[java-idp-plugin-duo] branch main updated: Support arbitrary username remapping.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-idp-plugin-duo.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=226ea098611207f24f1b931e159f5f42d9727f5e

The following commit(s) were added to refs/heads/main by this push:
     new 226ea098 Support arbitrary username remapping.
226ea098 is described below

commit 226ea098611207f24f1b931e159f5f42d9727f5e
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Jan 8 13:32:30 2024 -0500

    Support arbitrary username remapping.
---
 .../duo/impl/CheckPasswordlessEnrollment.java      | 30 +++++++++++++++++++---
 .../flows/authn/DuoOIDC/duo-oidc-authn-beans.xml   |  3 ++-
 2 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/CheckPasswordlessEnrollment.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/CheckPasswordlessEnrollment.java
index 84ebb0b4..a0dd09f9 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/CheckPasswordlessEnrollment.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/CheckPasswordlessEnrollment.java
@@ -14,6 +14,7 @@
 
 package net.shibboleth.idp.plugin.authn.duo.impl;
 
+import java.util.function.BiFunction;
 import java.util.function.BiPredicate;
 import java.util.function.Function;
 
@@ -95,6 +96,9 @@ public class CheckPasswordlessEnrollment extends AbstractExtractionAction {
     /** Whether to pull username from existing session or not. */
     private boolean checkSession;
     
+    /** Generic hook for remapping username. */
+    @Nullable private BiFunction<ProfileRequestContext,String,String> duoUsernameRemappingStrategy; 
+    
     /** Context to operate on. */
     @NonnullBeforeExec private DuoPasswordlessContext passwordlessContext;
     
@@ -207,6 +211,19 @@ public class CheckPasswordlessEnrollment extends AbstractExtractionAction {
         checkSession = flag;
     }
 
+    /**
+     * Sets a general hook for remapping username.
+     * 
+     * @param strategy username remapping strategy
+     */
+    public void setDuoUsernameRemappingStrategy(
+            @Nullable final BiFunction<ProfileRequestContext,String,String> strategy) {
+        // TODO: Remove once API moved to 5.1
+        checkSetterPreconditions();
+        
+        duoUsernameRemappingStrategy = strategy;
+    }
+    
     /** {@inheritDoc} */
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@@ -232,7 +249,7 @@ public class CheckPasswordlessEnrollment extends AbstractExtractionAction {
         
         boolean usernameChanged = false;
         
-        String username = getUsernameFromForm(authenticationContext);
+        String username = getUsernameFromForm(profileRequestContext, authenticationContext);
         if (username != null) {
             if (!username.equals(passwordlessContext.getUsername()) ) {
                 log.debug("{} Populating username '{}' from form submission into Duo passwordless context",
@@ -286,11 +303,13 @@ public class CheckPasswordlessEnrollment extends AbstractExtractionAction {
      * 
      * <p>Also processes do-not-cache instruction.</p>
      * 
+     * @param profileRequestContext profile request context
      * @param authenticationContext authentication context
      * 
      * @return submitted username, after applying any configured transforms
      */
-    @Nullable private String getUsernameFromForm(@Nonnull final AuthenticationContext authenticationContext) {
+    @Nullable private String getUsernameFromForm(@Nonnull final ProfileRequestContext profileRequestContext,
+            @Nonnull final AuthenticationContext authenticationContext) {
         
         final HttpServletRequest request = getHttpServletRequest();
         if (request != null) {
@@ -302,7 +321,12 @@ public class CheckPasswordlessEnrollment extends AbstractExtractionAction {
                 authenticationContext.setResultCacheable(true);
             }
 
-            return applyTransforms(request.getParameter(usernameFieldName));
+            // TODO: Convert to 2 parameter version once API moves to 5.1.
+            
+            final String s = applyTransforms(request.getParameter(usernameFieldName));
+            
+            return duoUsernameRemappingStrategy != null
+                    ? duoUsernameRemappingStrategy.apply(profileRequestContext, s) : s;
         }
         
         return null;
diff --git a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
index d5fa518a..522bbd60 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
@@ -158,7 +158,8 @@
         p:lowercase="%{idp.duo.oidc.lowercase:false}"
         p:uppercase="%{idp.duo.oidc.uppercase:false}"
         p:trim="%{idp.duo.oidc.trim:true}"
-        p:transforms="#{getObject('shibboleth.authn.DuoOIDC.Transforms')}" />
+        p:transforms="#{getObject('shibboleth.authn.DuoOIDC.Transforms')}"
+        p:duoUsernameRemappingStrategy="#{getObject('shibboleth.authnn.DuoOIDC.UsernameRemappingStrategy')}" />
     
     <!-- Duo OIDC beans -->
     <bean id="PopulateDuoAuthenticationContext" scope="prototype"

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.