[java-identity-provider] branch main updated: IDP-2068 - Remove legacy Duo flow
Scott Cantor
cantor.2 at osu.edu
Tue Jun 13 15:08:08 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=6788856c3dd856239520b2e4503d0f0f56d020de
The following commit(s) were added to refs/heads/main by this push:
new 6788856c3 IDP-2068 - Remove legacy Duo flow
6788856c3 is described below
commit 6788856c3dd856239520b2e4503d0f0f56d020de
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jun 13 11:08:05 2023 -0400
IDP-2068 - Remove legacy Duo flow
https://shibboleth.atlassian.net/browse/IDP-2068
Remove flow, module, config.
Add properties to dead list.
---
.../net/shibboleth/idp/module/authn/impl/Duo.java | 41 -------
.../services/net.shibboleth.idp.module.IdPModule | 1 -
.../net/shibboleth/idp/conf/authn-system.xml | 20 +---
.../net/shibboleth/idp/conf/global-system.xml | 26 +++++
.../net/shibboleth/idp/conf/webflow-config.xml | 1 -
.../shibboleth/idp/flows/authn/duo-authn-beans.xml | 121 ---------------------
.../shibboleth/idp/flows/authn/duo-authn-flow.xml | 67 ------------
.../idp/module/authn/impl/module.properties | 11 --
.../idp/module/conf/authn/authn.properties | 18 ---
.../idp/module/conf/authn/duo-authn-config.xml | 29 -----
.../idp/module/conf/authn/duo.properties | 27 -----
.../net/shibboleth/idp/module/views/duo.vm | 72 ------------
12 files changed, 27 insertions(+), 407 deletions(-)
diff --git a/idp-conf-impl/src/main/java/net/shibboleth/idp/module/authn/impl/Duo.java b/idp-conf-impl/src/main/java/net/shibboleth/idp/module/authn/impl/Duo.java
deleted file mode 100644
index e09ab833c..000000000
--- a/idp-conf-impl/src/main/java/net/shibboleth/idp/module/authn/impl/Duo.java
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.module.authn.impl;
-
-import java.io.IOException;
-
-import net.shibboleth.idp.module.IdPModule;
-import net.shibboleth.idp.module.impl.CoreIdPModule;
-import net.shibboleth.profile.module.ModuleException;
-
-/**
- * {@link IdPModule} implementation.
- */
-public final class Duo extends CoreIdPModule {
-
- /**
- * Constructor.
- *
- * @throws ModuleException on error
- * @throws IOException on error
- */
- public Duo() throws IOException, ModuleException {
- super(Duo.class);
- }
-
-}
\ No newline at end of file
diff --git a/idp-conf-impl/src/main/resources/META-INF/services/net.shibboleth.idp.module.IdPModule b/idp-conf-impl/src/main/resources/META-INF/services/net.shibboleth.idp.module.IdPModule
index 8fff5c5cc..23b905e94 100644
--- a/idp-conf-impl/src/main/resources/META-INF/services/net.shibboleth.idp.module.IdPModule
+++ b/idp-conf-impl/src/main/resources/META-INF/services/net.shibboleth.idp.module.IdPModule
@@ -3,7 +3,6 @@ net.shibboleth.idp.module.core.impl.CommandLine
net.shibboleth.idp.module.core.impl.EditWebApp
net.shibboleth.idp.module.core.impl.UserPrefs
-net.shibboleth.idp.module.authn.impl.Duo
net.shibboleth.idp.module.authn.impl.IPAddress
net.shibboleth.idp.module.authn.impl.MFA
net.shibboleth.idp.module.authn.impl.Password
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/authn-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/authn-system.xml
index 665768207..fc6b84a77 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/authn-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/authn-system.xml
@@ -233,25 +233,6 @@
</property>
</bean>
- <bean p:id="authn/Duo" parent="shibboleth.AuthenticationFlow"
- p:order="%{idp.authn.Duo.order:1000}"
- p:nonBrowserSupported="%{idp.authn.Duo.nonBrowserSupported:false}"
- p:passiveAuthenticationSupported="%{idp.authn.Duo.passiveAuthenticationSupported:false}"
- p:forcedAuthenticationSupported="%{idp.authn.Duo.forcedAuthenticationSupported:true}"
- p:proxyRestrictionsEnforced="%{idp.authn.Duo.proxyRestrictionsEnforced:%{idp.authn.enforceProxyRestrictions:true}}"
- p:proxyScopingEnforced="%{idp.authn.Duo.proxyScopingEnforced:false}"
