Package net.shibboleth.idp.plugin.authn.duo.impl

Class PopulateDuoAuthenticationContext

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.authn.AbstractAuthenticationAction

net.shibboleth.idp.plugin.authn.duo.impl.PopulateDuoAuthenticationContext

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class PopulateDuoAuthenticationContext
extends AbstractAuthenticationAction

An action to create (or lookup) and populate the DuoOIDCAuthenticationContext with the username, chosen DuoOIDCIntegration, and DuoOIDCClient appropriate for this request.

Operates in 2 modes, one for passwordless (indicated by presence of a DuoPasswordlessContext, or a standard mode. The difference is in how the username and integration to use are derived.

Determines the usable redirect_uri, either from one registered, or computed from the HTTP request. Is set once, before the client is constructed, for every client. If however, the client supports dynamic use of the redirect_uri, it is also set into the context for use downstream.

Adds the nonce part of the state parameter for matching on callback from the 2FA check.

Event:

EventIds.PROCEED_EVENT_ID, EventIds.INVALID_PROFILE_CTX, AuthnEventIds.NO_CREDENTIALS, AuthnEventIds.AUTHN_EXCEPTION

Postcondition:

See above.

Field Summary

Fields

Modifier and Type	Field	Description
private DuoOIDCClientRegistry	clientRegistry	The registry for locating the DuoClient for the established integration.
private final org.slf4j.Logger	log	Class logger.
private Function<ProfileRequestContext,DuoPasswordlessContext>	passwordlessContextLookupStrategy	Strategy used to locate a DuoPasswordlessContext if present.
private Function<ProfileRequestContext,DuoOIDCIntegration>	passwordlessDuoIntegrationLookupStrategy	Lookup strategy for Duo integration for passwordless use.
private BiFunction<HttpServletRequest,DynamicDuoOIDCIntegration,String>	redirectURICreationStrategy	Strategy used to compute the redirectURI from the given Duo integration if supported.
private String	ssoBypassFieldName	Parameter name for SSO bypass.
private Function<ProfileRequestContext,DuoOIDCIntegration>	standardDuoIntegrationLookupStrategy	Lookup strategy for Duo integration.
private Function<ProfileRequestContext,String>	usernameLookupStrategy	Lookup strategy for username to match against Duo identity.

Constructor Summary

Constructors

Constructor	Description
PopulateDuoAuthenticationContext()	Constructor.

Method Summary

Modifier and Type	Method	Description
private void	computeAndStoreRedirectURIIfSupported(DuoOIDCIntegration duoIntegration, HttpServletRequest request, DuoOIDCAuthenticationContext context)	For DynamicDuoOIDCIntegrations, apply the redirect_uri creation strategy to compute a redirect_uri to use.
protected void	doExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)
protected void	doInitialize()
private boolean	doPasswordless(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext, DuoOIDCAuthenticationContext duoContext, DuoPasswordlessContext passwordlessContext)	Perform standard context creation and lookups.
private boolean	doStandard(ProfileRequestContext profileRequestContext, DuoOIDCAuthenticationContext duoContext)	Perform standard context creation and lookups.
void	setClientRegistry(DuoOIDCClientRegistry duoRegistry)	Set the Duo client registry.
void	setPasswordlessContextLookupStrategy(Function<ProfileRequestContext,DuoPasswordlessContext> strategy)	Set the strategy used to locate the DuoPasswordlessContext to operate on.
void	setPasswordlessDuoIntegrationLookupStrategy(Function<ProfileRequestContext,DuoOIDCIntegration> strategy)	Set passwordless DuoIntegration lookup strategy to use.
void	setRedirectURICreationStrategy(BiFunction<HttpServletRequest,DynamicDuoOIDCIntegration,String> strategy)	Set the redirect URI creation strategy.
void	setSSOBypassFieldName(String fieldName)	Set the SSO bypass parameter name.
void	setStandardDuoIntegrationLookupStrategy(Function<ProfileRequestContext,DuoOIDCIntegration> strategy)	Set standard DuoIntegration lookup strategy to use.
void	setUsernameLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set the lookup strategy to use for the username to match against Duo identity.

