[java-idp-plugin-duo] branch main updated: JDUO-65 - Align audit logging to delivered feature in IdP
Phil Smart
philip.smart at jisc.ac.uk
Fri Feb 17 09:14:04 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-duo.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=9cc8e3154dc7263459f6bafe8183698b3fb03d72
The following commit(s) were added to refs/heads/main by this push:
new 9cc8e31 JDUO-65 - Align audit logging to delivered feature in IdP
9cc8e31 is described below
commit 9cc8e3154dc7263459f6bafe8183698b3fb03d72
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Feb 17 09:14:01 2023 +0000
JDUO-65 - Align audit logging to delivered feature in IdP
- Move Duo to 1.4.0-SNAPSHOT. This might never be released. It might be
V2.0.0 and IdP V5 compatible before it is shipped.
- Move validation action over to the new auditing validation mechanism
- Move the pre-duo audit actions over to the new population and audit
writing beans
https://shibboleth.atlassian.net/browse/JDUO-65
---
idp-duo-api/pom.xml | 2 +-
.../idp/plugin/authn/duo/audit/AuditFields.java | 14 +-
idp-duo-impl/pom.xml | 2 +-
.../impl/ValidateDuoTokenAuthenticationResult.java | 4 +-
.../META-INF/net.shibboleth.idp/postconfig.xml | 99 ------------
.../flows/authn/DuoOIDC/duo-oidc-authn-beans.xml | 170 ++++++++++++++-------
.../flows/authn/DuoOIDC/duo-oidc-authn-flow.xml | 4 +-
idp-duo-nimbus-client-impl/pom.xml | 2 +-
.../duo/nimbus/conf/authn/duo-oidc.properties | 8 +-
idp-duo-nimbus-distribution/pom.xml | 2 +-
idp-duo-sdk-client-impl/pom.xml | 2 +-
.../authn/duo/sdk/conf/authn/duo-oidc.properties | 6 +-
idp-duo-sdk-distribution/pom.xml | 7 +-
pom.xml | 4 +-
14 files changed, 155 insertions(+), 171 deletions(-)
diff --git a/idp-duo-api/pom.xml b/idp-duo-api/pom.xml
index d5d93b8..7cdfa3e 100644
--- a/idp-duo-api/pom.xml
+++ b/idp-duo-api/pom.xml
@@ -4,7 +4,7 @@
<parent>
<groupId>net.shibboleth.idp.plugin.authn</groupId>
<artifactId>idp-plugin-duo-parent</artifactId>
- <version>1.3.1-SNAPSHOT</version>
+ <version>1.4.0-SNAPSHOT</version>
</parent>
<artifactId>idp-plugin-duo-api</artifactId>
diff --git a/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/audit/AuditFields.java b/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/audit/AuditFields.java
index 137e0b9..e089aee 100644
--- a/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/audit/AuditFields.java
+++ b/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/audit/AuditFields.java
@@ -38,7 +38,12 @@ public final class AuditFields {
/** Duo Transaction ID. */
@Nonnull @NotEmpty public static final String TXID = "DuoTXID";
- /** Duo Device ID (auth_device:key). */
+ /**
+ * Duo Device ID (auth_device:key).
+ *
+ * @deprecated use AuthnAuditFields#DUO_DEVICE_ID
+ */
+ @Deprecated(since="1.4.0", forRemoval = true)
@Nonnull @NotEmpty public static final String DEVICE_ID = "DuoDID";
/** Duo Device friendly name (auth_device:name). */
@@ -47,7 +52,12 @@ public final class AuditFields {
/** Duo reason. */
@Nonnull @NotEmpty public static final String REASON = "DuoR";
- /** Duo factor used for 2FA. */
+ /**
+ * Duo factor used for 2FA.
