[java-idp-plugin-duo] branch main updated: JDUO-80 - Use of Duo as a Passwordless solution
Scott Cantor
cantor.2 at osu.edu
Thu Apr 11 12:59:28 UTC 2024
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-plugin-duo.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=ab953f74ffe82e38df49d1ba6e79619f58880d1b
The following commit(s) were added to refs/heads/main by this push:
new ab953f74 JDUO-80 - Use of Duo as a Passwordless solution
ab953f74 is described below
commit ab953f74ffe82e38df49d1ba6e79619f58880d1b
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Apr 11 08:59:25 2024 -0400
JDUO-80 - Use of Duo as a Passwordless solution
https://shibboleth.atlassian.net/browse/JDUO-80
Set up inherited CookieManager to allow max-age to be overridden.
---
.../idp/plugin/authn/duo/PasswordlessCookieManager.java | 15 +++------------
.../plugin/authn/duo/impl/CreatePasswordlessCookie.java | 16 ++--------------
.../duo/impl/PostValidatePasswordlessEvaluation.java | 4 ++--
.../resources/META-INF/net.shibboleth.idp/postconfig.xml | 11 +++++++----
4 files changed, 14 insertions(+), 32 deletions(-)
diff --git a/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/PasswordlessCookieManager.java b/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/PasswordlessCookieManager.java
index 999559a6..337d264c 100644
--- a/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/PasswordlessCookieManager.java
+++ b/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/PasswordlessCookieManager.java
@@ -165,15 +165,11 @@ public class PasswordlessCookieManager extends AbstractInitializableComponent {
/**
* Creates a fresh cookie for a given username (or a placeholder if null to indicate the negative).
*
- * <p>TODO: Notably the second parameter is currently unimplemented until a version of the plugin with the correct
- * API dependency is released.</p>
- *
* @param username username or null
- * @param maxAge lifetime of the cookie
*
* @return true iff the operation succeeded
*/
- public boolean writeCookie(@Nullable final String username, final int maxAge) {
+ public boolean writeCookie(@Nullable final String username) {
checkComponentActive();
if (!active) {
@@ -206,14 +202,9 @@ public class PasswordlessCookieManager extends AbstractInitializableComponent {
* For a non-negative cookie, this recreates the cookie using the current default key to ensure it can
* continue to be read.
*
- * <p>TODO: Notably the second parameter is currently unimplemented until a version of the plugin with the correct
- * API dependency is released.</p>
- *
- * @param maxAge lifetime of the cookie
- *
* @return true iff the operation succeeded
*/
- public boolean refreshCookie(final int maxAge) {
+ public boolean refreshCookie() {
checkComponentActive();
if (!active) {
@@ -222,7 +213,7 @@ public class PasswordlessCookieManager extends AbstractInitializableComponent {
final String username = readCookie();
if (username != null) {
- return writeCookie(username, maxAge);
+ return writeCookie(username);
}
return true;
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/CreatePasswordlessCookie.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/CreatePasswordlessCookie.java
index 364e0914..00e966a0 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/CreatePasswordlessCookie.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/CreatePasswordlessCookie.java
@@ -61,18 +61,6 @@ public class CreatePasswordlessCookie extends AbstractProfileAction {
/** Optional cookie manager to use. */
@NonnullAfterInit private PasswordlessCookieManager cookieManager;
- /** Max-Age of opt-in cookie. */
- private int optInMaxAge;
-
- /** Max-Age of opt-out cookie. */
- private int optOutMaxAge;
-
- /** Constructor. */
- public CreatePasswordlessCookie() {
- optInMaxAge = 0;
- optOutMaxAge = 0;
- }
-
/**
* Sets {@link PasswordlessCookieManager} to use.
*
@@ -107,7 +95,7 @@ public class CreatePasswordlessCookie extends AbstractProfileAction {
}
if (!"1".equals(optin)) {
- if (!cookieManager.writeCookie(null, optOutMaxAge)) {
+ if (!cookieManager.writeCookie(null)) {
log.warn("{} Failed to create passwordless cookie for opt-out", getLogPrefix());
}
return;
@@ -123,7 +111,7 @@ public class CreatePasswordlessCookie extends AbstractProfileAction {
}
log.debug("{} Creating passwordless cookie for username '{}'", getLogPrefix(), username);
- if (!cookieManager.writeCookie(username, optInMaxAge)) {
+ if (!cookieManager.writeCookie(username)) {
log.warn("{} Failed to create passwordless cookie for username '{}'", getLogPrefix(), username);
}
}
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/PostValidatePasswordlessEvaluation.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/PostValidatePasswordlessEvaluation.java
index 3bdeb37b..ed7c64fc 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/PostValidatePasswordlessEvaluation.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/PostValidatePasswordlessEvaluation.java
@@ -196,7 +196,7 @@ public class PostValidatePasswordlessEvaluation extends AbstractAuthenticationAc
cookieManager.clearCookie();
} else if (integration.isPasswordless()) {
log.debug("{} Refreshing passwordless cookie for '{}' if set", getLogPrefix(), username);
- if (!cookieManager.refreshCookie(0)) {
+ if (!cookieManager.refreshCookie()) {
log.warn("{} Unable to refresh passwordless cookie for '{}'", getLogPrefix(), username);
}
} else if (cookieManager.isOptOut()) {
@@ -208,7 +208,7 @@ public class PostValidatePasswordlessEvaluation extends AbstractAuthenticationAc
if (cookie != null) {
if (username.equals(cookie)) {
log.debug("{} Refreshing passwordless cookie for '{}' if set", getLogPrefix(), username);
- if (!cookieManager.refreshCookie(0)) {
+ if (!cookieManager.refreshCookie()) {
log.warn("{} Unable to refresh passwordless cookie for '{}'", getLogPrefix(), username);
}
return;
diff --git a/idp-duo-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-duo-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 63d73ba9..fb8ce364 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -54,10 +54,13 @@
<!-- Management bean allowing control over opt-in/opt-out cookie for Passwordless. -->
<bean id="shibboleth.PasswordlessCookieManager" lazy-init="true"
- class="net.shibboleth.idp.plugin.authn.duo.PasswordlessCookieManager"
- p:dataSealer="#{%{idp.duo.oidc.passwordless.enabled:false} ? getObject('shibboleth.DataSealer') : null}"
- p:cookieManager="#{%{idp.duo.oidc.passwordless.enabled:false} ? getObject('shibboleth.PersistentCookieManager') : null}"
- p:cookieName="%{idp.duo.oidc.passwordless.guardCookieName:__Host-shib_idp_duo_passwordless}" />
+ class="net.shibboleth.idp.plugin.authn.duo.PasswordlessCookieManager"
+ p:dataSealer="#{%{idp.duo.oidc.passwordless.enabled:false} ? getObject('shibboleth.DataSealer') : null}"
+ p:cookieName="%{idp.duo.oidc.passwordless.guardCookieName:__Host-shib_idp_duo_passwordless}">
+ <property name="cookieManager">
+ <bean parent="shibboleth.PersistentCookieManager" p:maxAge="%{idp.duo.oidc.passwordless.maxAge:%{idp.cookie.maxAge:31536000}}" />
+ </property>
+ </bean>
<!-- Default Duo Admin API Integration for IdP-wide use. -->
<bean id="shibboleth.authn.DuoOIDC.Admin.DuoIntegration" lazy-init="true"
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list