- p:discoveryRequired="%{idp.authn.Duo.discoveryRequired:false}"
- p:lifetime="%{idp.authn.Duo.lifetime:%{idp.authn.defaultLifetime:PT1H}}"
- p:inactivityTimeout="%{idp.authn.Duo.inactivityTimeout:%{idp.authn.defaultTimeout:PT30M}}"
- p:reuseCondition-ref="#{'%{idp.authn.Duo.reuseCondition:shibboleth.Conditions.TRUE}'.trim()}"
- p:activationCondition-ref="#{'%{idp.authn.Duo.activationCondition:shibboleth.Conditions.TRUE}'.trim()}"
- p:subjectDecorator="#{getObject('%{idp.authn.Duo.subjectDecorator:}'.trim())}">
- <property name="supportedPrincipalsByString">
- <bean parent="shibboleth.CommaDelimStringArray"
- c:_0="#{'%{idp.authn.Duo.supportedPrincipals:}'.trim()}" />
- </property>
- </bean>
-
<bean p:id="authn/MFA" parent="shibboleth.AuthenticationFlow"
p:order="%{idp.authn.MFA.order:1000}"
p:nonBrowserSupported="%{idp.authn.MFA.nonBrowserSupported:true}"
@@ -345,6 +326,7 @@
</constructor-arg>
</bean>
+ <!-- TBD: If still needed, likely moved to Duo OIDC plugin. -->
<bean p:id="duo" class="net.shibboleth.idp.authn.principal.GenericPrincipalService"
c:claz="net.shibboleth.idp.authn.duo.DuoPrincipal">
<constructor-arg name="serializer">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
index ecbd457ed..1c5edd6c5 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
@@ -202,6 +202,32 @@
<value>idp.authn.resolveAttribute</value>
<value>idp.authn.SAML.inboundMessageHandlerFunction</value>
<value>idp.authn.SAML.outboundMessageHandlerFunction</value>
+ <value>idp.duo.apiHost</value>
+ <value>idp.duo.applicationKey</value>
+ <value>idp.duo.integrationKey</value>
+ <value>idp.duo.secretKey</value>
+ <value>idp.duo.nonbrowser.apiHost</value>
+ <value>idp.duo.nonbrowser.integrationKey</value>
+ <value>idp.duo.nonbrowser.secretKey</value>
+ <value>idp.duo.nonbrowser.header.factor</value>
+ <value>idp.duo.nonbrowser.header.device</value>
+ <value>idp.duo.nonbrowser.header.passcode</value>
+ <value>idp.duo.nonbrowser.header.auto</value>
+ <value>idp.duo.nonbrowser.clientAddressTrusted</value>
+ <value>idp.authn.Duo.order</value>
+ <value>idp.authn.Duo.nonBrowserSupported</value>
+ <value>idp.authn.Duo.passiveAuthenticationSupported</value>
+ <value>idp.authn.Duo.forcedAuthenticationSupported</value>
+ <value>idp.authn.Duo.proxyRestrictionsEnforced</value>
+ <value>idp.authn.Duo.proxyScopingEnforced</value>
+ <value>idp.authn.Duo.discoveryRequired</value>
+ <value>idp.authn.Duo.lifetime</value>
+ <value>idp.authn.Duo.inactivityTimeout</value>
+ <value>idp.authn.Duo.reuseCondition</value>
+ <value>idp.authn.Duo.activationCondition</value>
+ <value>idp.authn.Duo.subjectDecorator</value>
+ <value>idp.authn.Duo.supportedPrincipals</value>
+ <value>idp.authn.Duo.addDefaultPrincipals</value>
<value>idp.nameid.saml1.legacyGenerator</value>
<value>idp.nameid.saml2.legacyGenerator</value>
<value>idp.service.attribute.registry.namingRegistry</value>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/webflow-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/webflow-config.xml
index 118511500..4904f48e9 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/webflow-config.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/webflow-config.xml
@@ -83,7 +83,6 @@
<entry key="authn/X509Internal" value="classpath:/net/shibboleth/idp/flows/authn/x509-internal-authn-flow.xml" />
<entry key="authn/SPNEGO" value="classpath:/net/shibboleth/idp/flows/authn/spnego-authn-flow.xml" />
<entry key="authn/External" value="classpath:/net/shibboleth/idp/flows/authn/external-authn-flow.xml" />
- <entry key="authn/Duo" value="classpath:/net/shibboleth/idp/flows/authn/duo-authn-flow.xml" />
<entry key="authn/MFA" value="classpath:/net/shibboleth/idp/flows/authn/mfa-authn-flow.xml" />
<entry key="authn/Function" value="classpath:/net/shibboleth/idp/flows/authn/function-authn-flow.xml" />
