[java-idp-plugin-duo] branch dev/JDUO-80 updated: Fixed some bugs, add error detection to view.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch dev/JDUO-80
in repository java-idp-plugin-duo.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=c88a8e4a335ef29cbfe06579c8cdf67b0c1d3acb

The following commit(s) were added to refs/heads/dev/JDUO-80 by this push:
     new c88a8e4a Fixed some bugs, add error detection to view.
c88a8e4a is described below

commit c88a8e4a335ef29cbfe06579c8cdf67b0c1d3acb
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jan 2 14:30:18 2024 -0500

    Fixed some bugs, add error detection to view.
---
 .../idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml           | 10 +++++-----
 .../shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml |  2 +-
 .../idp/plugin/authn/duo/nimbus/views/passwordless.vm          | 10 +++++++++-
 3 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
index 7e0f6023..53be41d4 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
@@ -35,9 +35,9 @@
     <bean id="shibboleth.authn.DuoOIDC.Passwordless.DuoIntegration" lazy-init="false"
         class="net.shibboleth.idp.plugin.authn.duo.DefaultDuoOIDCIntegration"
         p:passwordless="true"
-        p:APIHost="%{idp.duo.oidc.passwordless.apiHost:%{idp.duo.oidc.apiHost:none}}"
-        p:clientId="%{idp.duo.oidc.passwordless.clientId:%{idp.duo.oidc.clientId:none}}"
-        p:secretKey="%{idp.duo.oidc.passwordless.secretKey:%{idp.duo.oidc.secretKey:none}}"
+        p:APIHost="%{idp.duo.oidc.passwordless.apiHost:none}"
+        p:clientId="%{idp.duo.oidc.passwordless.clientId:none}"
+        p:secretKey="%{idp.duo.oidc.passwordless.secretKey:none}"
         p:registeredRedirectURI="%{idp.duo.oidc.passwordless.redirectURL:%{idp.duo.oidc.redirectURL:}}"
         p:healthCheckEndpoint="%{idp.duo.oidc.passwordless.endpoint.health:%{idp.duo.oidc.endpoint.health:/oauth/v1/health_check}}"
         p:tokenEndpoint="%{idp.duo.oidc.passwordless.endpoint.token:%{idp.duo.oidc.endpoint.token:/oauth/v1/token}}"
@@ -45,7 +45,7 @@
         p:allowedOrigins="%{idp.duo.oidc.passwordless.redirecturl.allowedOrigins:%{idp.duo.oidc.redirecturl.allowedOrigins:}}"
         p:allowedFactors="#{{ 'Platform authenticator (2fa)', 'Roaming authenticator (2fa)' }}" />
     <bean id="shibboleth.authn.DuoOIDC.Passwordless.DuoIntegrationStrategy" parent="shibboleth.Functions.Constant"
-        c:target="#{getObject('shibboleth.authn.DuoOIDC.PasswordlessDuoIntegration')}" />
+        c:target="#{getObject('shibboleth.authn.DuoOIDC.Passwordless.DuoIntegration')}" />
 
     <!-- Default "optional" non-browser integration. -->
     <bean id="shibboleth.authn.DuoOIDC.NonBrowser.DuoIntegration" lazy-init="false"
@@ -119,7 +119,7 @@
         p:dataSealer="#{'%{idp.authn.usernameCookieName:}'.trim().isEmpty() ? null : getObject('shibboleth.DataSealer')}"
         p:cookieManager="#{'%{idp.authn.usernameCookieName:}'.trim().isEmpty() ? null : getObject('shibboleth.PersistentCookieManager')}"
         p:cookieName="%{idp.authn.usernameCookieName:}"
-        p:usernameFieldName="#{%{idp.authn.DuoOIDC.usernameFieldName:j_username}'.trim()}"
+        p:usernameFieldName="#{'%{idp.authn.DuoOIDC.usernameFieldName:j_username}'.trim()}"
         p:checkSession="%{idp.authn.DuoOIDC.usernameFromSession:false}"
         p:lowercase="%{idp.authn.DuoOIDC.lowercase:false}"
         p:uppercase="%{idp.authn.DuoOIDC.uppercase:false}"
diff --git a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml
index bd57d8e1..2df555c6 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml
@@ -24,7 +24,7 @@
     </action-state>
     
     <decision-state id="CheckForPasswordless">
-        <if test="opensamlProfileRequestContext.containsSubcontext(T(net.shibboleth.idp.plugin.authn.duo.context.DuoPasswordlessContext))"
+        <if test="opensamlProfileRequestContext.ensureSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).containsSubcontext(T(net.shibboleth.idp.plugin.authn.duo.context.DuoPasswordlessContext))"
             then="CheckPasswordlessEnrollment1"
             else="CheckDuoOIDCAuthAPI" />
     </decision-state>
diff --git a/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/views/passwordless.vm b/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/views/passwordless.vm
index 13c35e05..c981e667 100644
--- a/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/views/passwordless.vm
+++ b/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/views/passwordless.vm
@@ -19,6 +19,10 @@
 ##
 #set ($rpContext = $profileRequestContext.getSubcontext('net.shibboleth.profile.context.RelyingPartyContext'))
 #set ($username = $passwordlessContext.getUsername())
+#set ($eventCtx = $profileRequestContext.getSubcontext('org.opensaml.profile.context.EventContext'))
+#if ($eventCtx)
+#set ($eventId = $eventCtx.getEvent())
+#end
 ##
 <!DOCTYPE html>
 <html>
@@ -63,7 +67,11 @@
                     #if ($desc)
                         <p>$encoder.encodeForHTML($desc)</p>
                     #end
-                            
+                    
+                    #if ($eventId == "RequestUnsupported")
+                        <p class="output-message output--error">$encoder.encodeForHTML("#springMessageText('idp.duo.passwordless.unsupported', 'You have not enrolled a qualifying device for Passwordless use.')")</p>
+                    #end
+                        
                     <label for="username">#springMessageText("idp.login.username", "Username")</label>
                     <input id="username" name="j_username" type="text"
                         value="#if($username)$encoder.encodeForHTML($username)#end" />

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.