+ *
+ * @deprecated use AuthnAuditFields#DUO_FACTOR
+ */
+ @Deprecated(since="1.4.0", forRemoval = true)
@Nonnull @NotEmpty public static final String FACTOR = "DuoF";
/** Duo username used for 2FA. */
diff --git a/idp-duo-impl/pom.xml b/idp-duo-impl/pom.xml
index 1c38fd5..05a9f7b 100644
--- a/idp-duo-impl/pom.xml
+++ b/idp-duo-impl/pom.xml
@@ -6,7 +6,7 @@
<parent>
<groupId>net.shibboleth.idp.plugin.authn</groupId>
<artifactId>idp-plugin-duo-parent</artifactId>
- <version>1.3.1-SNAPSHOT</version>
+ <version>1.4.0-SNAPSHOT</version>
</parent>
<name>Shibboleth IdP :: Plugins :: Duo 2FA Login Flow Impl</name>
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
index 2895789..6af7791 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
@@ -37,12 +37,12 @@ import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWT;
import com.nimbusds.jwt.JWTClaimsSet;
-import net.shibboleth.idp.authn.AbstractValidationAction;
import net.shibboleth.idp.authn.AuthenticationResult;
import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
import net.shibboleth.idp.authn.duo.DuoPrincipal;
+import net.shibboleth.idp.authn.impl.AbstractAuditingValidationAction;
import net.shibboleth.idp.plugin.authn.duo.DuoException;
import net.shibboleth.idp.plugin.authn.duo.DuoOIDCAuthAPI;
import net.shibboleth.idp.plugin.authn.duo.context.DuoOIDCAuthenticationContext;
@@ -64,7 +64,7 @@ import net.shibboleth.utilities.java.support.component.ComponentSupport;
* AuthenticationContext.getSubcontext(DuoOIDCAuthenticationContext.class, false) != null
* </pre>
*/
-public class ValidateDuoTokenAuthenticationResult extends AbstractValidationAction{
+public class ValidateDuoTokenAuthenticationResult extends AbstractAuditingValidationAction {
/** Class logger.*/
@Nonnull private final Logger log = LoggerFactory.getLogger(ValidateDuoTokenAuthenticationResult.class);
diff --git a/idp-duo-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-duo-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 09771cf..f3280dd 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -44,104 +44,5 @@
<bean id="shibboleth.DuoOIDCAuthnController"
class="net.shibboleth.idp.plugin.authn.duo.impl.DuoOIDCAuthnController" />
-
- <!-- Default audit format and extractors -->
- <util:map id="shibboleth.authn.DuoOIDC.DefaultAuditFormattingMap">
- <entry key="Shibboleth-Audit.DuoOIDC" value="%AAF|%a|%T|%DuoU|%DuoRedirect|%DuoCID|%DuoReqS|%DuoRespS|%DuoTXID|%DuoDID|%DuoDN|%DuoR|%DuoF" />
- </util:map>
-
-
- <bean id="shibboleth.authn.DuoOIDC.DefaultPreDuoPopulateAuditExtractors" lazy-init="true"
- class="org.springframework.beans.factory.config.MapFactoryBean">
- <property name="sourceMap">
- <map>
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.plugin.authn.duo.audit.AuditFields.ATTEMPTED_AUTHN_FLOW_ID"/>
- </key>
- <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.AttemptedAuthenticationFlowIdAuditExtractor" />
- </entry>
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.plugin.authn.duo.audit.AuditFields.CLIENT_ID"/>
- </key>
- <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.DuoClientIdAuditExtractor" />
- </entry>
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.plugin.authn.duo.audit.AuditFields.REDIRECT_URI"/>
- </key>
- <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.DuoRedirectUriAuditExtractor" />
- </entry>
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.plugin.authn.duo.audit.AuditFields.DUO_USER"/>
- </key>
- <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.DuoUsernameAuditExtractor"/>
- </entry>
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.plugin.authn.duo.audit.AuditFields.REQ_STATE"/>
