[java-idp-plugin-duo] branch main updated: JDUO-99 - Update WebSDK to add AMR claim to Duo's WebSDK models
Codeberg
noreply at shibboleth.net
Wed Jul 15 10:25:59 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-idp-plugin-duo.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-duo/commit/6d52803f5f6845e5e1103c1680cd85052f47cc5d
The following commit(s) were added to refs/heads/main by this push:
new 6d52803f JDUO-99 - Update WebSDK to add AMR claim to Duo's WebSDK models
6d52803f is described below
commit 6d52803f5f6845e5e1103c1680cd85052f47cc5d
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Jul 15 11:25:50 2026 +0100
JDUO-99 - Update WebSDK to add AMR claim to Duo's WebSDK models
- Add some basic tests for retrieving the id_token via the Duo SDK.
https://shibboleth.atlassian.net/browse/JDUO-99
---
.../authn/duo/sdk/impl/DuoSDKClientAdaptor.java | 16 +++
.../duo/sdk/impl/DuoSDKClientAdaptorTest.java | 123 +++++++++++++++++++++
2 files changed, 139 insertions(+)
diff --git a/idp-duo-sdk-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/sdk/impl/DuoSDKClientAdaptor.java b/idp-duo-sdk-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/sdk/impl/DuoSDKClientAdaptor.java
index 49a66e58..69fc24c8 100644
--- a/idp-duo-sdk-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/sdk/impl/DuoSDKClientAdaptor.java
+++ b/idp-duo-sdk-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/sdk/impl/DuoSDKClientAdaptor.java
@@ -166,6 +166,22 @@ public final class DuoSDKClientAdaptor extends AbstractDuoOIDCClient{
}
}
+
+ /**
+ *
+ * Package-private constructor used primarily for testing. Uses the injected Duo client.
+ *
+ * @param injectedClient the Duo client to use in this adaptor.
+ * @param integration the Duo integration to store off.
+ *
+ */
+ DuoSDKClientAdaptor(@Nonnull final Client injectedClient, @Nonnull final DuoOIDCIntegration integration) {
+ super();
+ duoIntegration = Constraint.isNotNull(integration,"Duo SDK Client requires a non-null Duo Integration");
+ healthCheckResponseConverter = new DefaultHealthCheckResponseConverter();
+ tokenResponseConverter = new DefaultTokenResponseConverter();
+ client = injectedClient;
+ }
/** {@inheritDoc} */
diff --git a/idp-duo-sdk-client-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/sdk/impl/DuoSDKClientAdaptorTest.java b/idp-duo-sdk-client-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/sdk/impl/DuoSDKClientAdaptorTest.java
new file mode 100644
index 00000000..11b27868
--- /dev/null
+++ b/idp-duo-sdk-client-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/sdk/impl/DuoSDKClientAdaptorTest.java
@@ -0,0 +1,123 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.duo.sdk.impl;
+
+import static org.mockito.Mockito.when;
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
+import static org.testng.Assert.assertTrue;
+import static org.testng.Assert.fail;
+
+import java.text.ParseException;
+import java.time.Instant;
+import java.util.List;
+import java.util.Set;
+
+import org.mockito.Mockito;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.duosecurity.Client;
+import com.duosecurity.exception.DuoException;
+import com.duosecurity.model.Token;
+import com.nimbusds.jwt.JWT;
+import com.nimbusds.jwt.JWTClaimsSet;
+
+import net.shibboleth.idp.plugin.authn.duo.DefaultDuoOIDCIntegration;
+import net.shibboleth.idp.plugin.authn.duo.DuoClientException;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.component.ComponentInitializationException;
+
+/**
+ * Tests for the {@link DuoSDKClientAdaptor}.
+ */
+public class DuoSDKClientAdaptorTest {
+
+ private DuoSDKClientAdaptor adaptor;
+
+ /** The mocked Duo client.*/
+ private Client client;
+
+ /**
+ * Setup.
+ *
+ * @throws Exception on error.
+ */
+ @BeforeMethod
+ public void setUp() throws Exception {
+ final DefaultDuoOIDCIntegration integration = new DefaultDuoOIDCIntegration();
+ integration.setAPIHost("host.com");
+ integration.setAuthorizeEndpoint("/authorize");
+ integration.setClientId("DIisismyclientidofco");
+ integration.setSecretKey("thissecretmustbefourtycharacterssopadits");
+ integration.setTokenEndpoint("/token");
+ integration.setRedirectURIIfAbsent("https://host.com/callback");
+ integration.setHealthCheckEndpoint("/health");
+ integration.setAllowedOrigins(Set.of("https://host.com"));
+ try {
+ integration.initialize();
+ } catch (final ComponentInitializationException e) {
+ fail(e.getMessage());
+ }
+ client = Mockito.mock(Client.class);
+ adaptor = new DuoSDKClientAdaptor(client, integration);
+ }
+
+ @Test
+ public void testExchangeAuthorizationCodeFor2FAResult() throws DuoClientException, DuoException, ParseException {
+
+ final Token duoToken = new Token();
+ duoToken.setIss("https://api.duosecurity.com/oauth/v1/token");
+ duoToken.setSub("jdoe");
+ duoToken.setAud("audience");
+ duoToken.setIat((double)Instant.now().getEpochSecond());
+ duoToken.setExp((int) Instant.now().plusSeconds(10).getEpochSecond());
+ when(client.exchangeAuthorizationCodeFor2FAResult("code", "jdoe")).thenReturn(duoToken);
+
+ final JWT token = adaptor.exchangeAuthorizationCodeFor2FAResult("code", "jdoe", null);
+ final JWTClaimsSet claims = token.getJWTClaimsSet();
+ assertEquals(claims.getIssuer(), "https://api.duosecurity.com/oauth/v1/token");
+ assertEquals(claims.getSubject(), "jdoe");
+ assertTrue(claims.getAudience().stream().anyMatch("audience"::equals));
+ }
+
+ @Test
+ public void testExchangeAuthorizationCodeFor2FAResult_WithAMR() throws DuoClientException, DuoException, ParseException {
+
+ final Token duoToken = new Token();
+ duoToken.setIss("https://api.duosecurity.com/oauth/v1/token");
+ duoToken.setSub("jdoe");
+ duoToken.setAud("audience");
+ duoToken.setIat((double)Instant.now().getEpochSecond());
+ duoToken.setExp((int) Instant.now().plusSeconds(10).getEpochSecond());
+ duoToken.setAmr(CollectionSupport.listOf("mfa","otp")); // taken from https://www.rfc-editor.org/info/rfc8176/
+
+ when(client.exchangeAuthorizationCodeFor2FAResult("code", "jdoe")).thenReturn(duoToken);
+
+ final JWT token = adaptor.exchangeAuthorizationCodeFor2FAResult("code", "jdoe", null);
+ final JWTClaimsSet claims = token.getJWTClaimsSet();
+ assertEquals(claims.getIssuer(), "https://api.duosecurity.com/oauth/v1/token");
+ assertEquals(claims.getSubject(), "jdoe");
+ assertTrue(claims.getAudience().stream().anyMatch("audience"::equals));
+ final Object amrObject = claims.getClaim("amr");
+ assertNotNull(amrObject);
+ assertTrue(amrObject instanceof List<?>);
+ final List<?> amrs = (List<?>) amrObject;
+ assertTrue(amrs.contains("mfa"));
+ assertTrue(amrs.contains("otp"));
+ }
+
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list