Package net.shibboleth.idp.plugin.authn.duo.impl

Class PopulateDuoAuthenticationContext

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.authn.AbstractAuthenticationAction

net.shibboleth.idp.plugin.authn.duo.impl.PopulateDuoAuthenticationContext

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class PopulateDuoAuthenticationContext
extends AbstractAuthenticationAction

An action to create (or lookup) and populate the DuoOIDCAuthenticationContext with the username, chosen DuoOIDCIntegration, and DuoOIDCClient appropriate for this request.

Determines the usable redirect_uri, either from one registered, or computed from the HTTP request. Is set once, before the client is constructed, for every client. If however, the client supports dynamic use of the redirect_uri, it is also set into the context for use downstream.

Adds the nonce part of the state parameter for matching on callback from the 2FA check.

Event:

EventIds.PROCEED_EVENT_ID, EventIds.INVALID_PROFILE_CTX, AuthnEventIds.NO_CREDENTIALS, AuthnEventIds.AUTHN_EXCEPTION

Postcondition:

See above.

Field Summary

Fields

Modifier and Type	Field	Description
private DuoOIDCClientRegistry	clientRegistry	The registry for locating the DuoClient for the established integration.
private Function<ProfileRequestContext,DuoOIDCAuthenticationContext>	duoAuthContextCreationStrategy	Strategy used to locate or create the DuoOIDCAuthenticationContext to populate.
private Function<ProfileRequestContext,DuoOIDCIntegration>	duoIntegrationLookupStrategy	Lookup strategy for Duo integration.
private final org.slf4j.Logger	log	Class logger.
private BiFunction<HttpServletRequest,DynamicDuoOIDCIntegration,String>	redirectURICreationStrategy	Strategy used to compute the redirectURI from the given Duo integration if supported.
private Function<ProfileRequestContext,String>	usernameLookupStrategy	Lookup strategy for username to match against Duo identity.

Constructor Summary

Constructors

Constructor	Description
PopulateDuoAuthenticationContext()	Constructor.

Method Summary

Modifier and Type	Method	Description
private void	computeAndStoreRedirectURIIfSupported(DuoOIDCIntegration duoIntegration, HttpServletRequest request, DuoOIDCAuthenticationContext context)	For DynamicDuoOIDCIntegrations, apply the redirect_uri creation strategy to compute a redirect_uri to use.
protected void	doExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)
protected void	doInitialize()
void	setClientRegistry(DuoOIDCClientRegistry duoRegistry)	Set the Duo client registry.
void	setDuoContextCreationStrategy(Function<ProfileRequestContext,DuoOIDCAuthenticationContext> strategy)	Set the strategy used to locate the DuoOIDCAuthenticationContext to operate on.
void	setDuoIntegrationLookupStrategy(Function<ProfileRequestContext,DuoOIDCIntegration> strategy)	Set DuoIntegration lookup strategy to use.
void	setRedirectURICreationStrategy(BiFunction<HttpServletRequest,DynamicDuoOIDCIntegration,String> strategy)	Set the redirect URI creation strategy.
void	setUsernameLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set the lookup strategy to use for the username to match against Duo identity.

Methods inherited from class net.shibboleth.idp.authn.AbstractAuthenticationAction

doExecute, doPreExecute, doPreExecute, setAuthenticationContextLookupStrategy

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

duoAuthContextCreationStrategy

@Nonnull
private Function<ProfileRequestContext,DuoOIDCAuthenticationContext> duoAuthContextCreationStrategy

Strategy used to locate or create the DuoOIDCAuthenticationContext to populate.

usernameLookupStrategy

@Nonnull
private Function<ProfileRequestContext,String> usernameLookupStrategy

Lookup strategy for username to match against Duo identity.

duoIntegrationLookupStrategy

@Nonnull
private Function<ProfileRequestContext,DuoOIDCIntegration> duoIntegrationLookupStrategy

Lookup strategy for Duo integration.

redirectURICreationStrategy

@Nullable
private BiFunction<HttpServletRequest,DynamicDuoOIDCIntegration,String> redirectURICreationStrategy

Strategy used to compute the redirectURI from the given Duo integration if supported.

clientRegistry

@NonnullAfterInit
private DuoOIDCClientRegistry clientRegistry

The registry for locating the DuoClient for the established integration.

Constructor Details

PopulateDuoAuthenticationContext

public PopulateDuoAuthenticationContext()

Constructor.

Method Details

setClientRegistry

public void setClientRegistry(@Nonnull
 DuoOIDCClientRegistry duoRegistry)

Set the Duo client registry.

Parameters:

duoRegistry - the registry

setUsernameLookupStrategy

public void setUsernameLookupStrategy(@Nonnull
 Function<ProfileRequestContext,String> strategy)

Set the lookup strategy to use for the username to match against Duo identity.

Parameters:

strategy - lookup strategy

setRedirectURICreationStrategy

public void setRedirectURICreationStrategy(@Nonnull
 BiFunction<HttpServletRequest,DynamicDuoOIDCIntegration,String> strategy)

Set the redirect URI creation strategy. The strategy is free to use or create a redirectURI based either on runtime parameters, or static information in the DuoOIDCIntegration.

Parameters:

strategy - the creation strategy.

setDuoContextCreationStrategy

public void setDuoContextCreationStrategy(@Nonnull
 Function<ProfileRequestContext,DuoOIDCAuthenticationContext> strategy)

Set the strategy used to locate the DuoOIDCAuthenticationContext to operate on.

Parameters:

strategy - lookup strategy

setDuoIntegrationLookupStrategy

public void setDuoIntegrationLookupStrategy(@Nonnull
 Function<ProfileRequestContext,DuoOIDCIntegration> strategy)

Set DuoIntegration lookup strategy to use.

Parameters:

strategy - lookup strategy

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AuthenticationContext authenticationContext)

Overrides:

doExecute in class AbstractAuthenticationAction

computeAndStoreRedirectURIIfSupported

private void computeAndStoreRedirectURIIfSupported(@Nonnull
 DuoOIDCIntegration duoIntegration,
 @Nonnull
 HttpServletRequest request,
 @Nonnull
 DuoOIDCAuthenticationContext context)
                                            throws DuoException

For DynamicDuoOIDCIntegrations, apply the redirect_uri creation strategy to compute a redirect_uri to use.

The redirect_uri is computed for each request, but is only set once as the usable redirect_uri on the integration itself i.e. for the client to read using DuoOIDCIntegration.getRedirectURI(). This allows all clients to see a computed (by the redirectURICreationStrategy) redirect_uri from the first request onward.

The computed redirect_uri is also added to the context as an override redirect_uri which - if supported by the client - can be used dynamically when creating authorization or token exchange requests.

Parameters:

duoIntegration - the Duo integration pertaining to this request.

request - the http servlet request.

context - the Duo authentication context to store the computed override redirect_uri.

Throws:

DuoException - if the redirect_uri could not be created by the strategy.