- </key>
- <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.DuoRequestStateAuditExtractor"/>
- </entry>
- </map>
- </property>
- </bean>
-
- <!-- Included so the state can be stashed inside the audit context before it is validated and removed -->
- <bean id="shibboleth.authn.DuoOIDC.DefaultPreStateValidationPopulateAuditExtractors" lazy-init="true"
- class="org.springframework.beans.factory.config.MapFactoryBean">
- <property name="sourceMap">
- <map>
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.plugin.authn.duo.audit.AuditFields.RESP_STATE"/>
- </key>
- <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.DuoResponseStateAuditExtractor"/>
- </entry>
- </map>
- </property>
- </bean>
-
-
- <bean id="shibboleth.authn.DuoOIDC.DefaultPostDuoPopulateAuditExtractors" lazy-init="true"
- class="org.springframework.beans.factory.config.MapFactoryBean">
- <property name="sourceMap">
- <map>
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.plugin.authn.duo.audit.AuditFields.TXID"/>
- </key>
- <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.DuoTransactionIdAuditExtractor"/>
- </entry>
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.plugin.authn.duo.audit.AuditFields.DEVICE_ID"/>
- </key>
- <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.DuoAuthnDeviceIdAuditExtractor"/>
- </entry>
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.plugin.authn.duo.audit.AuditFields.DEVICE_NAME"/>
- </key>
- <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.DuoAuthnDeviceNameAuditExtractor"/>
- </entry>
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.plugin.authn.duo.audit.AuditFields.REASON"/>
- </key>
- <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.DuoReasonAuditExtractor"/>
- </entry>
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.plugin.authn.duo.audit.AuditFields.FACTOR"/>
- </key>
- <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.DuoFactorAuditExtractor"/>
- </entry>
-
- </map>
- </property>
- </bean>
</beans>
\ No newline at end of file
diff --git a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
index 700169a..ee39e60 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
@@ -55,20 +55,6 @@
<bean id="shibboleth.authn.DuoOIDC.clientRegistry" scope="singleton"
class="net.shibboleth.idp.plugin.authn.duo.impl.DefaultDuoOIDCClientRegistry"
p:clientFactory-ref="%{idp.duo.oidc.clientFactoryBean:shibboleth.authn.DuoOIDC.clientFactory}"/>
-
- <!-- Some function beans -->
- <bean id="shibboleth.authn.DuoOIDC.ChildLookup.AuditContext"
- parent="shibboleth.Functions.Compose">
- <constructor-arg name="g">
- <bean id="shibboleth.ChildLookup.AuditContext"
- class="org.opensaml.messaging.context.navigate.ChildContextLookup"
- c:type="#{ T(net.shibboleth.idp.profile.context.AuditContext) }"
- c:createContext="true" />
- </constructor-arg>
- <constructor-arg name="f">
- <ref bean="shibboleth.ChildLookup.AuthenticationContext" />
- </constructor-arg>
- </bean>
<!--
Load all (or none) factory bean definitions from the classpath. The defaulted factory bean must be called
@@ -137,11 +123,6 @@
class="net.shibboleth.idp.plugin.authn.duo.impl.HealthCheckDuoOIDCAuthAPI"
p:activationCondition="%{idp.duo.oidc.healthcheck.enabled:true}">
</bean>
-
- <bean id="PreDuoPopulateAuditContext" parent="shibboleth.authn.DuoOIDC.AbstractPopulateAuditContext"
- p:fieldExtractors="#{getObject('shibboleth.authn.DuoOIDC.PreDuoPopulateAuditExtractors') ?: getObject('shibboleth.authn.DuoOIDC.DefaultPreDuoPopulateAuditExtractors')}"
- p:auditContextCreationStrategy-ref="shibboleth.authn.DuoOIDC.ChildLookup.AuditContext"/>
-
