[java-idp-plugin-duo] branch main updated: JDUO-88 - Capture Duo MFA "Device Key" from JWT response

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-idp-plugin-duo.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=b21a74b5600617871614de5e20537e0cea169961

The following commit(s) were added to refs/heads/main by this push:
     new b21a74b5 JDUO-88 - Capture Duo MFA "Device Key" from JWT response
b21a74b5 is described below

commit b21a74b5600617871614de5e20537e0cea169961
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Apr 24 10:59:19 2024 -0400

    JDUO-88 - Capture Duo MFA "Device Key" from JWT response
    
    https://shibboleth.atlassian.net/browse/JDUO-88
---
 .../duo/context/DuoOIDCAuthenticationContext.java  | 28 +++++++++++++++++++++
 .../impl/ValidateDuoTokenAuthenticationResult.java | 29 ++++++++++++----------
 2 files changed, 44 insertions(+), 13 deletions(-)

diff --git a/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/context/DuoOIDCAuthenticationContext.java b/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/context/DuoOIDCAuthenticationContext.java
index a94920eb..f803be32 100644
--- a/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/context/DuoOIDCAuthenticationContext.java
+++ b/idp-duo-api/src/main/java/net/shibboleth/idp/plugin/authn/duo/context/DuoOIDCAuthenticationContext.java
@@ -63,6 +63,9 @@ public final class DuoOIDCAuthenticationContext extends BaseContext {
     /** The factor claim from the token. */
     @Nullable private String factorUsed;
     
+    /** Device key used if available. */
+    @Nullable private String deviceKey;
+    
     /** The Duo OIDC client to use for the lifetime of this authentication request.*/
     @Nullable private DuoOIDCClient client;   
     
@@ -209,6 +212,31 @@ public final class DuoOIDCAuthenticationContext extends BaseContext {
         return factorUsed;
     }
     
+    /**
+     * Set the device key used if available from the token.
+     * 
+     * @param key device key
+     * 
+     * @return this context
+     * 
+     * @since 2.1.0
+     */
+    @Nonnull public DuoOIDCAuthenticationContext setDeviceKey(@Nullable final String key) {
+        deviceKey = key;
+        return this;
+    }
+    
+    /**
+     * Get the device key used if available from the token.
+     * 
+     * @return factor claim
+     * 
+     * @since 2.1.0
+     */
+    @Nullable public String getDeviceKey() {
+        return deviceKey;
+    }    
+    
     /**
      * Get the request state.
      * 
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
index 0bdef6ec..7c7d71ea 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/ValidateDuoTokenAuthenticationResult.java
@@ -180,7 +180,6 @@ public class ValidateDuoTokenAuthenticationResult extends AbstractAuditingValida
         
         return true;
     }
-
     
     /** {@inheritDoc} */
     @Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@@ -208,9 +207,9 @@ public class ValidateDuoTokenAuthenticationResult extends AbstractAuditingValida
                 statusMsgObj instanceof final String authResultStatusMsg) {
             
             if (DuoOIDCAuthAPI.DUO_AUTH_RESULT_ALLOW.equalsIgnoreCase(authResultStatus)){
-                factorUsed = extractFactor();
+                extractClaims();
                 
-                duoContext.setFactorUsed(factorUsed);
+                factorUsed = duoContext.getFactorUsed();
                 
                 // Check if factor is allowed.
                 final Set<String> allowedFactors = duoIntegration.getAllowedFactors();
@@ -256,28 +255,32 @@ public class ValidateDuoTokenAuthenticationResult extends AbstractAuditingValida
     }
     
     /**
-     * Extract the second-factor used for authentication as taken from the auth_context. Will return
-     * {@code null} if not found.
-     * 
-     * @return the second-factor used, or {@code null} if not found. Should always be found.
+     * Extract the second-factor used for authentication as taken from the auth_context and other
+     * details to be stored in the Duo context.
      */
-     @Nullable private String extractFactor() {
+     private void extractClaims() {
         
         try {
             final Map<String, Object> authnContextClaimObj = 
                     claimsSet.getJSONObjectClaim(DuoOIDCAuthAPI.DUO_AUTH_CONTEXT_JSON_OBJECT);
             
             if (authnContextClaimObj != null) {         
-                final Object factorClaimObj = 
-                        authnContextClaimObj.get(DuoOIDCAuthAPI.DUO_AUTH_FACTOR_JSON_OBJECT);
-                if (factorClaimObj instanceof final String factor) {
-                    return factor;
+                final Object factorClaimObj = authnContextClaimObj.get(DuoOIDCAuthAPI.DUO_AUTH_FACTOR_JSON_OBJECT);
+                if (factorClaimObj instanceof String factor) {
+                    duoContext.setFactorUsed(factor);
+                }
+                
+                final Object deviceClaimObj = authnContextClaimObj.get(DuoOIDCAuthAPI.DUO_AUTH_DEVICE_JSON_OBJECT);
+                if (deviceClaimObj instanceof Map<?,?> device) {
+                    final Object keyObj = device.get(DuoOIDCAuthAPI.DUO_AUTH_DEVICE_KEY_JSON_OBJECT);
+                    if (keyObj instanceof String key) {
+                        duoContext.setDeviceKey(key);
+                    }
                 }
             }
         } catch (final ParseException e) {
             // Do nothing, just return null
         }
-        return null;
     }
     
     /** {@inheritDoc} */

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.