Package net.shibboleth.idp.plugin.authn.duo.context

Class DuoOIDCAuthenticationContext

java.lang.Object
org.opensaml.messaging.context.BaseContext
net.shibboleth.idp.plugin.authn.duo.context.DuoOIDCAuthenticationContext
All Implemented Interfaces:
Iterable<BaseContext>
@NotThreadSafe public final class DuoOIDCAuthenticationContext extends BaseContext

Mutable Context that carries the Duo integration, request-response state, authorization code, and Duo authentication result token.

As with other context classes, holds state, is not thread-safe and should be thread-confined.

Parent:
AuthenticationContext
Added:
After extracting the Duo integration for the given authentication request.

  • Field Details

    • username

      @Nullable private String username
      Username.

    • integration

      @Nullable private DuoOIDCIntegration integration
      The selected Duo integration to use for the lifetime of this request.

    • requestState

      @Nullable private String requestState
      A randomly generated 32 character minimum String sent in the Duo 2FA authorization request.

    • responseState

      @Nullable private String responseState
      A randomly generated 32 character minimum String returned in the Duo 2FA authorization response.

    • nonce

      @Nullable private String nonce
      String value used to associate a Client session with an ID Token to mitigate replay attacks.

    • authCode

      @Nullable private String authCode
      The authorization code return from the Duo authorization request.

    • authToken

      @Nullable private com.nimbusds.jwt.JWT authToken
      The JWT token received from Duo as a result of 2FA. Token *must* be signed.

    • factorUsed

      @Nullable private String factorUsed
      The factor claim from the token.

    • deviceKey

      @Nullable private String deviceKey
      Device key used if available.

    • client

      @Nullable private DuoOIDCClient client
      The Duo OIDC client to use for the lifetime of this authentication request.

    • redirectURIOverride

      @Nullable private String redirectURIOverride
      A request-bound redirect URI that was determined at runtime. Used to override the URI inside a DuoOIDCIntegration for supported clients. Allows per-request redirects e.g. useful if one IdP instance is fronted by different virtual hosts.

  • Constructor Details

    • DuoOIDCAuthenticationContext

      public DuoOIDCAuthenticationContext()
      Public no-arg constructor to allow auto-creation.

  • Method Details

    • getRedirectURIOverride

      @Nullable public String getRedirectURIOverride()
      Get the override redirect URI.
      Returns:
      the override redirect URI.

    • setRedirectURIOverride

      @Nonnull public DuoOIDCAuthenticationContext setRedirectURIOverride(@Nullable String override)
      Set the override redirect URI.
      Parameters:
      override - the override redirect URI.
      Returns:
      this context.

    • getNonce

      @Nullable public String getNonce()
      Get the nonce.
      Returns:
      the nonce.

    • setNonce

      @Nonnull public DuoOIDCAuthenticationContext setNonce(@Nullable String oidcNonce)
      Set the OIDC nonce.
      Parameters:
      oidcNonce - the nonce.
      Returns:
      this context.

    • getAuthorizationCode

      @Nullable public String getAuthorizationCode()
      Get the authorization code.
      Returns:
      the authorization code.

    • setAuthorizationCode

      @Nonnull public DuoOIDCAuthenticationContext setAuthorizationCode(@Nullable String code)
      Set the authorization code.
      Parameters:
      code - the authorization code.
      Returns:
      this context.

    • getClient

      @Nullable public DuoOIDCClient getClient()
      Get the client used to communicate with the Duo OIDC API.
      Returns:
      the duo client.

    • setClient

      @Nonnull public DuoOIDCAuthenticationContext setClient(@Nullable DuoOIDCClient duoClient)
      Set the client used to communicate with the Duo OIDC API.
      Parameters:
      duoClient - the duo client.
      Returns:
      this context.

    • setAuthToken

      @Nonnull public DuoOIDCAuthenticationContext setAuthToken(@Nullable com.nimbusds.jwt.JWT token)
      Set the Duo authentication token.
      Parameters:
      token - the duo authentication token
      Returns:
      this context

    • getAuthToken

      @Nullable public com.nimbusds.jwt.JWT getAuthToken()
      Get the Duo authentication token.
      Returns:
      the token

    • setFactorUsed

      @Nonnull public DuoOIDCAuthenticationContext setFactorUsed(@Nullable String factor)
      Set the factor claim from the token.
      Parameters:
      factor - factor claim
      Returns:
      this context
      Since:
      2.1.0

    • getFactorUsed

      @Nullable public String getFactorUsed()
      Get the factor claim from the token.
      Returns:
      factor claim
      Since:
      2.1.0

    • setDeviceKey

      @Nonnull public DuoOIDCAuthenticationContext setDeviceKey(@Nullable String key)
      Set the device key used if available from the token.
      Parameters:
      key - device key
      Returns:
      this context
      Since:
      2.1.0

    • getDeviceKey

      @Nullable public String getDeviceKey()
      Get the device key used if available from the token.
      Returns:
      factor claim
      Since:
      2.1.0

    • getRequestState

      @Nullable public String getRequestState()
      Get the request state.
      Returns:
      the state

    • setRequestState

      @Nonnull public DuoOIDCAuthenticationContext setRequestState(@Nullable String state)
      Set the request state.
      Parameters:
      state - the state.
      Returns:
      this context

    • getResponseState

      @Nullable public String getResponseState()
      Get the response state.
      Returns:
      the state

    • setResponseState

      @Nonnull public DuoOIDCAuthenticationContext setResponseState(@Nullable String state)
      Set the response state.
      Parameters:
      state - the state.
      Returns:
      this context

    • getUsername

      @Nullable public String getUsername()
      Get the username.
      Returns:
      username

    • setUsername

      @Nonnull public DuoOIDCAuthenticationContext setUsername(@Nullable String name)
      Set the username.
      Parameters:
      name - username
      Returns:
      this context

    • setIntegration

      @Nonnull public DuoOIDCAuthenticationContext setIntegration(@Nullable DuoOIDCIntegration duoIntegration)
      Set the Duo integration.
      Parameters:
      duoIntegration - the integration
      Returns:
      this context

    • getIntegration

      @Nullable public DuoOIDCIntegration getIntegration()
      Get the Duo integration.
      Returns:
      the Duo integration