[java-idp-plugin-duo] branch main updated: JDUO-99 - Update WebSDK to add AMR claim to Duo's WebSDK models
Codeberg
noreply at shibboleth.net
Thu Jul 16 09:19:37 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-idp-plugin-duo.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-duo/commit/e99775cf14e456a405ebe7d4eee979b0ea408c14
The following commit(s) were added to refs/heads/main by this push:
new e99775cf JDUO-99 - Update WebSDK to add AMR claim to Duo's WebSDK models
e99775cf is described below
commit e99775cf14e456a405ebe7d4eee979b0ea408c14
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Jul 16 10:19:30 2026 +0100
JDUO-99 - Update WebSDK to add AMR claim to Duo's WebSDK models
- Add a configurable mapping strategy to simplify Duo AMR to Principal
mappings.
https://shibboleth.atlassian.net/browse/JDUO-99
---
...nMethodReferenceToPrincipalMappingStrategy.java | 137 +++++++++++++++++++++
.../META-INF/net.shibboleth.idp/postconfig.xml | 3 +
...hodReferenceToPrincipalMappingStrategyTest.java | 132 ++++++++++++++++++++
3 files changed, 272 insertions(+)
diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/AuthnMethodReferenceToPrincipalMappingStrategy.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/AuthnMethodReferenceToPrincipalMappingStrategy.java
new file mode 100644
index 00000000..52f4a7a0
--- /dev/null
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/AuthnMethodReferenceToPrincipalMappingStrategy.java
@@ -0,0 +1,137 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.duo.impl;
+
+import java.security.Principal;
+import java.text.ParseException;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+
+import com.nimbusds.jwt.JWT;
+import com.nimbusds.jwt.JWTClaimsSet;
+
+import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.plugin.authn.duo.context.DuoOIDCAuthenticationContext;
+import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
+/**
+ * A customisable principal mapping function that translates Authentication Method Reference (AMR) strings found in a
+ * Duo ID Token to internal {@link Principal} instances.
+ *
+ * <p>For use as a convenience implementation of a context to principal mapping strategy supported by
+ * {@link ValidateDuoTokenAuthenticationResult}. It enables one or more {@link Principal}s to be associated with
+ * each AMR value present in the authentication response.</p>
+ */
+public class AuthnMethodReferenceToPrincipalMappingStrategy implements Function<ProfileRequestContext,Collection<Principal>>{
+
+ /** The name of the AMR claim inside the Duo authentication token.*/
+ @Nonnull @NotEmpty private static final String AMR_CLAIM_NAME = "amr";
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AuthnMethodReferenceToPrincipalMappingStrategy.class);
+
+ /** Mappings to transform amr claims. */
+ @Nonnull @NonnullElements private final Map<String,Collection<Principal>> principalMappings;
+
+ /**
+ *
+ * Constructor.
+ *
+ * @param mappings the AMR value to Principal mappings
+ */
+ public AuthnMethodReferenceToPrincipalMappingStrategy(
+ @Nullable @NonnullElements @ParameterName(name="mappings")
+ final Map<String,Collection<Principal>> mappings) {
+
+ if (mappings == null || mappings.isEmpty()) {
+ principalMappings = CollectionSupport.emptyMap();
+ } else {
+ principalMappings = new HashMap<>(mappings.size());
+ mappings.forEach((k, v) -> principalMappings.put(k, v != null ? List.copyOf(v) : List.of()));
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override @Nonnull @NotLive @Unmodifiable
+ public Collection<Principal> apply(@Nullable final ProfileRequestContext profileRequestContext) {
+ if (profileRequestContext == null) {
+ return CollectionSupport.emptyList();
+ }
+ final AuthenticationContext authnContext = profileRequestContext.getSubcontext(AuthenticationContext.class);
+ if (authnContext == null) {
+ return CollectionSupport.emptyList();
+ }
+ final DuoOIDCAuthenticationContext duoContext = authnContext.getSubcontext(DuoOIDCAuthenticationContext.class);
+ if (duoContext == null) {
+ return CollectionSupport.emptyList();
+ }
+
+ JWTClaimsSet tokenClaims = null;
+ try {
+ final JWT token = duoContext.getAuthToken();
+ tokenClaims = token != null ? token.getJWTClaimsSet() : null;
+ } catch (final ParseException e) {
+ log.warn("Unable to parse token claims from authentication token, no AMRs can be mapped",e);
+ return CollectionSupport.emptyList();
+ }
+ if (tokenClaims == null) {
+ return CollectionSupport.emptyList();
+ }
+
+ List<String> amrs;
+ try {
+ amrs = tokenClaims.getStringListClaim(AMR_CLAIM_NAME);
+ } catch (final ParseException e) {
+ log.warn("Unable to parse AMR claims from authentication token, no AMRs can be mapped",e);
+ return CollectionSupport.emptyList();
+ }
+ log.trace("Attempting to map AMR claims '{}'", amrs);
+ if (amrs != null) {
+ final List<Principal> principals = new ArrayList<>();
+ for (final String amr : amrs) {
+ if (principalMappings.containsKey(amr)) {
+ final Collection<Principal> mappedPrincipals = principalMappings.get(amr);
+ if (!mappedPrincipals.isEmpty()) {
