
- flowModelResources = Collections.emptyMap();
- subflows = Collections.emptyList();
- mockProperties = Collections.emptyMap();
+ flowModelResources = CollectionSupport.emptyMap();
+ subflows = CollectionSupport.emptyList();
+ mockProperties = CollectionSupport.emptyMap();
removeDefaultContextCleanupHook = false;
entityId = Objects.requireNonNull(idpEntityID);
}
@@ -428,7 +430,7 @@ public abstract class AbstractAuthnXmlFlowExecutionTests extends CustomAbstractX
//register shibboleth function constants.
addBeanDefinition(builderContext, "shibboleth.Functions.Constant",BeanDefinitionBuilder.
- genericBeanDefinition(net.shibboleth.utilities.java.support.logic.FunctionSupport.class)
+ genericBeanDefinition(FunctionSupport.class)
.setFactoryMethod("constant").setAbstract(true).getBeanDefinition());
if (clientFactory != null) {
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractDuoActionTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractDuoActionTest.java
index ae24223..30fb5e5 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractDuoActionTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/AbstractDuoActionTest.java
@@ -847,8 +847,9 @@ public abstract class AbstractDuoActionTest {
* @param eventId the eventId to check.
*/
protected void assertEventIdFromProfileRequestContext(@Nonnull final String eventId) {
- final Object event = prc.getSubcontext(EventContext.class, true).getEvent();
+ final Object event = prc.ensureSubcontext(EventContext.class).getEvent();
assertNotNull(event);
+ assert event != null;
assertTrue(event instanceof String,"Event is not a string is: "+event.getClass());
assertEquals(eventId, (String)event);
@@ -862,6 +863,7 @@ public abstract class AbstractDuoActionTest {
*/
protected void assertEventId(@Nullable final Event event, @Nonnull final String eventId) {
assertNotNull(event);
+ assert event != null;
assertEquals(event.getId(),eventId);
}
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DualDuoIntegrationStrategy.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DualDuoIntegrationStrategy.java
index b1259be..e3d9f0f 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DualDuoIntegrationStrategy.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DualDuoIntegrationStrategy.java
@@ -29,6 +29,7 @@ import net.shibboleth.profile.context.RelyingPartyContext;
public class DualDuoIntegrationStrategy implements Function<ProfileRequestContext,DuoOIDCIntegration>{
@Override
+ @SuppressWarnings("null")
public DuoOIDCIntegration apply(final ProfileRequestContext prc) {
final DefaultDuoOIDCIntegration int1 = new DefaultDuoOIDCIntegration();
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoAudienceClaimLookupStrategyTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoAudienceClaimLookupStrategyTest.java
index 8b7fee1..2b6e642 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoAudienceClaimLookupStrategyTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoAudienceClaimLookupStrategyTest.java
@@ -2,8 +2,7 @@
package net.shibboleth.idp.plugin.authn.duo.impl;
import static org.testng.Assert.assertEquals;
-
-import javax.annotation.Nonnull;
+import static org.testng.Assert.assertNotNull;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
@@ -18,7 +17,7 @@ import net.shibboleth.shared.component.ComponentInitializationException;
public class DuoAudienceClaimLookupStrategyTest extends AbstractDuoActionTest{
/** The strategy.*/
- @Nonnull private DuoAudienceClaimLookupStrategy strategy;
+ private DuoAudienceClaimLookupStrategy strategy;
/**
* Setup.
@@ -35,7 +34,10 @@ public class DuoAudienceClaimLookupStrategyTest extends AbstractDuoActionTest{
addDuoContext();
addDuoIntegrationToContext();
final String audience = strategy.apply(prc,new JWTClaimsSet.Builder().build());
- assertEquals(audience, dc.getIntegration().getClientId());
+ final var integration = dc.getIntegration();
+ assertNotNull(integration);
+ assert integration != null;
+ assertEquals(audience, integration.getClientId());
}
@Test
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoAuthnFlowTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoAuthnFlowTest.java
index bb56712..319a5bc 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoAuthnFlowTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoAuthnFlowTest.java
@@ -26,7 +26,6 @@ import org.junit.Test;
import org.opensaml.profile.context.EventContext;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import org.springframework.core.io.ClassPathResource;
import org.springframework.webflow.core.collection.LocalAttributeMap;
import org.springframework.webflow.engine.Flow;
@@ -53,12 +52,14 @@ import net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal;
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Test the Duo 2FA flow using SWF flow testing.