<entry key="authn/SAML" value="classpath:/net/shibboleth/idp/flows/authn/saml-authn-flow.xml" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/duo-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/duo-authn-beans.xml
deleted file mode 100644
index 58ead6c39..000000000
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/duo-authn-beans.xml
+++ /dev/null
@@ -1,121 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans" xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p" xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize" default-destroy-method="destroy">
-
- <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer" p:placeholderPrefix="%{"
- p:placeholderSuffix="}" />
-
- <bean class="net.shibboleth.shared.spring.config.IdentifiableBeanPostProcessor" />
- <bean class="net.shibboleth.idp.profile.impl.ProfileActionBeanPostProcessor" />
-
- <!-- Default static integrations. -->
-
- <bean id="shibboleth.authn.Duo.DuoIntegration" class="net.shibboleth.idp.authn.duo.BasicDuoIntegration"
- p:APIHost="%{idp.duo.apiHost:none}"
- p:applicationKey="%{idp.duo.applicationKey:none}"
- p:integrationKey="%{idp.duo.integrationKey:none}"
- p:secretKey="%{idp.duo.secretKey:none}" />
- <bean id="shibboleth.authn.Duo.DuoIntegrationStrategy" parent="shibboleth.Functions.Constant"
- c:target-ref="shibboleth.authn.Duo.DuoIntegration" />
-
- <bean id="shibboleth.authn.Duo.NonBrowser.DuoIntegration" class="net.shibboleth.idp.authn.duo.BasicDuoIntegration"
- p:APIHost="%{idp.duo.nonbrowser.apiHost:%{idp.duo.apiHost:none}}"
- p:integrationKey="%{idp.duo.nonbrowser.integrationKey:none}"
- p:secretKey="%{idp.duo.nonbrowser.secretKey:none}" />
- <bean id="shibboleth.authn.Duo.NonBrowser.DuoIntegrationStrategy" parent="shibboleth.Functions.Constant"
- c:target-ref="shibboleth.authn.Duo.NonBrowser.DuoIntegration" />
-
-
- <!-- Default username comes from previous c14n or session. -->
- <bean id="shibboleth.authn.Duo.UsernameLookupStrategy"
- class="net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy" />
-
- <!-- Default message map. -->
- <util:map id="shibboleth.authn.Duo.ClassifiedMessageMap">
- <entry key="AccountLocked">
- <list>
- <value>locked_out</value>
- <value>Your two-factor account is disabled.</value>
- </list>
- </entry>
- <entry key="NoCredentials">
- <list>
- <value>Invalid request parameters (no capable device)</value>
- </list>
- </entry>
- </util:map>
-
- <!-- Can override one or more of the beans above. -->
- <import resource="conditional:%{idp.home}/conf/authn/duo-authn-config.xml" />
-
- <alias name="shibboleth.authn.Duo.UsernameLookupStrategy" alias="CanonicalUsernameStrategy" />
-
- <bean id="ValidateDuoWebResponse" scope="prototype"
- class="net.shibboleth.idp.authn.duo.impl.ValidateDuoWebResponse"
- p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier"
- p:usernameLookupStrategy-ref="shibboleth.authn.Duo.UsernameLookupStrategy"
- p:duoIntegrationLookupStrategy-ref="shibboleth.authn.Duo.DuoIntegrationStrategy"
- p:addDefaultPrincipals="#{getObject('shibboleth.authn.Duo.addDefaultPrincipals') ?: %{idp.authn.Duo.addDefaultPrincipals:true}}"
- p:resultCachingPredicate="#{getObject('shibboleth.authn.Duo.resultCachingPredicate')}"
- p:populateAuditContextAction="#{%{idp.authn.Duo.audit.enabled:%{idp.authn.audit.enabled:false}} ? getObject('shibboleth.authn.Duo.PopulateAuditContext') : null}"
- p:writeAuditLogAction="#{%{idp.authn.Duo.audit.enabled:%{idp.authn.audit.enabled:false}} ? getObject('WriteAuthnAuditLog') : null}" />
-
- <bean id="ExtractDuoAuthenticationFromHeaders" scope="prototype"
- class="net.shibboleth.idp.authn.duo.impl.ExtractDuoAuthenticationFromHeaders"
- p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier"
- p:autoAuthenticationSupported="%{idp.duo.nonbrowser.auto:true}"
- p:clientAdddressTrusted="%{idp.duo.nonbrowser.clientAddressTrusted:true}"
- p:factorHeader="%{idp.duo.nonbrowser.header.factor:X-Shibboleth-Duo-Factor}"
