Package net.shibboleth.idp.plugin.authn.duo

Class DefaultDuoOIDCIntegration

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

net.shibboleth.idp.plugin.authn.duo.DefaultDuoOIDCIntegration

All Implemented Interfaces:

PrincipalSupportingComponent, DuoOIDCIntegration, DynamicDuoOIDCIntegration, Component, DestructableComponent, InitializableComponent

@ThreadSafe
public final class DefaultDuoOIDCIntegration
extends AbstractInitializableComponent
implements DynamicDuoOIDCIntegration

Data wrapper for use with Duo OIDC integrations. Holds shared-state.

Despite most fields being 'effectively immutable' once published by Spring, the redirectURI is allowed to change, but in a guarded, shared-thread-safe manor.

Field Summary

Fields

Modifier and Type	Field	Description
private Set<String>	allowedOrigins	A set of 'allowed' origins that can be used as the scheme, host, and port portion of the redirectURI.
private String	apiHost	API host.
private String	authorizeEndpoint	The URL path to the authorization endpoint.
private String	clientId	Integration key.
private String	healthEndpoint	The URL path to the health endpoint.
private final org.slf4j.Logger	log	Class logger.
private String	redirectURI	The used (by clients) redirect_uri to send the client after authorisation .
private String	registeredRedirectURI	A statically set (pre-registered) redirectURI to send the client to after authorisation.
private String	secretKey	Secret key.
private final Subject	supportedPrincipals	Container for supported principals.
private String	tokenEndpoint	The URL path to the token endpoint.

Constructor Summary

Constructors

Constructor	Description
DefaultDuoOIDCIntegration()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doInitialize()
boolean	equals(Object obj)
Set<String>	getAllowedOrigins()	Get a list of URL origins that are allowed to appear in computed redirect URIs.
String	getAPIHost()	Get the name of the API host to contact.
String	getAuthorizeEndpoint()	Get the path of the authorization endpoint.
String	getClientId()	Get the clientId key.
String	getHealthCheckEndpoint()	Get the path of the health check endpoint.
String	getRedirectURI()	Get the runtime redirectURI to direct the client to after authorisation.
String	getRegisteredRedirectURI()	Get the static pre-registered redirect_uri.
String	getSecretKey()	Get the secret key.
<T extends Principal> Set<T>	getSupportedPrincipals(Class<T> c)
String	getTokenEndpoint()	Get the path of the token endpoint.
int	hashCode()
boolean	isRedirectURIPreregistered()	Has a redirectURI been pre-registered i.e.
void	setAllowedOrigins(Collection<String> hosts)	Set the origins that are allowed to form the scheme, host, and port part of a computed redirect_uri.
void	setAPIHost(String host)	Set the API host to use.
void	setAuthorizeEndpoint(String endpoint)	Set the authorize endpoint URL path.
void	setClientId(String id)	Set the client ID to use.
void	setHealthCheckEndpoint(String endpoint)	Set the health check endpoint URL path.
void	setRedirectURIIfAbsent(String computedRedirectURI)	Set the redirectURI from the one given in a thread-safe way.
void	setRegisteredRedirectURI(String uri)	Set the redirect_uri to use.
void	setSecretKey(String key)	Set the secret key to use.
<T extends Principal> void	setSupportedPrincipals(Collection<T> principals)	Set supported non-user-specific principals that the action will include in the subjects it generates, in place of any default principals from the flow.
void	setTokenEndpoint(String endpoint)	Set the token endpoint URL path.
String	toString()

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

apiHost

@NonnullAfterInit
@NotEmpty
private String apiHost

API host.

clientId

@NonnullAfterInit
@NotEmpty
private String clientId

Integration key.

secretKey

@NonnullAfterInit
@NotEmpty
private String secretKey

Secret key.

redirectURI

@Nullable
private String redirectURI

The used (by clients) redirect_uri to send the client after authorisation .

registeredRedirectURI

@Nullable
private String registeredRedirectURI

A statically set (pre-registered) redirectURI to send the client to after authorisation.

allowedOrigins

@Nonnull
@NonnullElements
@Unmodifiable
private Set<String> allowedOrigins

A set of 'allowed' origins that can be used as the scheme, host, and port portion of the redirectURI.

healthEndpoint

@NonnullAfterInit
@NotEmpty
private String healthEndpoint

The URL path to the health endpoint.

authorizeEndpoint

@NonnullAfterInit
@NotEmpty
private String authorizeEndpoint

The URL path to the authorization endpoint.

tokenEndpoint

@NonnullAfterInit
@NotEmpty
private String tokenEndpoint

The URL path to the token endpoint.

supportedPrincipals

@Nonnull
private final Subject supportedPrincipals

Container for supported principals.

Constructor Details

DefaultDuoOIDCIntegration

public DefaultDuoOIDCIntegration()

Constructor.

Method Details

setAllowedOrigins

public void setAllowedOrigins(@Nullable @NonnullElements
 Collection<String> hosts)

Set the origins that are allowed to form the scheme, host, and port part of a computed redirect_uri.

Parameters:

hosts - the hostnames to allow.

getAllowedOrigins

@Nonnull
@NotLive
@Unmodifiable
public Set<String> getAllowedOrigins()

Description copied from interface: DynamicDuoOIDCIntegration

Get a list of URL origins that are allowed to appear in computed redirect URIs.