*
* <p>Note, these test use JUnit, and work with the TestNG to JUnit bridge</p>
*/
+ at SuppressWarnings("null")
public class DuoAuthnFlowTest extends AbstractAuthnXmlFlowExecutionTests {
/** RP ID of the SP that requires the first duo integration.*/
@@ -256,6 +257,7 @@ public class DuoAuthnFlowTest extends AbstractAuthnXmlFlowExecutionTests {
assertCurrentStateEquals("Duo2FAAuthorizationRequest");
assertNotNull(prcOne.getSubcontext(AuthenticationContext.class));
+ final var ac = prcOne.getSubcontext(AuthenticationContext.class);
assertNotNull(prcOne.getSubcontext(AuthenticationContext.class).getSubcontext(
DuoOIDCAuthenticationContext.class));
assertNotNull(prcOne.getSubcontext(AuthenticationContext.class).getSubcontext(
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoIssuerClaimLookupStrategyTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoIssuerClaimLookupStrategyTest.java
index f400364..2e583ad 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoIssuerClaimLookupStrategyTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoIssuerClaimLookupStrategyTest.java
@@ -15,8 +15,7 @@
package net.shibboleth.idp.plugin.authn.duo.impl;
import static org.testng.Assert.assertEquals;
-
-import javax.annotation.Nonnull;
+import static org.testng.Assert.assertNotNull;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
@@ -31,7 +30,7 @@ import net.shibboleth.shared.component.ComponentInitializationException;
public class DuoIssuerClaimLookupStrategyTest extends AbstractDuoActionTest{
/** The strategy.*/
- @Nonnull private DuoIssuerClaimLookupStrategy strategy;
+ private DuoIssuerClaimLookupStrategy strategy;
/**
* Setup.
@@ -49,7 +48,10 @@ public class DuoIssuerClaimLookupStrategyTest extends AbstractDuoActionTest{
addDuoIntegrationToContext();
//set a different path for testing.
final String issuer = strategy.apply(prc,new JWTClaimsSet.Builder().build());
- assertEquals(issuer, "https://"+dc.getIntegration().getAPIHost()+"/oauth/v2/token");
+ final var integration = dc.getIntegration();
+ assertNotNull(integration);
+ assert integration != null;
+ assertEquals(issuer, "https://"+integration.getAPIHost()+"/oauth/v2/token");
}
@Test
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoNonceClaimLookupStrategyTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoNonceClaimLookupStrategyTest.java
index c5521ee..86766e6 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoNonceClaimLookupStrategyTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoNonceClaimLookupStrategyTest.java
@@ -16,8 +16,6 @@ package net.shibboleth.idp.plugin.authn.duo.impl;
import static org.testng.Assert.assertEquals;
-import javax.annotation.Nonnull;
-
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
@@ -31,7 +29,7 @@ import net.shibboleth.shared.component.ComponentInitializationException;
public class DuoNonceClaimLookupStrategyTest extends AbstractDuoActionTest{
/** The strategy.*/
- @Nonnull private DuoNonceClaimLookupStrategy strategy;
+ private DuoNonceClaimLookupStrategy strategy;
/**
* Setup.
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnControllerTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnControllerTest.java
index e9f22c2..cc2b8c2 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnControllerTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoOIDCAuthnControllerTest.java
@@ -27,8 +27,6 @@ import org.apache.commons.codec.binary.Hex;
import org.mockito.Mockito;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.test.context.ContextConfiguration;
import org.springframework.test.context.TestPropertySource;
@@ -90,11 +88,8 @@ public class DuoOIDCAuthnControllerTest extends AbstractTestNGSpringContextTests
/** Duo OIDC authz code.*/
@Nonnull private final String CODE = "db87f45083db5aea16eb45b7ace685c8";
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(DuoOIDCAuthnControllerTest.class);
-
/** The mock MVC entry point for testing. */
- @Nonnull private MockMvc mockMvc;
+ private MockMvc mockMvc;
/** The mock servlet context.*/
@Nonnull @Autowired private ServletContext servletContext;
@@ -130,6 +125,7 @@ public class DuoOIDCAuthnControllerTest extends AbstractTestNGSpringContextTests
* @throws Exception on exception.
