Package net.shibboleth.idp.plugin.authn.duo

Class AbstractDuoAuthenticationAction

java.lang.Object

net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.authn.AbstractAuthenticationAction

net.shibboleth.idp.plugin.authn.duo.AbstractDuoAuthenticationAction

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

Direct Known Subclasses:

ExchangeCodeForDuoToken, HealthCheckDuoOIDCAuthAPI, ValidateDuoResponseState, ValidateTokenClaims, ValidateTokenSignature

public abstract class AbstractDuoAuthenticationAction
extends AbstractAuthenticationAction

A base class for Duo 2FA authentication related actions.

In addition to the work performed by AbstractAuthenticationAction, this action also looks up and makes available the DuoOIDCAuthenticationContext.

Duo 2FA authentication action implementations should override the doExecute(ProfileRequestContext, AuthenticationContext, DuoOIDCAuthenticationContext) method.

Event:

AuthnEventIds.INVALID_AUTHN_CTX

Precondition:

ProfileRequestContext.getSubcontext(AuthenticationContext.class) != null

Postcondition:

AuthenticationContext.getSubcontext(DuoOIDCAuthenticationContext.class) != null

Field Summary

Fields

Modifier and Type	Field	Description
private DuoOIDCAuthenticationContext	duoContext	The Duo authentication Context.
private Function<ProfileRequestContext,DuoOIDCAuthenticationContext>	duoContextLookupStrategy	Lookup strategy to locate the Duo authentication context.
private org.slf4j.Logger	log	Class logger.

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	AbstractDuoAuthenticationAction()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)	Delegates to doExecute(ProfileRequestContext, AuthenticationContext, DuoOIDCAuthenticationContext) to perform the actual authentication.
protected void	doExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext, DuoOIDCAuthenticationContext context)	Performs this Duo authentication action using the supplied Duo context.
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext, DuoOIDCAuthenticationContext context)	Performs this authentication action's pre-execute step.
void	setDuoContextLookupStrategy(Function<ProfileRequestContext,DuoOIDCAuthenticationContext> strategy)	Set Duo authentication context lookup strategy to use.

Methods inherited from class net.shibboleth.idp.authn.AbstractAuthenticationAction

doExecute, doPreExecute, setAuthenticationContextLookupStrategy

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, setHttpServletRequest, setHttpServletRequestSupplier, setHttpServletResponse, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

destroy, doDestroy, doInitialize, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.utilities.java.support.component.InitializableComponent

initialize, isInitialized

Field Detail

log

@Nonnull
@NotEmpty
private final org.slf4j.Logger log

Class logger.

duoContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,DuoOIDCAuthenticationContext> duoContextLookupStrategy

Lookup strategy to locate the Duo authentication context.

duoContext

@Nullable
private DuoOIDCAuthenticationContext duoContext

The Duo authentication Context.

Constructor Detail

AbstractDuoAuthenticationAction

protected AbstractDuoAuthenticationAction()

Constructor.

Method Detail

setDuoContextLookupStrategy

public void setDuoContextLookupStrategy(@Nonnull
                                        Function<ProfileRequestContext,DuoOIDCAuthenticationContext> strategy)

Set Duo authentication context lookup strategy to use.

Parameters:

strategy - lookup strategy

doPreExecute

protected final boolean doPreExecute(@Nonnull
                                     ProfileRequestContext profileRequestContext,
                                     @Nonnull
                                     AuthenticationContext authenticationContext)

Overrides:

doPreExecute in class AbstractAuthenticationAction

doExecute

protected final void doExecute(@Nonnull
                               ProfileRequestContext profileRequestContext,
                               @Nonnull
                               AuthenticationContext authenticationContext)

Delegates to doExecute(ProfileRequestContext, AuthenticationContext, DuoOIDCAuthenticationContext) to perform the actual authentication. Implementations can not override this method.

Overrides:

doExecute in class AbstractAuthenticationAction

Parameters:

profileRequestContext - the current IdP profile request context

authenticationContext - the current authentication context

doPreExecute

protected boolean doPreExecute(@Nonnull
                               ProfileRequestContext profileRequestContext,
                               @Nonnull
                               AuthenticationContext authenticationContext,
                               @Nonnull
                               DuoOIDCAuthenticationContext context)

Performs this authentication action's pre-execute step. Default implementation just returns true.

Parameters:

profileRequestContext - the current IdP profile request context

authenticationContext - the current authentication context

context - the Duo authentication context

Returns:

true iff execution should continue

doExecute

protected void doExecute(@Nonnull
                         ProfileRequestContext profileRequestContext,
                         @Nonnull
                         AuthenticationContext authenticationContext,
                         @Nonnull
                         DuoOIDCAuthenticationContext context)

Performs this Duo authentication action using the supplied Duo context. Implementations should override this method.

Parameters:

profileRequestContext - the current IdP profile request context

authenticationContext - the current authentication context

context - the Duo authentication context