Package net.shibboleth.idp.plugin.authn.duo.context

Class DuoOIDCAuthenticationContext

  • All Implemented Interfaces:
    Iterable<BaseContext>
    @NotThreadSafe
public final class DuoOIDCAuthenticationContext
extends BaseContext

    Mutable Context that carries the Duo integration, request-response state, authorization code, and Duo authentication result token.

    As with other context classes, holds state, is not thread-safe and should be thread-confined.

    Parent:
    AuthenticationContext
    Added:
    After extracting the Duo integration for the given authentication request.

    • Field Detail

      • username

        @Nullable
private String username
        Username.

      • integration

        @Nullable
private DuoOIDCIntegration integration
        The selected Duo integration to use for the lifetime of this request.

      • requestState

        @Nullable
private String requestState
        A randomly generated 32 character minimum String sent in the Duo 2FA authorization request.

      • responseState

        @Nullable
private String responseState
        A randomly generated 32 character minimum String returned in the Duo 2FA authorization response.

      • nonce

        @Nullable
private String nonce
        String value used to associate a Client session with an ID Token to mitigate replay attacks.

      • authCode

        @Nullable
private String authCode
        The authorization code return from the Duo authorization request.

      • authToken

        @Nullable
private com.nimbusds.jwt.JWT authToken
        The JWT token received from Duo as a result of 2FA. Token *must* be signed.

      • client

        @Nullable
private DuoOIDCClient client
        The Duo OIDC client to use for the lifetime of this authentication request.

      • redirectURIOverride

        @Nullable
private String redirectURIOverride
        A request-bound redirect URI that was determined at runtime. Used to override the URI inside a DuoOIDCIntegration for supported clients. Allows per-request redirects e.g. useful if one IdP instance is fronted by different virtual hosts.

    • Constructor Detail

      • DuoOIDCAuthenticationContext

        public DuoOIDCAuthenticationContext()
        Public no-arg constructor to allow auto-creation.

    • Method Detail

      • getRedirectURIOverride

        @Nullable
public String getRedirectURIOverride()
        Get the override redirect URI.
        Returns:
        the override redirect URI.

      • setRedirectURIOverride

        @Nonnull
public DuoOIDCAuthenticationContext setRedirectURIOverride​(@Nullable
                                                           String override)
        Set the override redirect URI.
        Parameters:
        override - the override redirect URI.
        Returns:
        this context.

      • getNonce

        @Nullable
public String getNonce()
        Get the nonce.
        Returns:
        the nonce.

      • setNonce

        @Nonnull
public DuoOIDCAuthenticationContext setNonce​(@Nullable
                                             String oidcNonce)
        Set the OIDC nonce.
        Parameters:
        oidcNonce - the nonce.
        Returns:
        this context.

      • getAuthorizationCode

        @Nullable
public String getAuthorizationCode()
        Get the authorization code.
        Returns:
        the authorization code.

      • setAuthorizationCode

        @Nonnull
public DuoOIDCAuthenticationContext setAuthorizationCode​(@Nullable
                                                         String code)
        Set the authorization code.
        Parameters:
        code - the authorization code.
        Returns:
        this context.

      • getClient

        @Nullable
public DuoOIDCClient getClient()
        Get the client used to communicate with the Duo OIDC API.
        Returns:
        the duo client.

      • setClient

        @Nonnull
public DuoOIDCAuthenticationContext setClient​(@Nullable
                                              DuoOIDCClient duoClient)
        Set the client used to communicate with the Duo OIDC API.
        Parameters:
        duoClient - the duo client.
        Returns:
        this context.

      • setAuthToken

        @Nonnull
public DuoOIDCAuthenticationContext setAuthToken​(@Nullable
                                                 com.nimbusds.jwt.JWT token)
        Set the Duo authentication token.
        Parameters:
        token - the duo authentication token
        Returns:
        this context

      • getAuthToken

        @Nullable
public com.nimbusds.jwt.JWT getAuthToken()
        Get the Duo authentication token.
        Returns:
        the token

      • getRequestState

        @Nullable
public String getRequestState()
        Get the request state.
        Returns:
        the state

      • setRequestState

        @Nonnull
public DuoOIDCAuthenticationContext setRequestState​(@Nullable
                                                    String state)
        Set the request state.
        Parameters:
        state - the state.
        Returns:
        this context

      • getResponseState

        @Nullable
public String getResponseState()
        Get the response state.
        Returns:
        the state

      • setResponseState

        @Nonnull
public DuoOIDCAuthenticationContext setResponseState​(@Nullable
                                                     String state)
        Set the response state.
        Parameters:
        state - the state.
        Returns:
        this context

      • getUsername

        @Nullable
public String getUsername()
        Get the username.
        Returns:
        username

      • getIntegration

        @Nullable
public DuoOIDCIntegration getIntegration()
        Get the Duo integration.
        Returns:
        the Duo integration