*/
@Test
+ @SuppressWarnings("null")
public void testSuccessfulAuthorizeRequest() throws Exception {
final MvcResult result = mockMvc.perform(get("/Authn/Duo/2FA/authorize")
@@ -156,8 +152,7 @@ public class DuoOIDCAuthnControllerTest extends AbstractTestNGSpringContextTests
.param("state",invalidState))
.andDo(print());
} catch (final ServletException e) {
- assertTrue(e.getCause() instanceof ExternalAuthenticationException);
- log.error("{}",e.getRootCause().getMessage());
+ assertTrue(e.getCause() instanceof ExternalAuthenticationException);;
}
}
@@ -176,7 +171,6 @@ public class DuoOIDCAuthnControllerTest extends AbstractTestNGSpringContextTests
.andDo(print());
} catch (final ServletException e) {
assertTrue(e.getCause() instanceof ExternalAuthenticationException);
- log.error("{}",e.getRootCause().getMessage());
}
}
@@ -245,7 +239,6 @@ public class DuoOIDCAuthnControllerTest extends AbstractTestNGSpringContextTests
state)).andDo(print());
} catch (final ServletException e) {
assertTrue(e.getCause() instanceof ExternalAuthenticationException);
- log.error("{}",e.getMessage());
}
}
@@ -264,7 +257,6 @@ public class DuoOIDCAuthnControllerTest extends AbstractTestNGSpringContextTests
} catch (final ServletException e) {
assertTrue(e.getCause() instanceof ExternalAuthenticationException);
- log.error("{}",e.getMessage());
}
}
@@ -355,8 +347,10 @@ public class DuoOIDCAuthnControllerTest extends AbstractTestNGSpringContextTests
getFlowExecution(new CompositeFlowExecutionKey("1", "1")).
getConversationScope().get(ProfileRequestContext.BINDING_KEY);
- ((ProfileRequestContext)prcObject).getSubcontext(AuthenticationContext.class).
- removeSubcontext(DuoOIDCAuthenticationContext.class);
+ final var ac = ((ProfileRequestContext)prcObject).getSubcontext(AuthenticationContext.class);
+ assertNotNull(ac);
+ assert ac != null;
+ ac.removeSubcontext(DuoOIDCAuthenticationContext.class);
}
@@ -376,10 +370,13 @@ public class DuoOIDCAuthnControllerTest extends AbstractTestNGSpringContextTests
getConversationScope().get(ProfileRequestContext.BINDING_KEY);
assertTrue(prcObject instanceof ProfileRequestContext);
- final DuoOIDCAuthenticationContext duoContext = ((ProfileRequestContext)prcObject).
- getSubcontext(AuthenticationContext.class).getSubcontext(DuoOIDCAuthenticationContext.class);
- assertNotNull(duoContext);
+ final var ac = ((ProfileRequestContext)prcObject).getSubcontext(AuthenticationContext.class);
+ assertNotNull(ac);
+ assert ac != null;
+ final DuoOIDCAuthenticationContext duoContext = ac.getSubcontext(DuoOIDCAuthenticationContext.class);
+ assertNotNull(duoContext);
+ assert duoContext != null;
return duoContext;
}
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoUsernameClaimLookupStrategyTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoUsernameClaimLookupStrategyTest.java
index 8c9c02e..76bba89 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoUsernameClaimLookupStrategyTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/DuoUsernameClaimLookupStrategyTest.java
@@ -16,13 +16,12 @@ package net.shibboleth.idp.plugin.authn.duo.impl;
import static org.testng.Assert.assertEquals;
-import javax.annotation.Nonnull;
-
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
import com.nimbusds.jwt.JWTClaimsSet;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeTest;
import net.shibboleth.shared.component.ComponentInitializationException;
/**
@@ -31,7 +30,7 @@ import net.shibboleth.shared.component.ComponentInitializationException;
public class DuoUsernameClaimLookupStrategyTest extends AbstractDuoActionTest{
/** The strategy.*/
- @Nonnull private DuoUsernameClaimLookupStrategy strategy;
+ @NonnullBeforeTest private DuoUsernameClaimLookupStrategy strategy;
/**
* Setup.
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ExchangeCodeForDuoTokenTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ExchangeCodeForDuoTokenTest.java
index ab13a39..e4db179 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ExchangeCodeForDuoTokenTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ExchangeCodeForDuoTokenTest.java
@@ -14,6 +14,8 @@
package net.shibboleth.idp.plugin.authn.duo.impl;
+import static org.testng.Assert.assertNotNull;
+
import org.springframework.webflow.execution.Event;
import org.testng.AssertJUnit;
import org.testng.annotations.BeforeMethod;
@@ -47,7 +49,10 @@ public class ExchangeCodeForDuoTokenTest extends AbstractDuoActionTest {
addDuoIntegrationToContext();
//add an auth code
dc.setAuthorizationCode("testcode");
- dc.setClient(new MockDuoOIDCClient_OK(dc.getIntegration()));
+ final var integration = dc.getIntegration();
+ assertNotNull(integration);
+ assert integration != null;
+ dc.setClient(new MockDuoOIDCClient_OK(integration));
action.initialize();
final Event event = action.execute(src);
// success here is a null event
@@ -63,7 +68,10 @@ public class ExchangeCodeForDuoTokenTest extends AbstractDuoActionTest {
addDuoIntegrationToContext();
// blank the auth code.