<bean id="ValidateExternalAuthenticationContext" scope="prototype"
class="net.shibboleth.idp.plugin.authn.duo.impl.ValidateExternalAuthenticationContext" />
@@ -250,46 +231,133 @@
<bean id="shibboleth.authn.DuoOIDC.DefaultCleanupHook"
class="net.shibboleth.idp.plugin.authn.duo.impl.ValidateDuoTokenAuthenticationResult.DuoOIDCCleanupHook" />
-
-
- <bean id="PreStateValidationPopulateAuditContext" parent="shibboleth.authn.DuoOIDC.AbstractPopulateAuditContext"
- p:fieldExtractors="#{getObject('shibboleth.authn.DuoOIDC.PreStateValidationPopulateAuditExtractors') ?: getObject('shibboleth.authn.DuoOIDC.DefaultPreStateValidationPopulateAuditExtractors')}"
- p:auditContextCreationStrategy-ref="shibboleth.authn.DuoOIDC.ChildLookup.AuditContext"/>
-
-
- <bean id="PostDuoPopulateAuditContext" parent="shibboleth.authn.DuoOIDC.AbstractPopulateAuditContext"
- p:fieldExtractors="#{getObject('shibboleth.authn.DuoOIDC.PostDuoPopulateAuditExtractors') ?: getObject('shibboleth.authn.DuoOIDC.DefaultPostDuoPopulateAuditExtractors')}"
- p:auditContextCreationStrategy-ref="shibboleth.authn.DuoOIDC.ChildLookup.AuditContext"/>
-
- <bean id="WriteAuditLog" class="net.shibboleth.idp.profile.audit.impl.WriteAuditLog" scope="prototype"
- p:formattingMap="#{getObject('shibboleth.authn.DuoOIDC.AuditFormattingMap') ?: getObject('shibboleth.authn.DuoOIDC.DefaultAuditFormattingMap')}"
- p:dateTimeFormat="#{getObject('shibboleth.AuditDateTimeFormat')}"
- p:useDefaultTimeZone="#{getObject('shibboleth.AuditDefaultTimeZone') ?: false}"
- p:httpServletRequest-ref="shibboleth.authn.DuoOIDC.internal.HttpServletRequest"
- p:activationCondition="%{idp.duo.oidc.audit.enabled:false}"
- p:auditContextLookupStrategy-ref="shibboleth.authn.DuoOIDC.ChildLookup.AuditContext"/>
-
+
<bean id="ValidateDuoTokenAuthenticationResult" scope="prototype"
class="net.shibboleth.idp.plugin.authn.duo.impl.ValidateDuoTokenAuthenticationResult"
p:classifiedMessages="#{getObject('shibboleth.authn.DuoOIDC.ClassifiedMessageMap')}"
p:resultCachingPredicate="#{getObject('shibboleth.authn.DuoOIDC.resultCachingPredicate')}"
p:cleanupHook="#{getObject('shibboleth.authn.DuoOIDC.CleanUpHook') ?: getObject('shibboleth.authn.DuoOIDC.DefaultCleanupHook')}"
p:contextToPrincipalMappingStrategy="#{getObject('shibboleth.authn.DuoOIDC.ContextToPrincipalMappingStrategy')}"
- p:addDefaultPrincipals="#{%{idp.authn.DuoOIDC.addDefaultPrincipals:true} and getObject('shibboleth.authn.DuoOIDC.ContextToPrincipalMappingStrategy') == null}"/>
-
+ p:addDefaultPrincipals="#{%{idp.authn.DuoOIDC.addDefaultPrincipals:true} and getObject('shibboleth.authn.DuoOIDC.ContextToPrincipalMappingStrategy') == null}"
+ p:populateAuditContextAction="#{%{idp.duo.oidc.audit.enabled:%{idp.authn.audit.enabled:false}} ? getObject('PostDuoPopulateAuditContext') : null}"
+ p:writeAuditLogAction="#{%{idp.duo.oidc.audit.enabled:%{idp.authn.audit.enabled:false}} ? getObject('WriteAuthnAuditLog') : null}" />
- <!-- Audit System Setup Specific to Duo -->
+ <!-- Audit logging beans -->
- <bean id="shibboleth.authn.DuoOIDC.AbstractPopulateAuditContext" abstract="true"
- class="net.shibboleth.idp.profile.audit.impl.PopulateAuditContext" scope="prototype"
- p:formattingMapParser-ref="shibboleth.authn.DuoOIDC.AuditFormattingMapParser"
- p:dateTimeFormat="#{getObject('shibboleth.AuditDateTimeFormat')}"
- p:useDefaultTimeZone="#{getObject('shibboleth.AuditDefaultTimeZone') ?: false}"
- p:fieldReplacements="#{getObject('shibboleth.AuditFieldReplacementMap')}" />
+ <!--
+ The first context logger clears any previous audit information from the first authentication factor. The
+ others are accumulative.
