[java-idp-plugin-duo] branch main updated: JDUO-80 - Use of Duo as a Passwordless solution.
Scott Cantor
cantor.2 at osu.edu
Thu Mar 28 18:11:57 UTC 2024
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-plugin-duo.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=0b3a43add5d7f5b37507f1c37e8244ae948278a7
The following commit(s) were added to refs/heads/main by this push:
new 0b3a43ad JDUO-80 - Use of Duo as a Passwordless solution.
0b3a43ad is described below
commit 0b3a43add5d7f5b37507f1c37e8244ae948278a7
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Mar 28 14:11:55 2024 -0400
JDUO-80 - Use of Duo as a Passwordless solution.
https://shibboleth.atlassian.net/browse/JDUO-80
Guard passwordless usage against passive/non-browser usage.
Relocate non-browser steps to be independent of passwordless option.
---
.../flows/authn/DuoOIDC/duo-oidc-authn-beans.xml | 30 ++++++-------
.../flows/authn/DuoOIDC/duo-oidc-authn-flow.xml | 49 ++++++++++++----------
2 files changed, 43 insertions(+), 36 deletions(-)
diff --git a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
index af01b991..286c8e28 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-beans.xml
@@ -147,21 +147,21 @@
<!-- Passwordless beans -->
<bean id="CheckPasswordlessEnrollment2"
- class="net.shibboleth.idp.plugin.authn.duo.impl.CheckPasswordlessEnrollment" scope="prototype"
- p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier"
- p:passwordlessCondition="#{getObject('shibboleth.authn.DuoOIDC.Passwordless.Condition') ?: getObject('shibboleth.authn.DuoOIDC.Passwordless.DefaultCondition')}"
- p:dataSealer="#{'%{idp.authn.usernameCookieName:}'.trim().isEmpty() ? null : getObject('shibboleth.DataSealer')}"
- p:cookieManager="#{'%{idp.authn.usernameCookieName:}'.trim().isEmpty() ? null : getObject('shibboleth.PersistentCookieManager')}"
- p:cookieName="%{idp.authn.usernameCookieName:}"
- p:usernameFieldName="#{'%{idp.duo.oidc.usernameFieldName:j_username}'.trim()}"
- p:lowercase="%{idp.duo.oidc.lowercase:false}"
- p:uppercase="%{idp.duo.oidc.uppercase:false}"
- p:trim="%{idp.duo.oidc.trim:true}"
- p:transforms="#{getObject('shibboleth.authn.DuoOIDC.Transforms')}"
- p:duoUsernameRemappingStrategy="#{getObject('shibboleth.authnn.DuoOIDC.UsernameRemappingStrategy')}"
- p:signalEvents="true"
- p:precedence="form">
- </bean>
+ class="net.shibboleth.idp.plugin.authn.duo.impl.CheckPasswordlessEnrollment" scope="prototype"
+ p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier"
+ p:passwordlessCondition="#{getObject('shibboleth.authn.DuoOIDC.Passwordless.Condition') ?: getObject('shibboleth.authn.DuoOIDC.Passwordless.DefaultCondition')}"
+ p:dataSealer="#{'%{idp.authn.usernameCookieName:}'.trim().isEmpty() ? null : getObject('shibboleth.DataSealer')}"
+ p:cookieManager="#{'%{idp.authn.usernameCookieName:}'.trim().isEmpty() ? null : getObject('shibboleth.PersistentCookieManager')}"
+ p:cookieName="%{idp.authn.usernameCookieName:}"
+ p:usernameFieldName="#{'%{idp.duo.oidc.usernameFieldName:j_username}'.trim()}"
+ p:lowercase="%{idp.duo.oidc.lowercase:false}"
+ p:uppercase="%{idp.duo.oidc.uppercase:false}"
+ p:trim="%{idp.duo.oidc.trim:true}"
+ p:transforms="#{getObject('shibboleth.authn.DuoOIDC.Transforms')}"
+ p:duoUsernameRemappingStrategy="#{getObject('shibboleth.authnn.DuoOIDC.UsernameRemappingStrategy')}"
+ p:signalEvents="true"
+ p:precedence="form" />
+
<!-- Same bean as above but property-based enrollment check for first iteration of loop. -->
<bean id="CheckPasswordlessEnrollment1" parent="CheckPasswordlessEnrollment2" scope="prototype"
p:signalEvents="%{idp.duo.oidc.passwordless.alwaysSignal:false}">
diff --git a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml
index 981ac8b2..3b17c445 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml
@@ -2,32 +2,20 @@
xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
parent="authn.abstract">
- <!-- This is a login flow for the Duo OIDC Authn API authentication flow -->
+ <!-- This is a login flow for the Duo OIDC authentication flow. -->
- <action-state id="ExtractDuoAuthenticationFromHeaders">
- <evaluate expression="ExtractDuoAuthenticationFromHeaders" />
- <evaluate expression="'proceed'" />
-
- <transition on="proceed" to="ValidateDuoAuthAPI" />
-
- <!-- Fall through to a different flow if header extract fails on a passive or non-browser request. -->
- <transition on="#{ opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).isPassive() || !opensamlProfileRequestContext.isBrowserProfile() }" to="ReselectFlow" />
-
- <transition on="NoCredentials" to="CheckForPasswordless" />
- </action-state>
-
- <action-state id="ValidateDuoAuthAPI">
- <evaluate expression="ValidateDuoAuthAPI" />
- <evaluate expression="'proceed'" />
-
- <transition on="proceed" to="proceed" />
- </action-state>
-
<decision-state id="CheckForPasswordless">
<if test="opensamlProfileRequestContext.ensureSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).containsSubcontext(T(net.shibboleth.idp.plugin.authn.duo.context.DuoPasswordlessContext))"
+ then="IsPasswordlessPossible"
+ else="ExtractDuoAuthenticationFromHeaders" />
+ </decision-state>
+
+ <decision-state id="IsPasswordlessPossible">
+ <if test="!opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).isPassive() and opensamlProfileRequestContext.isBrowserProfile()"
then="CheckPasswordlessEnrollment1"
- else="CheckDuoOIDCAuthAPI" />
+ else="RequestUnsupported" />
</decision-state>
+
<action-state id="CheckPasswordlessEnrollment1">
<evaluate expression="CheckPasswordlessEnrollment1" />
@@ -65,7 +53,26 @@
<transition on="UnknownUsername" to="PasswordlessView" />
<transition on="RequestUnsupported" to="PasswordlessView" />
</action-state>
+
+ <action-state id="ExtractDuoAuthenticationFromHeaders">
+ <evaluate expression="ExtractDuoAuthenticationFromHeaders" />
+ <evaluate expression="'proceed'" />
+
+ <transition on="proceed" to="ValidateDuoAuthAPI" />
+
+ <!-- Fall through to a different flow if header extract fails on a passive or non-browser request. -->
+ <transition on="#{ opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).isPassive() || !opensamlProfileRequestContext.isBrowserProfile() }" to="ReselectFlow" />
+
+ <transition on="NoCredentials" to="CheckDuoOIDCAuthAPI" />
+ </action-state>
+
+ <action-state id="ValidateDuoAuthAPI">
+ <evaluate expression="ValidateDuoAuthAPI" />
+ <evaluate expression="'proceed'" />
+ <transition on="proceed" to="proceed" />
+ </action-state>
+
<action-state id="CheckDuoOIDCAuthAPI">
<evaluate expression="PopulateDuoAuthenticationContext" />
<evaluate expression="HealthCheckDuoOIDCAuthAPI" />
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list