dc.setAuthorizationCode(null);
- dc.setClient(new MockDuoOIDCClient_OK(dc.getIntegration()));
+ final var integration = dc.getIntegration();
+ assertNotNull(integration);
+ assert integration != null;
+ dc.setClient(new MockDuoOIDCClient_OK(integration));
action.initialize();
final Event event = action.execute(src);
@@ -97,8 +105,10 @@ public class ExchangeCodeForDuoTokenTest extends AbstractDuoActionTest {
//blank username
dc.setUsername(null);
-
- dc.setClient(new MockDuoOIDCClient_OK(dc.getIntegration()));
+ final var integration = dc.getIntegration();
+ assertNotNull(integration);
+ assert integration != null;
+ dc.setClient(new MockDuoOIDCClient_OK(integration));
action.initialize();
final Event event = action.execute(src);
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/HealthCheckDuoOIDCAuthAPITest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/HealthCheckDuoOIDCAuthAPITest.java
index 2577a43..7929ad4 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/HealthCheckDuoOIDCAuthAPITest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/HealthCheckDuoOIDCAuthAPITest.java
@@ -28,6 +28,7 @@
package net.shibboleth.idp.plugin.authn.duo.impl;
+import static org.testng.Assert.assertNotNull;
import static org.testng.Assert.assertNull;
import org.springframework.webflow.execution.Event;
@@ -59,7 +60,10 @@ class HealthCheckDuoOIDCAuthAPITest extends AbstractDuoActionTest {
void testDoExecuteHealthy() throws DuoRegistryException, ComponentInitializationException, DuoClientException {
addDuoContext();
addDuoIntegrationToContext();
- dc.setClient(new MockDuoOIDCClient_OK(dc.getIntegration()));
+ final var integration = dc.getIntegration();
+ assertNotNull(integration);
+ assert integration != null;
+ dc.setClient(new MockDuoOIDCClient_OK(integration));
healthCheckAction.initialize();
final Event event = healthCheckAction.execute(src);
@@ -73,7 +77,10 @@ class HealthCheckDuoOIDCAuthAPITest extends AbstractDuoActionTest {
void testDoExecuteUnHealthy() throws DuoRegistryException, ComponentInitializationException, DuoClientException {
addDuoContext();
addDuoIntegrationToContext();
- dc.setClient(new MockDuoOIDCClient_FAIL(dc.getIntegration()));
+ final var integration = dc.getIntegration();
+ assertNotNull(integration);
+ assert integration != null;
+ dc.setClient(new MockDuoOIDCClient_FAIL(integration));
healthCheckAction.initialize();
final Event event = healthCheckAction.execute(src);
@@ -87,7 +94,10 @@ class HealthCheckDuoOIDCAuthAPITest extends AbstractDuoActionTest {
void testDoExecuteUnknown() throws DuoRegistryException, ComponentInitializationException, DuoClientException {
addDuoContext();
addDuoIntegrationToContext();
- dc.setClient(new MockDuoOIDCClient_UNKNOWN(dc.getIntegration()));
+ final var integration = dc.getIntegration();
+ assertNotNull(integration);
+ assert integration != null;
+ dc.setClient(new MockDuoOIDCClient_UNKNOWN(integration));
healthCheckAction.initialize();
final Event event = healthCheckAction.execute(src);
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/InMemoryCredentialValidator.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/InMemoryCredentialValidator.java
index 69bb5a2..c322a4e 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/InMemoryCredentialValidator.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/InMemoryCredentialValidator.java
@@ -21,7 +21,6 @@ import javax.security.auth.login.LoginException;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.authn.AbstractUsernamePasswordCredentialValidator;
import net.shibboleth.idp.authn.AuthnEventIds;
@@ -30,6 +29,7 @@ import net.shibboleth.idp.authn.context.UsernamePasswordContext;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Simple in-memory credential validator that validates the username and password against a single
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/PopulateDuoAuthenticationContextTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/PopulateDuoAuthenticationContextTest.java
index 0501817..7e8f9ca 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/PopulateDuoAuthenticationContextTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/PopulateDuoAuthenticationContextTest.java
@@ -16,6 +16,7 @@ package net.shibboleth.idp.plugin.authn.duo.impl;
import static org.mockito.ArgumentMatchers.any;
