[java-idp-plugin-duo] branch main updated: JDUO-80 - Use of Duo as a Passwordless solution

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-idp-plugin-duo.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=90ab83c9dd7cf3728d21b718ee200e2933f52487

The following commit(s) were added to refs/heads/main by this push:
     new 90ab83c9 JDUO-80 - Use of Duo as a Passwordless solution
90ab83c9 is described below

commit 90ab83c9dd7cf3728d21b718ee200e2933f52487
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Mar 1 15:01:45 2024 -0500

    JDUO-80 - Use of Duo as a Passwordless solution
    
    https://shibboleth.atlassian.net/browse/JDUO-80
    
    Fix username clearing logic.
    Adjust wiring to post-form submit the username can only come from form.
---
 .../idp/plugin/authn/duo/impl/CheckPasswordlessEnrollment.java |  9 +++++++--
 .../idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml           | 10 ++++++----
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/CheckPasswordlessEnrollment.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/CheckPasswordlessEnrollment.java
index d54f9068..5fa0a4a8 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/CheckPasswordlessEnrollment.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/CheckPasswordlessEnrollment.java
@@ -329,6 +329,11 @@ public class CheckPasswordlessEnrollment extends AbstractExtractionAction {
             }
         }
         
+        // Clear cookie if required.
+        if (!authenticationContext.isResultCacheable() && cookieManager != null && cookieName != null) {
+            cookieManager.unsetCookie(cookieName);
+        }
+        
         final String finalUsername = passwordlessContext.getUsername(); 
         if (finalUsername == null || finalUsername.isBlank()) {
             passwordlessContext.setUsername(null);
@@ -346,7 +351,7 @@ public class CheckPasswordlessEnrollment extends AbstractExtractionAction {
                     passwordlessContext.isEnrolled() ? "capable" : "incapable");
                 
             // Upodate cookie if needed.
-            manageCookie(authenticationContext);
+            updateCookie(authenticationContext);
         } else {
             log.debug("{} Username not updated, leaving DuoPasswordlessContext unchanged", getLogPrefix());
         }
@@ -381,7 +386,7 @@ public class CheckPasswordlessEnrollment extends AbstractExtractionAction {
      * 
      * @param authenticationContext authentication context
      */
-    private void manageCookie(@Nonnull final AuthenticationContext authenticationContext) {
+    private void updateCookie(@Nonnull final AuthenticationContext authenticationContext) {
         if (passwordlessContext.isEnrolled()) {
             final String localCookieName = cookieName;
             if (authenticationContext.isResultCacheable()) {
diff --git a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
index 281bfd17..af01b991 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
@@ -159,15 +159,17 @@
             p:trim="%{idp.duo.oidc.trim:true}"
             p:transforms="#{getObject('shibboleth.authn.DuoOIDC.Transforms')}"
             p:duoUsernameRemappingStrategy="#{getObject('shibboleth.authnn.DuoOIDC.UsernameRemappingStrategy')}"
-            p:signalEvents="true">
+            p:signalEvents="true"
+            p:precedence="form">
+    </bean>
+    <!-- Same bean as above but property-based enrollment check for first iteration of loop. -->
+    <bean id="CheckPasswordlessEnrollment1" parent="CheckPasswordlessEnrollment2" scope="prototype"
+            p:signalEvents="%{idp.duo.oidc.passwordless.alwaysSignal:false}">
         <property name="precedence">
             <bean parent="shibboleth.CommaDelimStringArray"
                 c:_0="#{'%{idp.authn.usernamePrecedence:form,session,cookie}'.trim()}" />
         </property>
     </bean>
-    <!-- Same bean as above but property-based enrollment check for first iteration of loop. -->
-    <bean id="CheckPasswordlessEnrollment1" parent="CheckPasswordlessEnrollment2" scope="prototype"
-        p:signalEvents="%{idp.duo.oidc.passwordless.alwaysSignal:false}" />
     
     <!-- Duo OIDC beans -->
     <bean id="PopulateDuoAuthenticationContext" scope="prototype"

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.