Specified by:

getAllowedOrigins in interface DynamicDuoOIDCIntegration

Returns:

a set of unmodifiable allowed origins. Never null but could be empty.

getAPIHost

@NonnullAfterInit
@NotEmpty
public String getAPIHost()

Description copied from interface: DuoOIDCIntegration

Get the name of the API host to contact.

Specified by:

getAPIHost in interface DuoOIDCIntegration

Returns:

name of API host

setAPIHost

public void setAPIHost(@Nonnull @NotEmpty
 String host)

Set the API host to use.

Parameters:

host - API host

getHealthCheckEndpoint

@NonnullAfterInit
@NotEmpty
public String getHealthCheckEndpoint()

Description copied from interface: DuoOIDCIntegration

Get the path of the health check endpoint.

Specified by:

getHealthCheckEndpoint in interface DuoOIDCIntegration

Returns:

the path of the health check endpoint

setHealthCheckEndpoint

public void setHealthCheckEndpoint(@Nonnull @NotEmpty
 String endpoint)

Set the health check endpoint URL path.

Parameters:

endpoint - the endpoint.

getAuthorizeEndpoint

@NonnullAfterInit
@NotEmpty
public String getAuthorizeEndpoint()

Description copied from interface: DuoOIDCIntegration

Get the path of the authorization endpoint.

Specified by:

getAuthorizeEndpoint in interface DuoOIDCIntegration

Returns:

the path of the authorization endpoint

setAuthorizeEndpoint

public void setAuthorizeEndpoint(@Nonnull @NotEmpty
 String endpoint)

Set the authorize endpoint URL path.

Parameters:

endpoint - the endpoint.

getTokenEndpoint

@NonnullAfterInit
@NotEmpty
public String getTokenEndpoint()

Description copied from interface: DuoOIDCIntegration

Get the path of the token endpoint.

Specified by:

getTokenEndpoint in interface DuoOIDCIntegration

Returns:

the path of the token endpoint;

setTokenEndpoint

public void setTokenEndpoint(@Nonnull @NotEmpty
 String endpoint)

Set the token endpoint URL path.

Parameters:

endpoint - the endpoint.

getRedirectURI

@Nullable
public String getRedirectURI()

Description copied from interface: DuoOIDCIntegration

Get the runtime redirectURI to direct the client to after authorisation.

Specified by:

getRedirectURI in interface DuoOIDCIntegration

Returns:

the redirectURI

setRegisteredRedirectURI

public void setRegisteredRedirectURI(@Nullable
 String uri)

Set the redirect_uri to use.

Parameters:

uri - the redirect_uri

getRegisteredRedirectURI

@Nullable
public String getRegisteredRedirectURI()

Description copied from interface: DynamicDuoOIDCIntegration

Get the static pre-registered redirect_uri.

Specified by:

getRegisteredRedirectURI in interface DynamicDuoOIDCIntegration

Returns:

the pre-registered redirect_uri.

isRedirectURIPreregistered

public boolean isRedirectURIPreregistered()

Description copied from interface: DynamicDuoOIDCIntegration

Has a redirectURI been pre-registered i.e. set in the properties file.

Specified by:

isRedirectURIPreregistered in interface DynamicDuoOIDCIntegration

Returns:

true iff DynamicDuoOIDCIntegration.getRegisteredRedirectURI() is not null, false otherwise.

setRedirectURIIfAbsent

public void setRedirectURIIfAbsent(@Nonnull @NotEmpty
 String computedRedirectURI)

Description copied from interface: DynamicDuoOIDCIntegration

Set the redirectURI from the one given in a thread-safe way.

Once set, DuoOIDCIntegration.getRedirectURI() should return the value of computedRedirectURI.

This is a sate changing operation, and should be thread-safe in its operation, as the integration will be shared amongst threads e.g. synchronize the method call.

Specified by:

setRedirectURIIfAbsent in interface DynamicDuoOIDCIntegration

Parameters:

computedRedirectURI - the runtime computed redirectURI.

setClientId

public void setClientId(@Nonnull @NotEmpty
 String id)

Set the client ID to use.

Parameters:

id - the client identifier.

getClientId

@NonnullAfterInit
@NotEmpty
public String getClientId()

Description copied from interface: DuoOIDCIntegration

Get the clientId key.

Specified by:

getClientId in interface DuoOIDCIntegration

Returns:

the integration key

setSecretKey

public void setSecretKey(@Nonnull @NotEmpty
 String key)

Set the secret key to use.

Parameters:

key - secret key

getSecretKey

@NonnullAfterInit
@NotEmpty
public String getSecretKey()

Description copied from interface: DuoOIDCIntegration

Get the secret key.

Specified by:

getSecretKey in interface DuoOIDCIntegration

Returns:

the secret key

getSupportedPrincipals

@Nonnull
@NonnullElements
@Unmodifiable
public <T extends Principal> Set<T> getSupportedPrincipals(@Nonnull
 Class<T> c)

Specified by:

getSupportedPrincipals in interface PrincipalSupportingComponent

setSupportedPrincipals

public <T extends Principal> void setSupportedPrincipals(@Nullable @NonnullElements
 Collection<T> principals)

Set supported non-user-specific principals that the action will include in the subjects it generates, in place of any default principals from the flow.

Setting to a null or empty collection will maintain the default behavior of relying on the flow.

Type Parameters:

T - a type of principal to add, if not generic

Parameters:

principals - supported principals to include

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

hashCode

public int hashCode()

Overrides:

hashCode in class Object

equals

public boolean equals(Object obj)

Overrides:

equals in class Object

toString

public String toString()

Overrides:

toString in class Object