Methods inherited from class net.shibboleth.idp.authn.AbstractAuthenticationAction

doExecute, doPreExecute, doPreExecute, setAuthenticationContextLookupStrategy

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

passwordlessContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,DuoPasswordlessContext> passwordlessContextLookupStrategy

Strategy used to locate a DuoPasswordlessContext if present.

usernameLookupStrategy

@Nonnull
private Function<ProfileRequestContext,String> usernameLookupStrategy

Lookup strategy for username to match against Duo identity.

standardDuoIntegrationLookupStrategy

@Nonnull
private Function<ProfileRequestContext,DuoOIDCIntegration> standardDuoIntegrationLookupStrategy

Lookup strategy for Duo integration.

passwordlessDuoIntegrationLookupStrategy

@Nonnull
private Function<ProfileRequestContext,DuoOIDCIntegration> passwordlessDuoIntegrationLookupStrategy

Lookup strategy for Duo integration for passwordless use.

redirectURICreationStrategy

@Nullable
private BiFunction<HttpServletRequest,DynamicDuoOIDCIntegration,String> redirectURICreationStrategy

Strategy used to compute the redirectURI from the given Duo integration if supported.

ssoBypassFieldName

@Nonnull
@NotEmpty
private String ssoBypassFieldName

Parameter name for SSO bypass.

clientRegistry

@NonnullAfterInit
private DuoOIDCClientRegistry clientRegistry

The registry for locating the DuoClient for the established integration.

Constructor Details

PopulateDuoAuthenticationContext

public PopulateDuoAuthenticationContext()

Constructor.

Method Details

setClientRegistry

public void setClientRegistry(@Nonnull
 DuoOIDCClientRegistry duoRegistry)

Set the Duo client registry.

Parameters:

duoRegistry - the registry

setUsernameLookupStrategy

public void setUsernameLookupStrategy(@Nonnull
 Function<ProfileRequestContext,String> strategy)

Set the lookup strategy to use for the username to match against Duo identity.

Parameters:

strategy - lookup strategy

setRedirectURICreationStrategy

public void setRedirectURICreationStrategy(@Nonnull
 BiFunction<HttpServletRequest,DynamicDuoOIDCIntegration,String> strategy)

Set the redirect URI creation strategy. The strategy is free to use or create a redirectURI based either on runtime parameters, or static information in the DuoOIDCIntegration.

Parameters:

strategy - the creation strategy.

setPasswordlessContextLookupStrategy

public void setPasswordlessContextLookupStrategy(@Nonnull
 Function<ProfileRequestContext,DuoPasswordlessContext> strategy)

Set the strategy used to locate the DuoPasswordlessContext to operate on.

Parameters:

strategy - lookup strategy

Since:

2.1.0

setStandardDuoIntegrationLookupStrategy

public void setStandardDuoIntegrationLookupStrategy(@Nonnull
 Function<ProfileRequestContext,DuoOIDCIntegration> strategy)

Set standard DuoIntegration lookup strategy to use.

Parameters:

strategy - lookup strategy

setPasswordlessDuoIntegrationLookupStrategy

public void setPasswordlessDuoIntegrationLookupStrategy(@Nonnull
 Function<ProfileRequestContext,DuoOIDCIntegration> strategy)

Set passwordless DuoIntegration lookup strategy to use.

Parameters:

strategy - lookup strategy

Since:

2.1.0

setSSOBypassFieldName

public void setSSOBypassFieldName(@Nonnull @NotEmpty
 String fieldName)

Set the SSO bypass parameter name.

Parameters:

fieldName - the SSO bypass parameter name

Since:

2.1.0

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AuthenticationContext authenticationContext)

Overrides:

doExecute in class AbstractAuthenticationAction

doPasswordless

private boolean doPasswordless(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AuthenticationContext authenticationContext,
 @Nonnull
 DuoOIDCAuthenticationContext duoContext,
 @Nonnull
 DuoPasswordlessContext passwordlessContext)

Perform standard context creation and lookups.

Parameters:

profileRequestContext - profile request context

authenticationContext - authentication context

duoContext - newly created Duo context

passwordlessContext - Duo passwordless context

Returns:

true iff processing should continue

doStandard

private boolean doStandard(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 DuoOIDCAuthenticationContext duoContext)

Perform standard context creation and lookups.

Parameters:

profileRequestContext - profile request context

duoContext - newly created Duo context

Returns:

true iff processing should continue

computeAndStoreRedirectURIIfSupported

private void computeAndStoreRedirectURIIfSupported(@Nonnull
 DuoOIDCIntegration duoIntegration,
 @Nonnull
 HttpServletRequest request,
 @Nonnull
 DuoOIDCAuthenticationContext context)
                                            throws DuoException

For DynamicDuoOIDCIntegrations, apply the redirect_uri creation strategy to compute a redirect_uri to use.

The redirect_uri is computed for each request, but is only set once as the usable redirect_uri on the integration itself i.e. for the client to read using DuoOIDCIntegration.getRedirectURI(). This allows all clients to see a computed (by the redirectURICreationStrategy) redirect_uri from the first request onward.

The computed redirect_uri is also added to the context as an override redirect_uri which - if supported by the client - can be used dynamically when creating authorization or token exchange requests.

Parameters:

duoIntegration - the Duo integration pertaining to this request.

request - the http servlet request.

context - the Duo authentication context to store the computed override redirect_uri.

Throws:

DuoException - if the redirect_uri could not be created by the strategy.