[java-idp-plugin-duo] branch main updated: JDUO-80 - Use of Duo as a passwordless solution
Scott Cantor
cantor.2 at osu.edu
Tue Apr 16 14:44:55 UTC 2024
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-plugin-duo.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=808376b72d3265afab0c2390198bec5a2b245acb
The following commit(s) were added to refs/heads/main by this push:
new 808376b7 JDUO-80 - Use of Duo as a passwordless solution
808376b7 is described below
commit 808376b72d3265afab0c2390198bec5a2b245acb
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Apr 16 10:44:52 2024 -0400
JDUO-80 - Use of Duo as a passwordless solution
https://shibboleth.atlassian.net/browse/JDUO-80
Clean up cookie handling in post-validate action.
Allow for opt-in prompt for passwordless cases.
Add option controlling cookie username mismatch handling.
---
.../impl/PostValidatePasswordlessEvaluation.java | 69 +++++++++++++---------
.../flows/authn/DuoOIDC/duo-oidc-authn-beans.xml | 3 +-
2 files changed, 43 insertions(+), 29 deletions(-)
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/PostValidatePasswordlessEvaluation.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/PostValidatePasswordlessEvaluation.java
index ed7c64fc..6dfcca55 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/PostValidatePasswordlessEvaluation.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/PostValidatePasswordlessEvaluation.java
@@ -89,6 +89,9 @@ public class PostValidatePasswordlessEvaluation extends AbstractAuthenticationAc
/** Whether to require the authentication be cacheable to allow this. */
private boolean requireResultCacheable;
+ /** Whether to detect mismatches between cookie and current username. */
+ private boolean detectUsernameMismatch;
+
/** Cookie manager to use. */
@NonnullAfterInit private PasswordlessCookieManager cookieManager;
@@ -99,6 +102,7 @@ public class PostValidatePasswordlessEvaluation extends AbstractAuthenticationAc
public PostValidatePasswordlessEvaluation() {
passwordlessCondition = PredicateSupport.alwaysFalse();
requireResultCacheable = true;
+ detectUsernameMismatch = true;
}
/**
@@ -134,6 +138,19 @@ public class PostValidatePasswordlessEvaluation extends AbstractAuthenticationAc
checkSetterPreconditions();
requireResultCacheable = flag;
}
+
+ /**
+ * Sets whether to detect a mismatch between the passwordless cookie and the current username.
+ *
+ * <p>Defaults to true. When detected, a mismatch clears the existing cookoie and proceeds as
+ * though it were absent.</p>
+ *
+ * @param flag flag to set
+ */
+ public void setDetectUsernameMismatch(final boolean flag) {
+ checkSetterPreconditions();
+ detectUsernameMismatch = flag;
+ }
/**
* Sets {@link PasswordlessCookieManager} to use.
@@ -194,39 +211,35 @@ public class PostValidatePasswordlessEvaluation extends AbstractAuthenticationAc
if (!authenticationContext.isResultCacheable() && requireResultCacheable) {
log.debug("{} Non-cacheable authentication, clearing guard cookie if set", getLogPrefix());
cookieManager.clearCookie();
- } else if (integration.isPasswordless()) {
- log.debug("{} Refreshing passwordless cookie for '{}' if set", getLogPrefix(), username);
- if (!cookieManager.refreshCookie()) {
- log.warn("{} Unable to refresh passwordless cookie for '{}'", getLogPrefix(), username);
- }
+ return;
} else if (cookieManager.isOptOut()) {
log.debug("{} Opt-out cookie found, skipping prompt for '{}'", getLogPrefix(), username);
return;
- } else {
- // Read in existing cookie, if any.
- final String cookie = cookieManager.readCookie();
- if (cookie != null) {
- if (username.equals(cookie)) {
- log.debug("{} Refreshing passwordless cookie for '{}' if set", getLogPrefix(), username);
- if (!cookieManager.refreshCookie()) {
- log.warn("{} Unable to refresh passwordless cookie for '{}'", getLogPrefix(), username);
- }
- return;
- } else {
- // Clear the existing cookie to start fresh.
- log.info("{} Clearing existing guard cookie for original username '{}'", getLogPrefix(),
- cookie);
- cookieManager.clearCookie();
+ }
+
+ // Read in existing cookie, if any.
+ final String cookie = cookieManager.readCookie();
+ if (cookie != null) {
+ if (username.equals(cookie)) {
+ log.debug("{} Refreshing passwordless cookie for '{}' if set", getLogPrefix(), username);
+ if (!cookieManager.refreshCookie()) {
+ log.warn("{} Unable to refresh passwordless cookie for '{}'", getLogPrefix(), username);
}
+ return;
+ } else if (detectUsernameMismatch) {
+ // Clear the existing cookie to start fresh.
+ log.info("{} Clearing existing guard cookie for original username '{}'", getLogPrefix(),
+ cookie);
+ cookieManager.clearCookie();
}
-
- // This is a new user without an existing cookie set, so establish eligibility.
- if (passwordlessCondition.test(profileRequestContext)) {
- log.info("{} User '{}' eligible for passwordless, advancing to opt-in view", getLogPrefix(), username);
- ActionSupport.buildEvent(profileRequestContext, PROMPT_USER_EVENT);
- } else {
- log.debug("{} User '{}' not eligible for passwordless", getLogPrefix(), username);
- }
+ }
+
+ // This is a new user without an existing cookie set, so establish eligibility.
+ if (passwordlessCondition.test(profileRequestContext)) {
+ log.info("{} User '{}' eligible for passwordless, advancing to opt-in view", getLogPrefix(), username);
+ ActionSupport.buildEvent(profileRequestContext, PROMPT_USER_EVENT);
+ } else {
+ log.debug("{} User '{}' not eligible for passwordless", getLogPrefix(), username);
}
}
// Checkstyle: CyclomaticComplexity ON
diff --git a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
index db19be6a..9fe32667 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
@@ -310,7 +310,8 @@
p:passwordlessCondition-ref="#{%{idp.duo.oidc.passwordless.enabled:false} ? '%{idp.duo.oidc.passwordless.guardCondition:shibboleth.authn.DuoOIDC.Passwordless.DefaultCondition}'.trim() : 'shibboleth.Conditions.FALSE'}"
p:cookieManager-ref="shibboleth.PasswordlessCookieManager"
p:cleanupHook="#{getObject('shibboleth.authn.DuoOIDC.CleanUpHook') ?: getObject('shibboleth.authn.DuoOIDC.DefaultCleanupHook')}"
- p:requireResultCacheable="%{idp.duo.oidc.passwordless.requireResultCacheable:true}" />
+ p:requireResultCacheable="%{idp.duo.oidc.passwordless.requireResultCacheable:true}"
+ p:detectUsernameMismatch="%{idp.duo.oidc.passwordless.detectUsernameMismatch:true}" />
<!-- Audit logging beans -->
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list