+ -->
+ <bean id="PreDuoPopulateAuditContext" parent="shibboleth.authn.AbstractPopulateAuditContext"
+ p:fieldExtractors="#{getObject('shibboleth.authn.DuoOIDC.PreDuoPopulateAuditExtractors') ?: getObject('shibboleth.authn.DuoOIDC.DefaultPreDuoPopulateAuditExtractors')}"
+ p:clearAuditContext="true"/>
+
+ <bean id="PreStateValidationPopulateAuditContext" parent="shibboleth.authn.AbstractPopulateAuditContext"
+ p:fieldExtractors="#{getObject('shibboleth.authn.DuoOIDC.PreStateValidationPopulateAuditExtractors') ?: getObject('shibboleth.authn.DuoOIDC.DefaultPreStateValidationPopulateAuditExtractors')}"/>
+
+ <bean id="PostDuoPopulateAuditContext" parent="shibboleth.authn.AbstractPopulateAuditContext" lazy-init="true"
+ p:fieldExtractors="#{getObject('shibboleth.authn.DuoOIDC.PostDuoPopulateAuditExtractors') ?: getObject('shibboleth.authn.DuoOIDC.DefaultPostDuoPopulateAuditExtractors')}"/>
- <bean id="shibboleth.authn.DuoOIDC.AuditFormattingMapParser" scope="prototype"
- class="net.shibboleth.idp.profile.audit.impl.PopulateAuditContext.FormattingMapParser"
- c:_0="#{getObject('shibboleth.authn.DuoOIDC.AuditFormattingMap') ?: getObject('shibboleth.authn.DuoOIDC.DefaultAuditFormattingMap')}" />
-
+ <util:map id="shibboleth.authn.AuditFormattingMap">
+ <entry key="#{'%{idp.duo.oidc.audit.category:Shibboleth-Audit.DuoOIDC}'.trim()}"
+ value="#{'%{idp.duo.oidc.audit.format:%AAF|%a|%T|%DuoU|%DuoRedirect|%DuoCID|%DuoReqS|%DuoRespS|%DuoTXID|%DuoDID|%DuoDN|%DuoR|%DuoF}'.trim()}" />
+ </util:map>
+
+ <bean id="WritePreDuoAuthnAuditLog" parent="WriteAuthnAuditLog"
+ p:activationCondition="#{%{idp.authn.audit.enabled:false} and %{idp.duo.oidc.audit.enabled:false} ? true : false}"/>
+
+ <!-- The initial audit population bean is parented by the default authn audit extractor -->
+ <bean id="shibboleth.authn.DuoOIDC.DefaultPreDuoPopulateAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors"
+ lazy-init="true" class="org.springframework.beans.factory.config.MapFactoryBean">
+ <property name="sourceMap">
+ <map merge="true">
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.plugin.authn.duo.audit.AuditFields.ATTEMPTED_AUTHN_FLOW_ID"/>
+ </key>
+ <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.AttemptedAuthenticationFlowIdAuditExtractor" />
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.plugin.authn.duo.audit.AuditFields.CLIENT_ID"/>
+ </key>
+ <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.DuoClientIdAuditExtractor" />
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.plugin.authn.duo.audit.AuditFields.REDIRECT_URI"/>
+ </key>
+ <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.DuoRedirectUriAuditExtractor" />
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.plugin.authn.duo.audit.AuditFields.DUO_USER"/>
+ </key>
+ <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.DuoUsernameAuditExtractor"/>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.plugin.authn.duo.audit.AuditFields.REQ_STATE"/>
+ </key>
+ <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.DuoRequestStateAuditExtractor"/>
+ </entry>
+ </map>
+ </property>
+ </bean>
+
+ <!-- Included so the state can be stashed inside the audit context before it is validated and removed -->
+ <bean id="shibboleth.authn.DuoOIDC.DefaultPreStateValidationPopulateAuditExtractors" lazy-init="true"
+ class="org.springframework.beans.factory.config.MapFactoryBean">
+ <property name="sourceMap">
+ <map>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.plugin.authn.duo.audit.AuditFields.RESP_STATE"/>
