Package net.shibboleth.idp.plugin.authn.duo

Interface DuoOIDCClient

All Superinterfaces:

DuoOIDCClientCapabilities

All Known Implementing Classes:

AbstractDuoOIDCClient, DuoSDKClientAdaptor, NimbusClient

public interface DuoOIDCClient
extends DuoOIDCClientCapabilities

A client for handling Duo OIDC 2FA interactions. Clients are shared and required to be thread-safe.

Method Summary

Modifier and Type	Method	Description
String	createAuthUrl(String username, String state, String nonce, String redirectURIOverride)	Constructs an authorization redirection URL string with the query parameters required to initiate a Duo 2FA request.
com.nimbusds.jwt.JWT	exchangeAuthorizationCodeFor2FAResult(String code, String username, String redirectURIOverride)	Exchanges the authorizaton code for a signed Json Web Token (JWT) which contains information pertaining to the authentication.
DuoOIDCClientCapabilities	getCapabilities()	Returns the capabilities of the underlying client.
String	getClientId()	Get an identifier for this client e.g.
DuoHealthCheck	healthCheck()	Check the health of the Duo 2FA endpoint and the clients configuration.

Methods inherited from interface net.shibboleth.idp.plugin.authn.duo.DuoOIDCClientCapabilities

isSupportsNonce

Method Detail

getCapabilities

@Nonnull
DuoOIDCClientCapabilities getCapabilities()

Returns the capabilities of the underlying client.

Returns:

interface to access the service's capabilities

healthCheck

@Nonnull
DuoHealthCheck healthCheck()
                    throws DuoClientException

Check the health of the Duo 2FA endpoint and the clients configuration.

Returns:

the heath check response, never null.

Throws:

DuoClientException - if there is an error returning the health check response.

createAuthUrl

@Nonnull
@NotEmpty
String createAuthUrl(@Nonnull @NotEmpty
                     String username,
                     @Nonnull @NotEmpty
                     String state,
                     @Nullable
                     String nonce,
                     @Nullable
                     String redirectURIOverride)
              throws DuoClientException

Constructs an authorization redirection URL string with the query parameters required to initiate a Duo 2FA request.

Parameters:

username - The user to be authenticated by Duo, never null.

state - A randomly generated minimum 22 character String, which is relayed back to the client, never null.

nonce - a randomly generated (minimum 22 character) cryptographically secure nonce that is replayed in the id_token. Can be null if not supported by the client as indicated by the clients described capabilities.

redirectURIOverride - the redirectURI to use in the authorization request. If not null and the client supports dynamic redirect URIs, it should override any redirect_uri held internally to the client e.g. from the DuoOIDCIntegration. If the client does not support dynamic redirect URIs, it can be ignored in favour of one held internally.

Returns:

the authorization redirect URL as a string, never null.

Throws:

DuoClientException - if there is an error creating the authentication URL.

exchangeAuthorizationCodeFor2FAResult

@Nonnull
com.nimbusds.jwt.JWT exchangeAuthorizationCodeFor2FAResult(@Nonnull
                                                           String code,
                                                           @Nonnull
                                                           String username,
                                                           @Nullable
                                                           String redirectURIOverride)
                                                    throws DuoClientException

Exchanges the authorizaton code for a signed Json Web Token (JWT) which contains information pertaining to the authentication. There is no requirement on the client to verify the tokens authenticity or claims - these should be performed elsewhere in the flow. The JWT **must** be signed.

Parameters:

code - An authentication identifier which is exchanged (per OAuth2.0 spec) with Duo for a token. the token can be used to determine if authentication was successful as well as obtain meta-data about the authentication, never null. *

username - The user to be authenticated by Duo, never null.

redirectURIOverride - the redirectURI to use in the code exchange request. If not null and the client supports dynamic redirect URIs, it should override any redirect_uri held internally to the client e.g. from the DuoOIDCIntegration. If the client does not support dynamic redirect URIs, it can be ignored in favour of one held internally.

Returns:

the **signed** JWT, never null.

Throws:

DuoClientException - if there is an error exchanging the auth_code for a token result.

getClientId

@Nonnull
String getClientId()

Get an identifier for this client e.g. a UUID. Only for logging and debugging.

Returns:

the client identifier.