- p:deviceHeader="%{idp.duo.nonbrowser.header.device:X-Shibboleth-Duo-Device}"
- p:passcodeHeader="%{idp.duo.nonbrowser.header.passcode:X-Shibboleth-Duo-Passcode}"
- p:pushInfoLookupStrategy="#{getObject('shibboleth.authn.Duo.PushInfoLookupStrategy')}" />
-
- <bean id="DuoPreauthAuthenticator" lazy-init="true"
- class="net.shibboleth.idp.authn.duo.impl.DuoPreauthAuthenticator"
- p:objectMapper-ref="shibboleth.JSONObjectMapper"
- p:httpClient="#{getObject('shibboleth.authn.Duo.NonBrowser.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
- p:httpClientSecurityParameters="#{getObject('shibboleth.authn.Duo.NonBrowser.HttpClientSecurityParameters')}" />
-
- <bean id="DuoAuthAuthenticator" lazy-init="true"
- class="net.shibboleth.idp.authn.duo.impl.DuoAuthAuthenticator"
- p:objectMapper-ref="shibboleth.JSONObjectMapper"
- p:httpClient="#{getObject('shibboleth.authn.Duo.NonBrowser.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
- p:httpClientSecurityParameters="#{getObject('shibboleth.authn.Duo.NonBrowser.HttpClientSecurityParameters')}" />
-
- <bean id="ValidateDuoAuthAPI" scope="prototype"
- class="net.shibboleth.idp.authn.duo.impl.ValidateDuoAuthAPI"
- p:usernameLookupStrategy-ref="shibboleth.authn.Duo.UsernameLookupStrategy"
- p:duoIntegrationLookupStrategy-ref="shibboleth.authn.Duo.NonBrowser.DuoIntegrationStrategy"
- p:addDefaultPrincipals="#{getObject('shibboleth.authn.Duo.addDefaultPrincipals') ?: %{idp.authn.Duo.addDefaultPrincipals:true}}"
- p:preauthAuthenticator-ref="DuoPreauthAuthenticator"
- p:authAuthenticator-ref="DuoAuthAuthenticator"
- p:classifiedMessages="#{getObject('shibboleth.authn.Duo.ClassifiedMessageMap')}"
- p:resultCachingPredicate="#{getObject('shibboleth.authn.Duo.resultCachingPredicate')}"
- p:populateAuditContextAction="#{%{idp.authn.Duo.audit.enabled:%{idp.authn.audit.enabled:false}} ? getObject('shibboleth.authn.Duo.PopulateAuditContext') : null}"
- p:writeAuditLogAction="#{%{idp.authn.Duo.audit.enabled:%{idp.authn.audit.enabled:false}} ? getObject('WriteAuthnAuditLog') : null}" />
-
- <!-- Audit logging beans. -->
-
- <util:map id="shibboleth.authn.AuditFormattingMap">
- <entry key="#{'%{idp.authn.Duo.audit.category:Shibboleth-Audit.Duo}'.trim()}"
- value="#{'%{idp.authn.Duo.audit.format:%a|%T|%SP|%I|%s|%AF|%u|%AR|%DuoCID|%DuoF|%DuoDID|%UA}'.trim()}" />
- </util:map>
-
- <bean id="shibboleth.authn.Duo.DefaultAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors" lazy-init="true"
- class="org.springframework.beans.factory.config.MapFactoryBean">
- <property name="sourceMap">
- <map merge="true" />
- </property>
- </bean>
-
- <bean id="shibboleth.authn.Duo.PopulateAuditContext" parent="shibboleth.authn.AbstractPopulateAuditContext" lazy-init="true"
- p:fieldExtractors="#{getObject('shibboleth.authn.Duo.AuditExtractors') ?: getObject('shibboleth.authn.Duo.DefaultAuditExtractors')}"
- p:clearAuditContext="true" />
-
-</beans>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/duo-authn-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/duo-authn-flow.xml
deleted file mode 100644
index 261eb964c..000000000
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/duo-authn-flow.xml
+++ /dev/null
@@ -1,67 +0,0 @@
-<flow xmlns="http://www.springframework.org/schema/webflow" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
- parent="authn.abstract">
-
- <!-- This is a simple login flow for Duo authentication. -->
-
- <action-state id="ExtractDuoAuthenticationFromHeaders">
- <on-entry>
- <evaluate expression="T(net.shibboleth.shared.primitive.DeprecationSupport).warnOnce(T(net.shibboleth.shared.primitive.DeprecationSupport.ObjectType).WEBFLOW, 'authn/Duo', null, 'authn/DuoOIDC')" />
- </on-entry>
- <evaluate expression="ExtractDuoAuthenticationFromHeaders" />
- <evaluate expression="'proceed'" />
-
- <transition on="proceed" to="ValidateDuoAuthAPI" />
-