+ </key>
+ <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.DuoResponseStateAuditExtractor"/>
+ </entry>
+ </map>
+ </property>
+ </bean>
+
+
+ <bean id="shibboleth.authn.DuoOIDC.DefaultPostDuoPopulateAuditExtractors"
+ lazy-init="true" class="org.springframework.beans.factory.config.MapFactoryBean">
+ <property name="sourceMap">
+ <map>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.plugin.authn.duo.audit.AuditFields.TXID"/>
+ </key>
+ <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.DuoTransactionIdAuditExtractor"/>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.authn.AuthnAuditFields.DUO_DEVICE_ID"/>
+ </key>
+ <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.DuoAuthnDeviceIdAuditExtractor"/>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.plugin.authn.duo.audit.AuditFields.DEVICE_NAME"/>
+ </key>
+ <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.DuoAuthnDeviceNameAuditExtractor"/>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.plugin.authn.duo.audit.AuditFields.REASON"/>
+ </key>
+ <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.DuoReasonAuditExtractor"/>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.authn.AuthnAuditFields.DUO_FACTOR"/>
+ </key>
+ <bean class="net.shibboleth.idp.plugin.authn.duo.audit.impl.DuoFactorAuditExtractor"/>
+ </entry>
+
+ </map>
+ </property>
+ </bean>
</beans>
\ No newline at end of file
diff --git a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml
index d83170c..6956f4d 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml
@@ -27,7 +27,7 @@
<evaluate expression="PopulateDuoAuthenticationContext" />
<evaluate expression="HealthCheckDuoOIDCAuthAPI" />
<evaluate expression="PreDuoPopulateAuditContext" />
- <evaluate expression="WriteAuditLog"/>
+ <evaluate expression="WritePreDuoAuthnAuditLog"/>
<evaluate expression="'proceed'" />
<transition on="proceed" to="Duo2FAAuthorizationRequest" />
</action-state>
@@ -58,8 +58,6 @@
<!-- validate the token signature and claims -->
<evaluate expression="ValidateTokenSignature"/>
<evaluate expression="ValidateTokenClaims"/>
- <evaluate expression="PostDuoPopulateAuditContext" />
- <evaluate expression="WriteAuditLog" />
<!-- final validation of the response status to build an authn result -->
<evaluate expression="ValidateDuoTokenAuthenticationResult"/>
<evaluate expression="'proceed'" />
diff --git a/idp-duo-nimbus-client-impl/pom.xml b/idp-duo-nimbus-client-impl/pom.xml
index 326c75f..4d80249 100644
--- a/idp-duo-nimbus-client-impl/pom.xml
+++ b/idp-duo-nimbus-client-impl/pom.xml
@@ -5,7 +5,7 @@
<parent>
<groupId>net.shibboleth.idp.plugin.authn</groupId>
<artifactId>idp-plugin-duo-parent</artifactId>
- <version>1.3.1-SNAPSHOT</version>
+ <version>1.4.0-SNAPSHOT</version>
</parent>
<artifactId>idp-plugin-duo-nimbus-client-impl</artifactId>
diff --git a/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties b/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties
index 569db6e..d2eeb13 100644
--- a/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties
+++ b/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties
@@ -66,5 +66,9 @@ idp.duo.oidc.redirectURL = https://<hostname>:<port>/idp/profile/Authn/Duo/2FA/d
# Applies only to forced authentication
#idp.duo.oidc.jwt.verifier.authLifetime = PT60S
-## Write audit entries before the Duo redirect and after response validation
-#idp.duo.oidc.audit.enabled = false
