Package net.shibboleth.idp.plugin.authn.duo.impl

Class DuoSupport

java.lang.Object
net.shibboleth.idp.plugin.authn.duo.impl.DuoSupport
@ThreadSafe public final class DuoSupport extends Object
Helper methods for Duo 2FA.

  • Field Details

    • RFC_2822_DATE_FORMAT

      public static final DateTimeFormatter RFC_2822_DATE_FORMAT
      RFC 2822 formatter for date/time.

  • Constructor Details

    • DuoSupport

      private DuoSupport()
      Private Constructor.

  • Method Details

    • canonRequest

      private static String canonRequest(@Nonnull org.apache.hc.core5.http.io.support.ClassicRequestBuilder request, @Nonnull String date, int sigVersion)
      The signature requires that the request parameters being in a particular order as specified in the API.
      Parameters:
      request - the request
      date - the date
      sigVersion - the signature version
      Returns:
      the parameters to be signed in their canonical order
      Since:
      2.0.0

    • createQueryString

      private static String createQueryString(@Nonnull List<org.apache.hc.core5.http.NameValuePair> params)
      Builds a string representation of the query string with the parameter names is alphabetical order. The names and values are URL encoded and then they are concatenated with '&' in between.
      Parameters:
      params - the name/value pairs to be joined
      Returns:
      the canonical query string
      Since:
      2.0.0

    • signRequest

      @NotEmpty public static void signRequest(@Nonnull org.apache.hc.core5.http.io.support.ClassicRequestBuilder request, @Nonnull DuoIntegration duo) throws InvalidKeyException, NoSuchAlgorithmException, EncodingException
      Sign a Duo AuthAPI request.
      Parameters:
      request - the request to be signed
      duo - integration parameters to use
      Throws:
      InvalidKeyException - bad skey value
      NoSuchAlgorithmException - unknown encryption algorithm
      EncodingException - if unable to base64-encode the header
      Since:
      2.0.0

    • generateNonce

      @Nonnull static String generateNonce(@Nonnull Integer length)
      Generates a random identifier to be used as a nonce.
      Parameters:
      length - the length of the parameter, minimum allowed is 22.
      Returns:
      the randomly generated nonce value.

    • generateState

      @Nonnull static String generateState(@Nonnull String nonce, @Nonnull String key)

      Generate a state parameter from a nonce component and an execution key component.

      The nonce is separated from the key by a dot e.g. <nonce>.<keyHex>.

      The nonce is assumed to be already encoded in its transmission format e.g. Hex. The key is hex encoded before it is combined with the nonce. The result is assumed URL encoded e.g. inside the allowed set of URI characters or, no character in the state is from the URI reserved set.

      Parameters:
      nonce - the nonce component.
      key - the key component. The key is hex encoded before it is added to the generated state.
      Returns:
      the combined state component.

    • extractKeyFromState

      @Nonnull static String extractKeyFromState(@Nonnull String state) throws DuoException
      Extract the key component from the state. The key is hex encoded and separated from the nonce value by a dot.
      Parameters:
      state - the state which contains both the nonce and the key dot separated.
      Returns:
      the key extracted from the state and hex decoded.
      Throws:
      DuoException - if the key component can not be found, or hex decoding fails.

    • extractNonceFromState

      @Nonnull static String extractNonceFromState(@Nonnull String state) throws DuoException
      Extract the nonce component from the state. The nonce is separated from the key by a dot, and is assumed to be the first value of the pair.
      Parameters:
      state - the state which contains both the nonce and the key dot separated.
      Returns:
      the nonce extracted from the state.
      Throws:
      DuoException - if the nonce component can not be found.