+ if (log.isTraceEnabled()) {
+ log.trace("Mapped '{}' to '{}'", amr, mappedPrincipals.stream().map(Principal::getName)
+ .collect(CollectionSupport.nonnullCollector(Collectors.toUnmodifiableSet())).get());
+ }
+ principals.addAll(mappedPrincipals);
+ }
+ }
+ }
+ return CollectionSupport.copyToList(principals);
+ }
+ return CollectionSupport.emptyList();
+ }
+
+}
diff --git a/idp-duo-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-duo-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 558ac0aa..3788d19a 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -99,4 +99,7 @@
p:initialBackoff="%{idp.duo.oidc.admin.initialBackoff:1000}"
p:maxBackoff="%{idp.duo.oidc.admin.maxBackoff:16000}" />
+ <!-- Abstract beans to isolate impl classes from user config -->
+ <bean id="shibboleth.authn.DuoOIDC.AuthnMethodReferencePrincipalMappingStrategy" abstract="true"
+ class="net.shibboleth.idp.plugin.authn.duo.impl.AuthnMethodReferenceToPrincipalMappingStrategy"/>
</beans>
\ No newline at end of file
diff --git a/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/AuthnMethodReferenceToPrincipalMappingStrategyTest.java b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/AuthnMethodReferenceToPrincipalMappingStrategyTest.java
new file mode 100644
index 00000000..2494b835
--- /dev/null
+++ b/idp-duo-impl/src/test/java/net/shibboleth/idp/plugin/authn/duo/impl/AuthnMethodReferenceToPrincipalMappingStrategyTest.java
@@ -0,0 +1,132 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.duo.impl;
+
+import static org.testng.Assert.assertTrue;
+
+import java.security.Principal;
+import java.util.Collection;
+import java.util.List;
+import java.util.Map;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.testng.Assert;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.jwt.PlainJWT;
+
+import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.plugin.authn.duo.context.DuoOIDCAuthenticationContext;
+import net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal;
+import net.shibboleth.shared.collection.CollectionSupport;
+
+/**
+ * Tests for {@link AuthnMethodReferenceToPrincipalMappingStrategy}.
+ */
+public class AuthnMethodReferenceToPrincipalMappingStrategyTest {
+
+
+ private ProfileRequestContext prc;
+ private AuthenticationContext authenticationContext;
+ private DuoOIDCAuthenticationContext duoContext;
+
+
+ @BeforeMethod
+ public void setUp() {
+ prc = new ProfileRequestContext();
+ authenticationContext = prc.ensureSubcontext(AuthenticationContext.class);
+ duoContext = authenticationContext.ensureSubcontext(DuoOIDCAuthenticationContext.class);
+ }
+
+ @Test
+ public void testNoToken() {
+ final ProfileRequestContext prc = new ProfileRequestContext();
+
+ final AuthenticationContext authnContext =
+ prc.ensureSubcontext(AuthenticationContext.class);
+
+ authnContext.ensureSubcontext(DuoOIDCAuthenticationContext.class);
+
+ final AuthnMethodReferenceToPrincipalMappingStrategy strategy =
+ new AuthnMethodReferenceToPrincipalMappingStrategy(CollectionSupport.emptyMap());
+
+ assertTrue(strategy.apply(prc).isEmpty());
+ }
+
+
+
+ @Test
+ public void testAMRWithoutMapping() throws Exception {
+
+ final JWTClaimsSet claims = new JWTClaimsSet.Builder()
+ .claim("amr", List.of("mfa"))
+ .build();
+
+ duoContext.setAuthToken(new PlainJWT(claims));
+
+ final AuthnMethodReferenceToPrincipalMappingStrategy strategy =
+ new AuthnMethodReferenceToPrincipalMappingStrategy(Map.of());
+
+ Assert.assertTrue(strategy.apply(prc).isEmpty());
+ }
+
+
+ @Test
+ public void testSingleAMRMapping() throws Exception {
+
+ final Principal principal = new AuthnContextClassRefPrincipal("MFA");
+
+ final JWTClaimsSet claims = new JWTClaimsSet.Builder()
+ .claim("amr", List.of("mfa"))
+ .build();
+ duoContext.setAuthToken(new PlainJWT(claims));
+ final AuthnMethodReferenceToPrincipalMappingStrategy strategy =
+ new AuthnMethodReferenceToPrincipalMappingStrategy(Map.of("mfa", CollectionSupport.listOf(principal)));
+
+ final Collection<Principal> mapped = strategy.apply(prc);
+
+ Assert.assertEquals(mapped.size(), 1);
+ Assert.assertTrue(mapped.contains(principal));
+ }
+
+ @Test
+ public void testMultipleAMRMappings() throws Exception {
+
+ final Principal p1 = new AuthnContextClassRefPrincipal("MFA");
+ final Principal p2 = new AuthnContextClassRefPrincipal("PHR-MFA");
+ final Principal p3 = new AuthnContextClassRefPrincipal("PASSWORD");
+
+ final JWTClaimsSet claims = new JWTClaimsSet.Builder()
+ .claim("amr", List.of("mfa", "pwd"))
+ .build();
+ duoContext.setAuthToken(new PlainJWT(claims));
+
+ final AuthnMethodReferenceToPrincipalMappingStrategy strategy =
+ new AuthnMethodReferenceToPrincipalMappingStrategy(Map.of(
+ "mfa", CollectionSupport.listOf(p1, p2),
+ "pwd", CollectionSupport.listOf(p3)));
+
+ final Collection<Principal> mapped = strategy.apply(prc);
+
+ Assert.assertEquals(mapped.size(), 3);
+ Assert.assertTrue(mapped.contains(p1));
+ Assert.assertTrue(mapped.contains(p2));
+ Assert.assertTrue(mapped.contains(p3));
+ }
+
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list