import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
import static org.testng.Assert.assertNull;
import org.mockito.Mockito;
@@ -98,8 +99,10 @@ public class PopulateDuoAuthenticationContextTest extends AbstractDuoActionTest{
//success here is a null event
assertNull(event);
//simple client, so no override set
- assertEquals(ac.getSubcontext(DuoOIDCAuthenticationContext.class)
- .getRedirectURIOverride(), null);
+ final var duoContext = ac.getSubcontext(DuoOIDCAuthenticationContext.class);
+ assertNotNull(duoContext);
+ assert duoContext != null;
+ assertEquals(duoContext.getRedirectURIOverride(), null);
}
/**
@@ -171,7 +174,10 @@ public class PopulateDuoAuthenticationContextTest extends AbstractDuoActionTest{
//success here is a null event
assertNull(event);
assertEquals(integ.getRedirectURI(), "https://example.com/idp/profile/Authn/Duo/2FA/callback");
- assertEquals(ac.getSubcontext(DuoOIDCAuthenticationContext.class)
+ final var duoContext = ac.getSubcontext(DuoOIDCAuthenticationContext.class);
+ assertNotNull(duoContext);
+ assert duoContext != null;
+ assertEquals(duoContext
.getRedirectURIOverride(), "https://example.com/idp/profile/Authn/Duo/2FA/callback");
}
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResultTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResultTest.java
index 5586c45..9916c1e 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResultTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResultTest.java
@@ -236,11 +236,19 @@ public class ValidateDuoTokenAuthenticationResultTest extends AbstractDuoActionT
action.setContextToPrincipalMappingStrategy(prc ->{
+ final var ac = prc.getSubcontext(AuthenticationContext.class);
+ assertNotNull(ac);
+ assert ac != null;
+
final DuoOIDCAuthenticationContext duoContext =
- prc.getSubcontext(AuthenticationContext.class).getSubcontext(DuoOIDCAuthenticationContext.class);
+ ac.getSubcontext(DuoOIDCAuthenticationContext.class);
+ assertNotNull(duoContext);
+ assert duoContext != null;
final List<Principal> p = new ArrayList<>();
try {
- if ("duo_push".equals(duoContext.getAuthToken().getJWTClaimsSet()
+ final var authToken = duoContext.getAuthToken();
+ assert authToken != null;
+ if ("duo_push".equals(authToken.getJWTClaimsSet()
.getJSONObjectClaim("auth_context").get("factor"))){
p.add(new AuthnContextClassRefPrincipal("http://example.com/duoPush"));
}
@@ -257,8 +265,14 @@ public class ValidateDuoTokenAuthenticationResultTest extends AbstractDuoActionT
assertNull(event);
//check the correct subject has been populated.
- assertNotNull(prc.getSubcontext(AuthenticationContext.class).getAuthenticationResult());
- final Subject sbj = prc.getSubcontext(AuthenticationContext.class).getAuthenticationResult().getSubject();
+ final var ac = prc.getSubcontext(AuthenticationContext.class);
+ assertNotNull(ac);
+ assert ac != null;
+ assertNotNull(ac.getAuthenticationResult());
+ final var authnResult = ac.getAuthenticationResult();
+ assertNotNull (authnResult);
+ assert authnResult != null;
+ final Subject sbj = authnResult.getSubject();
assertTrue(sbj.getPrincipals().contains(
new AuthnContextClassRefPrincipal("http://example.com/duoPush")));
}
@@ -278,11 +292,19 @@ public class ValidateDuoTokenAuthenticationResultTest extends AbstractDuoActionT
action.setContextToPrincipalMappingStrategy(prc ->{
- final DuoOIDCAuthenticationContext duoContext =
- prc.getSubcontext(AuthenticationContext.class).getSubcontext(DuoOIDCAuthenticationContext.class);
+ final var ac = prc.getSubcontext(AuthenticationContext.class);
+ assertNotNull(ac);
+ assert ac != null;
+
+ final DuoOIDCAuthenticationContext duoContext = ac.getSubcontext(DuoOIDCAuthenticationContext.class);
final List<Principal> p = new ArrayList<>();
+ assertNotNull(duoContext);
+ assert duoContext != null;
+
try {
- if ("sms".equals(duoContext.getAuthToken().getJWTClaimsSet()
+ final var authToken = duoContext.getAuthToken();
+ assert authToken != null;
+ if ("sms".equals(authToken.getJWTClaimsSet()
.getJSONObjectClaim("auth_context").get("factor"))){
p.add(new AuthnContextClassRefPrincipal("http://example.com/sms"));
}
@@ -300,8 +322,14 @@ public class ValidateDuoTokenAuthenticationResultTest extends AbstractDuoActionT
assertNull(event);
//check the correct subject has been populated.
