[java-idp-plugin-duo] branch main updated: JDUO-80 - Use of Duo as a passwordless solution
Scott Cantor
cantor.2 at osu.edu
Wed Jan 17 01:16:36 UTC 2024
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-plugin-duo.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=9df13ed78b03a04f72d091622c7109ad8b63b43f
The following commit(s) were added to refs/heads/main by this push:
new 9df13ed7 JDUO-80 - Use of Duo as a passwordless solution
9df13ed7 is described below
commit 9df13ed78b03a04f72d091622c7109ad8b63b43f
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jan 16 20:16:32 2024 -0500
JDUO-80 - Use of Duo as a passwordless solution
https://shibboleth.atlassian.net/browse/JDUO-80
Always run enrollment check to set flag, but conditionally signal event.
---
.../duo/impl/CheckPasswordlessEnrollment.java | 34 ++++++++++------------
.../flows/authn/DuoOIDC/duo-oidc-authn-beans.xml | 2 +-
.../duo/impl/CheckPasswordlessEnrollmentTest.java | 2 ++
.../duo/nimbus/conf/authn/duo-oidc.properties | 4 +--
.../authn/duo/sdk/conf/authn/duo-oidc.properties | 4 +--
5 files changed, 22 insertions(+), 24 deletions(-)
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/CheckPasswordlessEnrollment.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/CheckPasswordlessEnrollment.java
index c8aebbbd..d54f9068 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/CheckPasswordlessEnrollment.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/CheckPasswordlessEnrollment.java
@@ -83,8 +83,8 @@ public class CheckPasswordlessEnrollment extends AbstractExtractionAction {
/** Condition indicating passwordless use is valid. */
@Nonnull private BiPredicate<ProfileRequestContext,String> passwordlessCondition;
- /** Whether to carry out the full enrollment checking step. */
- private boolean checkEnrollment;
+ /** Whether to signal non-proceed events. */
+ private boolean signalEvents;
/** Form parameter name to carry username. */
@Nonnull @NotEmpty private String usernameFieldName;
@@ -116,8 +116,6 @@ public class CheckPasswordlessEnrollment extends AbstractExtractionAction {
new ChildContextLookup<>(DuoPasswordlessContext.class).compose(
new ChildContextLookup<>(AuthenticationContext.class));
- checkEnrollment = true;
-
// TODO: BiPredicateSupport.alwaysTrue once API is bumped.
passwordlessCondition = (a,b) -> {
return true;
@@ -154,16 +152,16 @@ public class CheckPasswordlessEnrollment extends AbstractExtractionAction {
}
/**
- * Sets whether the action should carry out the enrollment check or stop at populating the username field.
+ * Sets whether the action should signal non-proceed events in defined cases, or suppress them.
*
- * <p>Defaults to true.</p>
+ * <p>Defaults to false.</p>
*
* @param flag flag to set
*/
- public void setCheckEnrollment(final boolean flag) {
+ public void setSignalEvents(final boolean flag) {
checkSetterPreconditions();
- checkEnrollment = flag;
+ signalEvents = flag;
}
/**
@@ -335,27 +333,25 @@ public class CheckPasswordlessEnrollment extends AbstractExtractionAction {
if (finalUsername == null || finalUsername.isBlank()) {
passwordlessContext.setUsername(null);
passwordlessContext.setEnrolled(false);
- if (checkEnrollment) {
+ if (signalEvents) {
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.UNKNOWN_USERNAME);
- return;
}
+ return;
}
if (usernameChanged) {
- if (checkEnrollment) {
- passwordlessContext.setEnrolled(
- passwordlessCondition.test(profileRequestContext, finalUsername));
- log.debug("{} Username '{}' found to be {} of passwordless attempt", getLogPrefix(), finalUsername,
- passwordlessContext.isEnrolled() ? "capable" : "incapable");
+ passwordlessContext.setEnrolled(
+ passwordlessCondition.test(profileRequestContext, finalUsername));
+ log.debug("{} Username '{}' found to be {} of passwordless attempt", getLogPrefix(), finalUsername,
+ passwordlessContext.isEnrolled() ? "capable" : "incapable");
- // Upodate cookie if needed.