- <!-- Fall through to a different flow if header extract fails on a passive or non-browser request. -->
- <transition on="#{ opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).isPassive() || !opensamlProfileRequestContext.isBrowserProfile() }" to="ReselectFlow" />
-
- <transition on="NoCredentials" to="DisplayDuoWebView" />
- </action-state>
-
- <action-state id="ValidateDuoAuthAPI">
- <evaluate expression="ValidateDuoAuthAPI" />
- <evaluate expression="'proceed'" />
-
- <transition on="proceed" to="proceed" />
- </action-state>
-
- <view-state id="DisplayDuoWebView" view="duo">
- <on-render>
- <evaluate expression="environment" result="viewScope.environment" />
- <evaluate expression="opensamlProfileRequestContext" result="viewScope.profileRequestContext" />
- <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext))" result="viewScope.authenticationContext" />
- <evaluate expression="authenticationContext.getSubcontext(T(net.shibboleth.idp.ui.context.RelyingPartyUIContext))" result="viewScope.rpUIContext" />
- <evaluate expression="T(net.shibboleth.shared.codec.HTMLEncoder)" result="viewScope.encoder" />
- <evaluate expression="flowRequestContext.getExternalContext().getNativeRequest()" result="viewScope.request" />
- <evaluate expression="flowRequestContext.getExternalContext().getNativeResponse()" result="viewScope.response" />
- <evaluate expression="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.CustomViewContext') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.CustomViewContext') : null" result="viewScope.custom" />
- <set name="viewScope.DuoIntegration" value="flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.Duo.DuoIntegrationStrategy').apply(opensamlProfileRequestContext)" />
- <set name="viewScope.canonicalUsername" value="CanonicalUsernameStrategy.apply(opensamlProfileRequestContext)" />
- <set name="viewScope.duoHost" value="DuoIntegration.getAPIHost()" />
- <set name="viewScope.duoRequest" value="T(net.shibboleth.idp.authn.duo.impl.DuoSupport).generateSignedRequestToken(DuoIntegration, canonicalUsername)" />
- <set name="viewScope.duoScriptPath" value="'/js/Duo-Web-v2.min.js'" />
- </on-render>
-
- <transition on="proceed" to="ValidateDuoWebResponse" />
- <transition on="cancel" to="ReselectFlow" />
- <transition on-exception="com.duosecurity.duoweb.DuoWebException" to="LogDuoException" />
- </view-state>
-
- <action-state id="ValidateDuoWebResponse">
- <evaluate expression="ValidateDuoWebResponse" />
- <evaluate expression="'proceed'" />
-
- <transition on="proceed" to="proceed" />
- </action-state>
-
- <action-state id="LogDuoException">
- <on-entry>
- <evaluate expression="LogRuntimeException.log('net.shibboleth.idp.authn.duo', flowExecutionException)" />
- </on-entry>
- <evaluate expression="'AuthenticationException'" />
- </action-state>
-
- <bean-import resource="duo-authn-beans.xml" />
-
-</flow>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/authn/impl/module.properties b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/authn/impl/module.properties
index 07c671a6b..91e0b1ef2 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/authn/impl/module.properties
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/authn/impl/module.properties
@@ -1,7 +1,6 @@
# Properties defining authn modules
# Class to Module ID mappings
-net.shibboleth.idp.module.authn.impl.Duo = idp.authn.Duo
net.shibboleth.idp.module.authn.impl.IPAddress = idp.authn.IPAddress
net.shibboleth.idp.module.authn.impl.MFA = idp.authn.MFA
net.shibboleth.idp.module.authn.impl.Password = idp.authn.Password
@@ -9,16 +8,6 @@ net.shibboleth.idp.module.authn.impl.SPNEGO = idp.authn.SPNEGO
net.shibboleth.idp.module.authn.impl.X509 = idp.authn.X509
net.shibboleth.idp.module.authn.impl.Demo = idp.authn.Demo
-idp.authn.Duo.name = Duo Authentication
-idp.authn.Duo.desc = Login flow for Duo Security's second-factor authentication service.