- assertNotNull(prc.getSubcontext(AuthenticationContext.class).getAuthenticationResult());
- final Subject sbj = prc.getSubcontext(AuthenticationContext.class).getAuthenticationResult().getSubject();
+ final var ac = prc.getSubcontext(AuthenticationContext.class);
+ assertNotNull(ac);
+ assert ac != null;
+ assertNotNull(ac.getAuthenticationResult());
+ final var authnResult = ac.getAuthenticationResult();
+ assertNotNull (authnResult);
+ assert authnResult != null;
+ final Subject sbj = authnResult.getSubject();
assertFalse(sbj.getPrincipals().contains(
new AuthnContextClassRefPrincipal("http://example.com/sms")));
}
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignatureTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignatureTest.java
index 68c7097..02976f2 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignatureTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateTokenSignatureTest.java
@@ -28,6 +28,7 @@
package net.shibboleth.idp.plugin.authn.duo.impl;
+import static org.testng.Assert.assertNotNull;
import static org.testng.Assert.assertNull;
import java.time.Instant;
@@ -119,7 +120,10 @@ public class ValidateTokenSignatureTest extends AbstractDuoActionTest {
final String headerJson = "{\"typ\": \"JWT\",\"alg\": \"HS256\"}";
- dc.setAuthToken(createSignedDummyToken(headerJson,dc.getIntegration().getSecretKey(),
+ final var integration = dc.getIntegration();
+ assertNotNull(integration);
+ assert integration != null;
+ dc.setAuthToken(createSignedDummyToken(headerJson,integration.getSecretKey(),
DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW,"Login Succesful",CLIENT_ID,
Instant.now().plus(1,ChronoUnit.MINUTES),Instant.now(), Instant.now(),
"api.duosecurity.com", "duo_push"));
diff --git a/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClient.java b/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClient.java
index f1d0afa..2ee686f 100644
--- a/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClient.java
+++ b/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClient.java
@@ -34,7 +34,6 @@ import org.apache.hc.core5.net.URIBuilder;
import org.opensaml.security.httpclient.HttpClientSecurityParameters;
import org.opensaml.security.httpclient.HttpClientSecuritySupport;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.fasterxml.jackson.core.type.TypeReference;
import com.fasterxml.jackson.databind.ObjectMapper;
@@ -48,6 +47,7 @@ import net.shibboleth.idp.plugin.authn.duo.DuoOIDCIntegration;
import net.shibboleth.idp.plugin.authn.duo.model.DuoHealthCheck;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A Duo client using the Nimbus OIDC library.
@@ -214,9 +214,11 @@ public final class NimbusClient extends AbstractDuoOIDCClient{
try {
final HttpClientContext clientContext = HttpClientContext.create();
+ assert clientContext != null;
HttpClientSecuritySupport.marshalSecurityParameters(clientContext, httpClientSecurityParameters, true);
HttpClientSecuritySupport.addDefaultTLSTrustEngineCriteria(clientContext, request);
final ClassicHttpResponse httpResponse = httpClient.executeOpen(null, request, clientContext);
+ assert httpResponse != null;
HttpClientSecuritySupport.checkTLSCredentialEvaluated(clientContext, request.getUri().getScheme());
final int httpStatusCode = httpResponse.getCode();
diff --git a/idp-duo-nimbus-client-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClientFactoryTest.java b/idp-duo-nimbus-client-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClientFactoryTest.java
index 19a014e..1b5957e 100644
--- a/idp-duo-nimbus-client-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClientFactoryTest.java
+++ b/idp-duo-nimbus-client-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClientFactoryTest.java
@@ -3,8 +3,6 @@ package net.shibboleth.idp.plugin.authn.duo.nimbus.impl;
import static org.testng.Assert.assertNotNull;
-import javax.annotation.Nonnull;
-
import org.apache.hc.client5.http.classic.HttpClient;
import org.mockito.Mockito;
import org.testng.annotations.BeforeMethod;
@@ -15,6 +13,7 @@ import com.fasterxml.jackson.databind.ObjectMapper;
import net.shibboleth.idp.plugin.authn.duo.DefaultDuoOIDCIntegration;
import net.shibboleth.idp.plugin.authn.duo.DuoClientException;
import net.shibboleth.idp.plugin.authn.duo.DuoOIDCClient;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeTest;
import net.shibboleth.shared.component.ComponentInitializationException;
@@ -22,8 +21,7 @@ import net.shibboleth.shared.component.ComponentInitializationException;
public class NimbusClientFactoryTest {
/** The factory. */
- @Nonnull
- private NimbusClientFactory factory;
+ @NonnullBeforeTest private NimbusClientFactory factory;