- manageCookie(authenticationContext);
- }
+ // Upodate cookie if needed.
+ manageCookie(authenticationContext);
} else {
log.debug("{} Username not updated, leaving DuoPasswordlessContext unchanged", getLogPrefix());
}
- if (checkEnrollment && !passwordlessContext.isEnrolled()) {
+ if (signalEvents && !passwordlessContext.isEnrolled()) {
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.REQUEST_UNSUPPORTED);
}
}
diff --git a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
index a1bf28ae..eedb6db3 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
@@ -166,7 +166,7 @@
</bean>
<!-- Same bean as above but property-based enrollment check for first iteration of loop. -->
<bean id="CheckPasswordlessEnrollment1" parent="CheckPasswordlessEnrollment2" scope="prototype"
- p:checkEnrollment="%{idp.duo.oidc.passwordless.checkEnrollmentOnEntry:false}" />
+ p:signalEvents="%{idp.duo.oidc.passwordless.alwaysSignal:false}" />
<!-- Duo OIDC beans -->
<bean id="PopulateDuoAuthenticationContext" scope="prototype"
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/CheckPasswordlessEnrollmentTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/CheckPasswordlessEnrollmentTest.java
index 32f88b2a..1a5eeaa4 100644
--- a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/CheckPasswordlessEnrollmentTest.java
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/CheckPasswordlessEnrollmentTest.java
@@ -110,6 +110,7 @@ public class CheckPasswordlessEnrollmentTest extends AbstractDuoActionTest {
action.setCookieName(COOKIE_NAME);
action.setHttpServletRequestSupplier(new ThreadLocalHttpServletRequestSupplier());
action.setHttpServletResponseSupplier(new ThreadLocalHttpServletResponseSupplier());
+ action.setSignalEvents(true);
action.initialize();
}
@@ -119,6 +120,7 @@ public class CheckPasswordlessEnrollmentTest extends AbstractDuoActionTest {
@Test public void testNoServlet() throws ComponentInitializationException {
action = new CheckPasswordlessEnrollment();
+ action.setSignalEvents(true);
action.initialize();
final Event event = action.execute(src);
diff --git a/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties b/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties
index 760de3c2..05389cae 100644
--- a/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties
+++ b/idp-duo-nimbus-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/nimbus/conf/authn/duo-oidc.properties
@@ -40,8 +40,8 @@ idp.duo.oidc.redirectURL = https://<hostname>:<port>/idp/profile/Authn/Duo/2FA/d
#idp.duo.oidc.passwordless.integrationKey = ikey
# Suggest defining this in credentials/secrets.properties
#idp.duo.oidc.passwordless.secretKey = key
-# Controls whether a cached username is initially run through the check
-#idp.duo.oidc.passwordless.checkEnrollmentOnEntry = false
+# Controls whether to report enrollment check on entry to form
+#idp.duo.oidc.passwordless.alwaysSignal = false
# Non-Browser AuthAPI integration if desired
#idp.duo.oidc.nonbrowser.apiHost = %{idp.duo.oidc.apiHost}
diff --git a/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties b/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties
index 9d9701fb..c05549cf 100644
--- a/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties
+++ b/idp-duo-sdk-client-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/sdk/conf/authn/duo-oidc.properties
@@ -40,8 +40,8 @@ idp.duo.oidc.redirectURL = https://<hostname>:<port>/idp/profile/Authn/Duo/2FA/d
#idp.duo.oidc.passwordless.integrationKey = ikey
# Suggest defining this in credentials/secrets.properties
#idp.duo.oidc.passwordless.secretKey = key
-# Controls whether a cached username is initially run through the check
-#idp.duo.oidc.passwordless.checkEnrollmentOnEntry = false
+# Controls whether to report enrollment check on entry to form
+#idp.duo.oidc.passwordless.alwaysSignal = false
# Non-Browser AuthAPI integration if desired
#idp.duo.oidc.nonbrowser.apiHost = %{idp.duo.oidc.apiHost}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list