-idp.authn.Duo.1.src = /net/shibboleth/idp/module/conf/authn/duo-authn-config.xml
-idp.authn.Duo.1.dest = conf/authn/duo-authn-config.xml
-idp.authn.Duo.1.optional = true
-idp.authn.Duo.2.src = /net/shibboleth/idp/module/conf/authn/duo.properties
-idp.authn.Duo.2.dest = conf/authn/duo.properties
-idp.authn.Duo.3.src = /net/shibboleth/idp/module/views/duo.vm
-idp.authn.Duo.3.dest = views/duo.vm
-
idp.authn.IPAddress.name = IPAddress Authentication
idp.authn.IPAddress.desc = Login flow that maps IP Address ranges to subjects.
idp.authn.IPAddress.url = /pages/3199505489/IPAddressAuthnConfiguration
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/authn.properties b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/authn.properties
index 236f2ae37..405c52288 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/authn.properties
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/authn.properties
@@ -185,24 +185,6 @@ idp.authn.IPAddress.supportedPrincipals = \
# Unset if you plan to return full Java Subject from function
#idp.authn.Function.addDefaultPrincipals = true
-#### Duo ####
-
-#idp.authn.Duo.order = 1000
-#idp.authn.Duo.nonBrowserSupported = false
-#idp.authn.Duo.forcedAuthenticationSupported = true
-# Unset if you have advanced Duo integrations with individualized Principals
-#idp.authn.Duo.addDefaultPrincipals = true
-# The list below should be changed to reflect whatever locally- or
-# community-defined values are appropriate to represent Duo. It is
-# strongly advised that the value not be specific to Duo or any
-# particular technology to avoid lock-in.
-idp.authn.Duo.supportedPrincipals = \
- saml2/http://example.org/ac/classes/mfa, \
- saml1/http://example.org/ac/classes/mfa
-# Default Duo integration settings are defined separately
-# in duo.properties due to the sensitivity of the secret key.
-
-
#### SAML ####
#idp.authn.SAML.order = 1000
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/duo-authn-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/duo-authn-config.xml
deleted file mode 100644
index 2867f484f..000000000
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/duo-authn-config.xml
+++ /dev/null
@@ -1,29 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans" xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p" xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize" default-destroy-method="destroy">
-
- <!--
- By default, the Duo flow will use statically-defined integrations defined with the
- duo.properties file. If you need more flexibility, you can define a function bean
- called "shibboleth.authn.Duo.DuoIntegrationStrategy" to return an instance of
- net.shibboleth.idp.authn.duo.DuoIntegration based on the state of the request.
- A second bean, "shibboleth.authn.Duo.NonBrowser.DuoIntegrationStrategy", can be
- supplied to use the AuthAPI for non-browser profiles.
-
- The Duo flow is designed to operate in conjunction with some other login flow,
- usually orchestrated by the MFA login flow. It obtains the username to send to
- Duo based on the output of the other login flow or a previous session with the
- user. You can override that approach using a function bean called
- "shibboleth.authn.Duo.UsernameLookupStrategy" to supply the username from a
- different source.
-
- Various other beans are supported, per the documentation.
- -->
-
-</beans>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/duo.properties b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/duo.properties
deleted file mode 100644
index da75c8e79..000000000
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/duo.properties
+++ /dev/null
@@ -1,27 +0,0 @@
-## Duo integration settings
-
-## The first set of properties support DuoWeb "iframe" integration.