/** Setup.*/
@BeforeMethod
@@ -53,7 +51,10 @@ public class NimbusClientFactoryTest {
integ.setTokenEndpoint("/token");
integ.setAuthorizeEndpoint("/authorize");
integ.setSecretKey("rFvDfPul27v3Wew2zb6xRPzAJewJ34MP2w8UitPh");
- integ.setRedirectURIIfAbsent(integ.getRegisteredRedirectURI());
+ final var registeredRedirect = integ.getRegisteredRedirectURI();
+ assertNotNull(registeredRedirect);
+ assert registeredRedirect != null;
+ integ.setRedirectURIIfAbsent(registeredRedirect);
integ.initialize();
final DuoOIDCClient client = factory.createInstance(integ);
assertNotNull(client);
diff --git a/idp-duo-nimbus-client-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClientSupportTest.java b/idp-duo-nimbus-client-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClientSupportTest.java
index bef6b2a..b92e3f9 100644
--- a/idp-duo-nimbus-client-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClientSupportTest.java
+++ b/idp-duo-nimbus-client-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClientSupportTest.java
@@ -18,15 +18,13 @@ import static org.testng.Assert.assertEquals;
import static org.testng.Assert.assertNotNull;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
import net.shibboleth.idp.plugin.authn.duo.DefaultDuoOIDCIntegration;
import net.shibboleth.idp.plugin.authn.duo.DuoClientException;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeTest;
import net.shibboleth.shared.component.ComponentInitializationException;
/** Tests for the NimbusClientSupport class.*/
@@ -40,12 +38,9 @@ public class NimbusClientSupportTest {
/** A dummy audience.*/
@Nonnull static final String AUD = "audience";
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(NimbusClientSupportTest.class);
-
+
/** A dummy integration.*/
- @Nullable private DefaultDuoOIDCIntegration integ;
+ @NonnullBeforeTest private DefaultDuoOIDCIntegration integ;
@BeforeMethod
@@ -58,15 +53,21 @@ public class NimbusClientSupportTest {
integ.setTokenEndpoint("/token");
integ.setAuthorizeEndpoint("/authorize");
integ.setSecretKey("rFvDfPul27v3Wew2zb6xRPzAJewJ34MP2w8UitPh");
- integ.setRedirectURIIfAbsent(integ.getRegisteredRedirectURI());
+ final var registeredRedirect = integ.getRegisteredRedirectURI();
+ assertNotNull(registeredRedirect);
+ assert registeredRedirect != null;
+ integ.setRedirectURIIfAbsent(registeredRedirect);
integ.initialize();
}
/* Simple test that a JWS string is created and contains 3 components, header.payload.signature */
@Test
- public void testCreateJWSRequestObject() throws DuoClientException {
+ public void testCreateJWSRequestObject() throws DuoClientException {
+ final var registeredRedirect = integ.getRegisteredRedirectURI();
+ assertNotNull(registeredRedirect);
+ assert registeredRedirect != null;
final String jws = NimbusClientSupport.createJWSRequestObject(integ.getClientId(),
- integ.getRedirectURI(),integ.getSecretKey(), STATE, USERNAME);
+ registeredRedirect,integ.getSecretKey(), STATE, USERNAME);
assertNotNull(jws);
assertEquals(jws.split("\\.").length,3);
}
diff --git a/idp-duo-nimbus-client-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClientTest.java b/idp-duo-nimbus-client-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClientTest.java
index f981cfd..e1cf0c5 100644
--- a/idp-duo-nimbus-client-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClientTest.java
+++ b/idp-duo-nimbus-client-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClientTest.java
@@ -58,16 +58,17 @@ import com.nimbusds.jwt.JWT;
import net.shibboleth.idp.plugin.authn.duo.DefaultDuoOIDCIntegration;
import net.shibboleth.idp.plugin.authn.duo.DuoClientException;
import net.shibboleth.idp.plugin.authn.duo.model.DuoHealthCheck;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeTest;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
/** Tests for the NimbusClient class.*/
public class NimbusClientTest {
/** The Nimbus client to test.*/
- @Nonnull private NimbusClient client;
+ @NonnullBeforeTest private NimbusClient client;
/** The default OIDC integration params.*/
- @Nonnull private DefaultDuoOIDCIntegration integ;
+ @NonnullBeforeTest private DefaultDuoOIDCIntegration integ;
/** Real but valid OAuth JSON token response that has an INVALID signature.*/
@Nonnull @NotEmpty
@@ -150,7 +151,10 @@ public class NimbusClientTest {
integ.setAuthorizeEndpoint("/oauth/v1/authorize");
integ.setTokenEndpoint("/oauth/v1/token");
integ.setHealthCheckEndpoint("/oauth/v1/health_check");
- integ.setRedirectURIIfAbsent(integ.getRegisteredRedirectURI());
+ final var registeredRedirect = integ.getRegisteredRedirectURI();
+ assertNotNull(registeredRedirect);
+ assert registeredRedirect != null;