\ No newline at end of file
+# Write audit entries before the Duo redirect and after response validation
+#idp.duo.oidc.audit.enabled = false
+# The audit format to use
+#idp.duo.oidc.audit.format = %a|%T|%SP|%I|%s|%AF|%u|%AR|%DuoCID|%DuoF|%DuoDID|%UA
+# The audit category to use
+#idp.duo.oidc.audit.category = Shibboleth-Audit.DuoOIDC
\ No newline at end of file
diff --git a/idp-duo-nimbus-distribution/pom.xml b/idp-duo-nimbus-distribution/pom.xml
index 4b92a3b..24f8a11 100644
--- a/idp-duo-nimbus-distribution/pom.xml
+++ b/idp-duo-nimbus-distribution/pom.xml
@@ -6,7 +6,7 @@
<parent>
<groupId>net.shibboleth.idp.plugin.authn</groupId>
<artifactId>idp-plugin-duo-parent</artifactId>
- <version>1.3.1-SNAPSHOT</version>
+ <version>1.4.0-SNAPSHOT</version>
</parent>
<artifactId>idp-plugin-duo-nimbus-dist</artifactId>
diff --git a/idp-duo-sdk-client-impl/pom.xml b/idp-duo-sdk-client-impl/pom.xml
index d9d8120..9e2be76 100644
--- a/idp-duo-sdk-client-impl/pom.xml
+++ b/idp-duo-sdk-client-impl/pom.xml
@@ -6,7 +6,7 @@
<parent>
<groupId>net.shibboleth.idp.plugin.authn</groupId>
<artifactId>idp-plugin-duo-parent</artifactId>
- <version>1.3.1-SNAPSHOT</version>
+ <version>1.4.0-SNAPSHOT</version>
</parent>
<artifactId>idp-plugin-duo-sdk-client-impl</artifactId>
diff --git a/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties b/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties
index d4eb417..f166eb9 100644
--- a/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties
+++ b/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties
@@ -55,4 +55,8 @@ idp.duo.oidc.redirectURL = https://<hostname>:<port>/idp/profile/Authn/Duo/2FA/d
#idp.duo.oidc.jwt.verifier.authLifetime = PT60S
## Write audit entries before the Duo redirect and after response validation
-#idp.duo.oidc.audit.enabled = false
\ No newline at end of file
+#idp.duo.oidc.audit.enabled = false
+## The audit format to use
+#idp.duo.oidc.audit.format = %a|%T|%SP|%I|%s|%AF|%u|%AR|%DuoCID|%DuoF|%DuoDID|%UA
+# The audit category to use
+#idp.duo.oidc.audit.category = Shibboleth-Audit.DuoOIDC
\ No newline at end of file
diff --git a/idp-duo-sdk-distribution/pom.xml b/idp-duo-sdk-distribution/pom.xml
index 2f48988..0152439 100644
--- a/idp-duo-sdk-distribution/pom.xml
+++ b/idp-duo-sdk-distribution/pom.xml
@@ -1,12 +1,11 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>net.shibboleth.idp.plugin.authn</groupId>
<artifactId>idp-plugin-duo-parent</artifactId>
- <version>1.3.1-SNAPSHOT</version>
+ <version>1.4.0-SNAPSHOT</version>
</parent>
<artifactId>idp-plugin-duo-sdk-dist</artifactId>
@@ -41,7 +40,7 @@
<finalName>${dist.duosdk.finalName}</finalName>
<tarLongFileMode>gnu</tarLongFileMode>
</configuration>
- </execution>
+ </execution>
</executions>
</plugin>
<plugin>
diff --git a/pom.xml b/pom.xml
index 64ee6ff..4ae9024 100644
--- a/pom.xml
+++ b/pom.xml
@@ -11,7 +11,7 @@
<groupId>net.shibboleth.idp.plugin.authn</groupId>
<artifactId>idp-plugin-duo-parent</artifactId>
- <version>1.3.1-SNAPSHOT</version>
+ <version>1.4.0-SNAPSHOT</version>
<name>Shibboleth IdP :: Plugins :: Duo 2FA Login Flow</name>
<packaging>pom</packaging>
@@ -21,7 +21,7 @@
<properties>
<idp.groupId>net.shibboleth.idp</idp.groupId>
- <idp.version>4.3.0</idp.version>
+ <idp.version>4.3.1-SNAPSHOT</idp.version>
<duo.client.version>1.1.3</duo.client.version>
<opensaml.groupId>org.opensaml</opensaml.groupId>
<opensaml.version>4.3.0</opensaml.version>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list