-
-idp.duo.apiHost = hostname
-idp.duo.applicationKey = key
-idp.duo.integrationKey = key
-idp.duo.secretKey = key
-
-## The second set are used for direct AuthAPI usage for ECP support.
-## A separate integration has to be created for this to work.
-
-#idp.duo.nonbrowser.apiHost = %{idp.duo.apiHost}
-#idp.duo.nonbrowser.applicationKey = key
-#idp.duo.nonbrowser.integrationKey = key
-#idp.duo.nonbrowser.secretKey = key
-
-## Request header names for Duo non-browser credentials.
-# idp.duo.nonbrowser.header.factor = X-Shibboleth-Duo-Factor
-# idp.duo.nonbrowser.header.device = X-Shibboleth-Duo-Device
-# idp.duo.nonbrowser.header.passcode = X-Shibboleth-Duo-Passcode
-
-## Enables auto selection of factor/device if not specified by client.
-# idp.duo.nonbrowser.auto = true
-
-## Enables transmission of client address to Duo during authentication.
-# idp.duo.nonbrowser.clientAddressTrusted = true
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/duo.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/duo.vm
deleted file mode 100644
index a2e2ff4d4..000000000
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/duo.vm
+++ /dev/null
@@ -1,72 +0,0 @@
-##
-## Velocity Template for Duo login view-state
-##
-## Velocity context will contain the following properties
-## flowExecutionUrl - the form action location
-## flowRequestContext - the Spring Web Flow RequestContext
-## flowExecutionKey - the SWF execution key (this is built into the flowExecutionUrl)
-## profileRequestContext - root of context tree
-## authenticationContext - context with authentication request information
-## rpUIContext - the context with SP UI information from the metadata
-## canonicalUsername - name of user passed to Duo
-## duoHost - API hostname for Duo frame
-## duoRequest - signed Duo request message
-## duoScriptPath - path to Duo JavaScript source
-## encoder - HTMLEncoder class
-## request - HttpServletRequest
-## response - HttpServletResponse
-## environment - Spring Environment object for property resolution
-## custom - arbitrary object injected by deployer
-##
-<!DOCTYPE html>
-<html>
- <head>
- <title>#springMessageText("idp.title", "Web Login Service")</title>
- <meta charset="UTF-8" />
- <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
- <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=5.0">
- <link rel="stylesheet" type="text/css" href="$request.getContextPath()#springMessageText("idp.css", "/css/placeholder.css")" media="all">
- <style>
- #duo_iframe {
- width: 100%;
- min-width: 304px;
- max-width: 620px;
- height: 330px;
- }
- </style>
- </head>
- <body>
- <main class="main">
- <header>
- <img class="main-logo" src="$request.getContextPath()#springMessageText("idp.logo", "/images/placeholder-logo.png")" alt="#springMessageText("idp.logo.alt-text", "logo")" />
- </header>
-
- <section>
- <h1>#springMessageText("idp.login.duoRequired", "Authentication with Duo is required for the requested service.")</h1>
- <noscript>#springMessageText("idp.login.duoNoScript", "The Duo service requires JavaScript.")</noscript>
- <script src="$request.getContextPath()$duoScriptPath"></script>
- <iframe id="duo_iframe"
- data-host="$duoHost"
- data-sig-request="$duoRequest"
- data-post-action="$flowExecutionUrl"
- frameborder="0"
- >
- </iframe>
- <form id="duo_form" method="post">
- #parse("csrf/csrf.vm")
- <input type="hidden" name="_eventId" value="proceed" />
- </form>
-
- <p><a class="button button--secondary" href="$flowExecutionUrl&_eventId=cancel#parse("csrf/csrf-qparam.vm")">#springMessageText("idp.login.duoCancel", "Cancel this Request")</a></p>
- <ul>
- <li><a href="#springMessageText("idp.url.helpdesk", '#')"><span class="item-marker">›</span> #springMessageText("idp.login.needHelp", "Need Help?")</a></li>
- </ul>
- </section>
- </main>
- <footer class="footer">
- <div class="cc">
- <p>#springMessageText("idp.footer", "Insert your footer text here.")</p>
- </div>
- </footer>
- </body>
-</html>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list