+ integ.setRedirectURIIfAbsent(registeredRedirect);
integ.initialize();
}
diff --git a/idp-duo-sdk-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/sdk/impl/DuoSDKClientAdaptor.java b/idp-duo-sdk-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/sdk/impl/DuoSDKClientAdaptor.java
index c199cbe..308e046 100644
--- a/idp-duo-sdk-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/sdk/impl/DuoSDKClientAdaptor.java
+++ b/idp-duo-sdk-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/sdk/impl/DuoSDKClientAdaptor.java
@@ -26,7 +26,6 @@ import javax.annotation.concurrent.Immutable;
import javax.annotation.concurrent.ThreadSafe;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.duosecurity.Client;
import com.duosecurity.exception.DuoException;
@@ -49,6 +48,7 @@ import net.shibboleth.oidc.security.JWSAssemblyUtils;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.codec.EncodingException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
@@ -188,8 +188,8 @@ public final class DuoSDKClientAdaptor extends AbstractDuoOIDCClient{
private class DefaultHealthCheckResponseConverter implements Function<HealthCheckResponse,DuoHealthCheck>{
@Override
- public DuoHealthCheck apply(@Nonnull final HealthCheckResponse response) {
-
+ public DuoHealthCheck apply(@Nullable final HealthCheckResponse response) {
+ assert response != null;
return DuoHealthCheck.builder().withStatus(response.getStat()).withCode(response.getCode())
.withMessage(response.getMessage()).withMessageDetail(response.getMessage_detail())
.withResponse(new DuoHealthCheckResponse(response.getResponse().getTimestamp()))
@@ -215,7 +215,10 @@ public final class DuoSDKClientAdaptor extends AbstractDuoOIDCClient{
}
@Override
- @Nullable public JWT apply(@Nonnull final Token t, @Nonnull final DuoOIDCIntegration integ) {
+ @Nullable public JWT apply(@Nullable final Token t, @Nullable final DuoOIDCIntegration integ) {
+ if (integ == null) {
+ return null;
+ }
try {
final String duoTokenAsJson = objectMapper.writeValueAsString(t);
final JWTClaimsSet claims = JWTClaimsSet.parse(duoTokenAsJson);
diff --git a/idp-duo-sdk-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/sdk/impl/DuoSDKClientFactory.java b/idp-duo-sdk-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/sdk/impl/DuoSDKClientFactory.java
index ccfdd47..1b1c6e2 100644
--- a/idp-duo-sdk-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/sdk/impl/DuoSDKClientFactory.java
+++ b/idp-duo-sdk-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/sdk/impl/DuoSDKClientFactory.java
@@ -21,9 +21,6 @@ import javax.annotation.Nullable;
import javax.annotation.concurrent.GuardedBy;
import javax.annotation.concurrent.ThreadSafe;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
import net.shibboleth.idp.plugin.authn.duo.DuoClientException;
import net.shibboleth.idp.plugin.authn.duo.DuoOIDCClient;
import net.shibboleth.idp.plugin.authn.duo.DuoOIDCClientFactory;
@@ -37,10 +34,7 @@ import net.shibboleth.shared.primitive.StringSupport;
/** Abstract factory implementation for the {@link DuoSDKClientAdaptor}. */
@ThreadSafe
-public final class DuoSDKClientFactory extends AbstractInitializableComponent implements DuoOIDCClientFactory{
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(DuoSDKClientFactory.class);
+public final class DuoSDKClientFactory extends AbstractInitializableComponent implements DuoOIDCClientFactory{
/** List of CA Certificate pins. If null, the client's default set are used.*/
@GuardedBy("this") @Nullable @NonnullElements @Unmodifiable private List<String> caCerts;
diff --git a/idp-duo-sdk-client-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/sdk/impl/DuoSDKClientFactoryTest.java b/idp-duo-sdk-client-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/sdk/impl/DuoSDKClientFactoryTest.java
index f9e794a..94e38fe 100644
--- a/idp-duo-sdk-client-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/sdk/impl/DuoSDKClientFactoryTest.java
+++ b/idp-duo-sdk-client-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/sdk/impl/DuoSDKClientFactoryTest.java
@@ -88,7 +88,10 @@ public class DuoSDKClientFactoryTest {
integ.setAuthorizeEndpoint("/oauth/v1/authorize");
integ.setTokenEndpoint("/oauth/v1/token");
integ.setHealthCheckEndpoint("/oauth/v1/health_check");
- integ.setRedirectURIIfAbsent(integ.getRegisteredRedirectURI());
+ final var registeredRedirect = integ.getRegisteredRedirectURI();
+ assertNotNull(registeredRedirect);
+ assert registeredRedirect != null;
+ integ.setRedirectURIIfAbsent(registeredRedirect);
final DuoOIDCClient client = factory.createInstance(integ);
assertNotNull(client);
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list