[java-idp-plugin-duo] branch main updated: JDUO-80 - Use of Duo as a Passwordless solution
Scott Cantor
cantor.2 at osu.edu
Mon Apr 8 13:30:02 UTC 2024
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-plugin-duo.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=eb0c7a76a76d5ddf16e9f91885ac1193fad5de4c
The following commit(s) were added to refs/heads/main by this push:
new eb0c7a76 JDUO-80 - Use of Duo as a Passwordless solution
eb0c7a76 is described below
commit eb0c7a76a76d5ddf16e9f91885ac1193fad5de4c
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Apr 8 09:29:59 2024 -0400
JDUO-80 - Use of Duo as a Passwordless solution
https://shibboleth.atlassian.net/browse/JDUO-80
Add a "not you?" link to view to clear cookie.
Simplify view a bit.
---
.../authn/duo/impl/ClearPasswordlessCookie.java | 100 +++++++++++++++++++++
.../flows/authn/DuoOIDC/duo-oidc-authn-beans.xml | 5 ++
.../flows/authn/DuoOIDC/duo-oidc-authn-flow.xml | 8 ++
.../idp/plugin/authn/duo/messages.properties | 5 +-
.../idp/plugin/authn/duo/views/passwordless.vm | 6 +-
5 files changed, 117 insertions(+), 7 deletions(-)
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ClearPasswordlessCookie.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ClearPasswordlessCookie.java
new file mode 100644
index 00000000..dc8eaaa1
--- /dev/null
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ClearPasswordlessCookie.java
@@ -0,0 +1,100 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.duo.impl;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.action.ActionSupport;
+import org.opensaml.profile.action.EventIds;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+
+import net.shibboleth.idp.authn.AuthnEventIds;
+import net.shibboleth.idp.profile.AbstractProfileAction;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.net.CookieManager;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.primitive.StringSupport;
+
+/**
+ * A profile action to clear the passwordless guard cookie.
+ *
+ * @since 2.1.0
+ *
+ * @event {@link EventIds#PROCEED_EVENT_ID}
+ * @event {@link EventIds#INVALID_PROFILE_CTX}
+ */
+public class ClearPasswordlessCookie extends AbstractProfileAction {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(ClearPasswordlessCookie.class);
+
+ /** Passwordless cookie name. */
+ @NonnullBeforeExec @NotEmpty private String cookieName;
+
+ /** Optional cookie manager to use. */
+ @NonnullBeforeExec private CookieManager cookieManager;
+
+ /**
+ * Set cookie name to use for "authorizing" passwordless use.
+ *
+ * @param name cookie name
+ */
+ public void setCookieName(@Nullable final String name) {
+ checkSetterPreconditions();
+
+ cookieName = StringSupport.trimOrNull(name);
+ }
+
+ /**
+ * Sets optional {@link CookieManager} to use.
+ *
+ * @param manager cookie manager
+ */
+ public void setCookieManager(@Nullable final CookieManager manager) {
+ checkSetterPreconditions();
+
+ cookieManager = manager;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ if (!super.doPreExecute(profileRequestContext)) {
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.REQUEST_UNSUPPORTED);
+ return false;
+ }
+
+ if (cookieName == null || cookieManager == null) {
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.REQUEST_UNSUPPORTED);
+ return false;
+ }
+
+ return true;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+
+ log.debug("{} Clearing passwordless guard cookie at user instruction", getLogPrefix());
+
+ assert cookieName != null;
+ cookieManager.unsetCookie(cookieName);
+ }
+
+}
\ No newline at end of file
diff --git a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
index b2c3f549..31c619a4 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
@@ -160,6 +160,11 @@
p:dataSealer="#{%{idp.duo.oidc.passwordless.enabled:false} ? getObject('shibboleth.DataSealer') : null}"
p:cookieManager="#{%{idp.duo.oidc.passwordless.enabled:false} ? getObject('shibboleth.PersistentCookieManager') : null}"
p:cookieName="%{idp.duo.oidc.passwordless.guardCookieName:__Host-shib_idp_duo_passwordless}" />
+
+ <bean id="ClearPasswordlessCookie" scope="prototype"
+ class="net.shibboleth.idp.plugin.authn.duo.impl.ClearPasswordlessCookie"
+ p:cookieManager="#{%{idp.duo.oidc.passwordless.enabled:false} ? getObject('shibboleth.PersistentCookieManager') : null}"
+ p:cookieName="%{idp.duo.oidc.passwordless.guardCookieName:__Host-shib_idp_duo_passwordless}" />
<!-- Duo OIDC beans -->
<bean id="PopulateDuoAuthenticationContext" scope="prototype"
diff --git a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml
index 35332df7..1ed4db5c 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml
@@ -39,6 +39,7 @@
</on-render>
<transition on="proceed" to="CheckDuoOIDCAuthAPI" />
+ <transition on="clear" to="ClearPasswordlessCookie" />
<transition on="cancel" to="RequestUnsupported" />
<on-exit>
@@ -46,6 +47,13 @@
</on-exit>
</view-state>
+ <action-state id="ClearPasswordlessCookie">
+ <evaluate expression="ClearPasswordlessCookie" />
+ <evaluate expression="'proceed'" />
+
+ <transition on="proceed" to="RequestUnsupported" />
+ </action-state>
+
<action-state id="ExtractDuoAuthenticationFromHeaders">
<evaluate expression="ExtractDuoAuthenticationFromHeaders" />
<evaluate expression="'proceed'" />
diff --git a/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/messages.properties b/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/messages.properties
index 9262969a..b97030f7 100644
--- a/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/messages.properties
+++ b/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/messages.properties
@@ -7,12 +7,9 @@
# so administrators can locally override or supplement the values
# in their own message files.
-
-idp.duo.passwordless.explain = If this isn't you, or you wish to bypass the option \
- to use a Passkey or device to login, click the 'Login with Password' button.
-
idp.duo.passwordless.proceed = Login with Passkey or Device
idp.duo.passwordless.cancel = Login with Password
+idp.duo.passwordless.notyou = Not You?
idp.duo.enrollment = Enroll New Devices
idp.duo.enrollment.url = #
diff --git a/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/views/passwordless.vm b/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/views/passwordless.vm
index b8f70303..90cc26d7 100644
--- a/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/views/passwordless.vm
+++ b/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/views/passwordless.vm
@@ -64,12 +64,12 @@ $response.addHeader("Content-Security-Policy", "script-src-elem 'nonce-$nonce'")
<form action="$flowExecutionUrl" method="post">
#parse("csrf/csrf.vm")
+
+ <p><a href="$flowExecutionUrl&_eventId_clear=1#parse("csrf/csrf-qparam.vm")"
+ alt="#springMessageText("idp.duo.passwordless.notyou", "Not you?")">#springMessageText("idp.duo.passwordless.notyou", "Not you?")</a></p>
<label for="username">#springMessageText("idp.login.username", "Username")</label>
<input id="unused" name="unused" type="text" readonly="true" value="$encoder.encodeForHTML($username)" />
-
- <p>#springMessageText("idp.duo.passwordless.explain", "If this isn't you, or you wish to bypass the option
- to use a Passkey or device to login, click the 'Login with Password' button.")</p>
<input type="checkbox" name="donotcache" value="1" id="donotcache" />
<label for="donotcache">#springMessageText("idp.login.donotcache", "Don't Remember Login")</label>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list