Package net.shibboleth.idp.plugin.authn.duo

Interface DuoOIDCClient

All Superinterfaces:
DuoOIDCClientCapabilities
All Known Implementing Classes:
AbstractDuoOIDCClient, DuoSDKClientAdaptor, NimbusClient
public interface DuoOIDCClient extends DuoOIDCClientCapabilities
A client for handling Duo OIDC 2FA interactions. Clients are shared and required to be thread-safe.

  • Method Details

    • getCapabilities

      @Nonnull DuoOIDCClientCapabilities getCapabilities()
      Returns the capabilities of the underlying client.
      Returns:
      interface to access the service's capabilities

    • healthCheck

      @Nonnull DuoHealthCheck healthCheck() throws DuoClientException
      Check the health of the Duo 2FA endpoint and the clients configuration.
      Returns:
      the heath check response, never null.
      Throws:
      DuoClientException - if there is an error returning the health check response.

    • createAuthUrl

      @Nonnull @NotEmpty String createAuthUrl(@Nonnull @NotEmpty String username, @Nonnull @NotEmpty String state, @Nullable String nonce, @Nullable String redirectURIOverride) throws DuoClientException
      Constructs an authorization redirection URL string with the query parameters required to initiate a Duo 2FA request.
      Parameters:
      username - The user to be authenticated by Duo, never null.
      state - A randomly generated minimum 22 character String, which is relayed back to the client, never null.
      nonce - a randomly generated (minimum 22 character) cryptographically secure nonce that is replayed in the id_token. Can be null if not supported by the client as indicated by the clients described capabilities.
      redirectURIOverride - the redirectURI to use in the authorization request. If not null and the client supports dynamic redirect URIs, it should override any redirect_uri held internally to the client e.g. from the DuoOIDCIntegration. If the client does not support dynamic redirect URIs, it can be ignored in favour of one held internally.
      Returns:
      the authorization redirect URL as a string, never null.
      Throws:
      DuoClientException - if there is an error creating the authentication URL.

    • exchangeAuthorizationCodeFor2FAResult

      @Nonnull com.nimbusds.jwt.JWT exchangeAuthorizationCodeFor2FAResult(@Nonnull String code, @Nonnull String username, @Nullable String redirectURIOverride) throws DuoClientException
      Exchanges the authorizaton code for a signed Json Web Token (JWT) which contains information pertaining to the authentication. There is no requirement on the client to verify the tokens authenticity or claims - these should be performed elsewhere in the flow. The JWT **must** be signed.
      Parameters:
      code - An authentication identifier which is exchanged (per OAuth2.0 spec) with Duo for a token. the token can be used to determine if authentication was successful as well as obtain meta-data about the authentication, never null. *
      username - The user to be authenticated by Duo, never null.
      redirectURIOverride - the redirectURI to use in the code exchange request. If not null and the client supports dynamic redirect URIs, it should override any redirect_uri held internally to the client e.g. from the DuoOIDCIntegration. If the client does not support dynamic redirect URIs, it can be ignored in favour of one held internally.
      Returns:
      the **signed** JWT, never null.
      Throws:
      DuoClientException - if there is an error exchanging the auth_code for a token result.

    • getClientId

      @Nonnull String getClientId()
      Get an identifier for this client e.g. a UUID. Only for logging and debugging.
      Returns:
      the client identifier.