Package net.shibboleth.idp.plugin.authn.duo.impl

Class DefaultDuoAdminClient

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.idp.plugin.authn.duo.impl.DefaultDuoAdminClient
All Implemented Interfaces:
DuoAdminClient, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent
@ThreadSafeAfterInit public class DefaultDuoAdminClient extends AbstractIdentifiableInitializableComponent implements DuoAdminClient
The default implementation of the DuoAdminClient for looking up information from the DuoAdmin API.

This class is thread-safe and can be re-used once published.

Since:
2.1.0

  • Field Details

    • DEFAULT_BACKOFF_FACTOR

      private static final int DEFAULT_BACKOFF_FACTOR
      Default rate limiting backoff multiplier.
      See Also:

    • DEFAULT_INITIAL_BACKOFF_MS

      private static final int DEFAULT_INITIAL_BACKOFF_MS
      Default initial backoff delay.
      See Also:

    • DEFAULT_MAX_BACKOFF_MS

      private static final int DEFAULT_MAX_BACKOFF_MS
      Default maximum backoff.
      See Also:

    • RATE_LIMIT_ERROR_CODE

      private static final int RATE_LIMIT_ERROR_CODE
      The error returned for rate limiting rejection.
      See Also:

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • backoffFactor

      private int backoffFactor
      Rate limiting backoff multiplier.

    • initialBackoff

      private int initialBackoff
      Initial rate limiting delay.

    • maxBackoff

      private int maxBackoff
      Maximum backoff delay.

    • random

      @Nonnull private final Random random
      Generates random backoff delay.

    • httpClient

      @NonnullAfterInit private org.apache.hc.client5.http.classic.HttpClient httpClient
      HttpClient for contacting Duo.

    • httpClientSecurityParameters

      @Nullable private HttpClientSecurityParameters httpClientSecurityParameters
      HTTP client security parameters.

    • objectMapper

      @NonnullAfterInit private com.fasterxml.jackson.databind.ObjectMapper objectMapper
      JSON object mapper.

    • adminDuoIntegrationLookupStrategy

      @Nonnull private Function<ProfileRequestContext,DuoIntegration> adminDuoIntegrationLookupStrategy
      Lookup strategy for Duo integration for Admin API use.

    • usersAdminEndpoint

      @Nonnull @NotEmpty private String usersAdminEndpoint
      The location of the users admin endpoint.

  • Constructor Details

    • DefaultDuoAdminClient

      public DefaultDuoAdminClient()
      Constructor.

  • Method Details

    • setBackoffFactor

      public void setBackoffFactor(int factor)
      Set the rate limiting multipler factor.
      Parameters:
      factor - multipler

    • setInitialBackoff

      public void setInitialBackoff(int backoff)
      Set the initial backoff delay.
      Parameters:
      backoff - initial backoff

    • setMaxBackoff

      public void setMaxBackoff(int backoff)
      Set the maximum backoff delay.
      Parameters:
      backoff - maximum backoff

    • setHttpClient

      public void setHttpClient(@Nonnull org.apache.hc.client5.http.classic.HttpClient client)
      Set the HttpClient to use for contacting Duo.
      Parameters:
      client - HttpClient

    • setHttpClientSecurityParameters

      public void setHttpClientSecurityParameters(@Nullable HttpClientSecurityParameters params)
      Set the optional client security parameters.
      Parameters:
      params - the new client security parameters

    • setObjectMapper

      public void setObjectMapper(@Nonnull com.fasterxml.jackson.databind.ObjectMapper mapper)
      Set the JSON ObjectMapper.
      Parameters:
      mapper - object mapper

    • setAdminDuoIntegrationLookupStrategy

      public void setAdminDuoIntegrationLookupStrategy(@Nonnull Function<ProfileRequestContext,DuoIntegration> strategy)
      Set the lookup strategy to use to locate the Duo Admin API integration.
      Parameters:
      strategy - The lookup strategy to set.

    • setUsersAdminEndpoint

      public void setUsersAdminEndpoint(@Nonnull @NotEmpty String endpoint)
      Set the /users admin endpoint.
      Parameters:
      endpoint - The users admin endpoint to set.

    • doInitialize

      protected void doInitialize() throws ComponentInitializationException
      Overrides:
      doInitialize in class AbstractIdentifiedInitializableComponent
      Throws:
      ComponentInitializationException

    • getUser

      @Nullable public User getUser(@Nonnull ProfileRequestContext context, @Nonnull String username) throws DuoException
      Get the User that corresponds to the given username from the Duo Admin API.
      Specified by:
      getUser in interface DuoAdminClient
      Parameters:
      context - context the profile request context, typically used in locating the DuoIntegration to use
      username - a user name (or username alias) to look up a single user
      Returns:
      the User iff found, or null
      Throws:
      DuoException - on error retrieving a response from the API

    • retrieve

      @Nonnull public <T extends DuoAdminResponseWrapper<?>> T retrieve(@Nonnull ProfileRequestContext context, @Nonnull @NotEmpty String path, @Nullable @NonnullElements Map<String,String> parameters, @Nonnull com.fasterxml.jackson.core.type.TypeReference<T> wrapperTypeRef) throws DuoException
      Generic method for returning a type of DuoAdminResponseWrapper response from the given path and parameters.

      Note, only GET requests should be allowed and hence only retrieval operations should be supported.

      Specified by:
      retrieve in interface DuoAdminClient
      Type Parameters:
      T - the type of response
      Parameters:
      context - the profile request context, typically used in locating the DuoIntegration to use
      path - the path component of the API endpoint
      parameters - any name value pairs to add to the HTTP request parameters
      wrapperTypeRef - the type of response to return
      Returns:
      a DuoAdminResponseWrapper with the correct response type embedded
      Throws:
      DuoException - on error retrieving a response from the API

    • retrieve

      @Nonnull public DuoAdminListMapResponseWrapper retrieve(@Nonnull ProfileRequestContext context, @Nonnull @NotEmpty String path, @Nullable @NonnullElements Map<String,String> parameters) throws DuoException
      Generic method for returning a DuoAdminListMapResponseWrapper response from the given path and parameters.

      Note, only GET requests should be allowed and hence only retrieval operations should be supported.

      Specified by:
      retrieve in interface DuoAdminClient
      Parameters:
      context - the profile request context, typically used in locating the DuoIntegration to use
      path - the path component of the API endpoint
      parameters - any name value pairs to add to the HTTP request parameters
      Returns:
      a DuoAdminListMapResponseWrapper with a List of Maps response type embedded
      Throws:
      DuoException - on error retrieving a response from the API

    • getIntegrationAndCheckComponentActive

      @Nonnull private DuoIntegration getIntegrationAndCheckComponentActive(@Nonnull ProfileRequestContext prc) throws DuoException
      Check the component is active and if it is get the DuoIntegration to use.
      Parameters:
      prc - the profile request context
      Returns:
      the DuoIntegration to use
      Throws:
      DuoException - if the integration does not exist

    • buildRequest

      @Nonnull private org.apache.hc.core5.http.ClassicHttpRequest buildRequest(@Nonnull ProfileRequestContext context, @Nonnull @NotEmpty String path, @Nullable @NonnullElements Map<String,String> parameters) throws DuoException
      Build the HTTP request from the given path and parameters.

      The DuoIntegration is located dynamically. The request is signed using the integration key and secret key from the located integration. Similarly the integration's API host is used as the host component of the URI.

      Parameters:
      context - the profile request context use to locate the DuoIntegration to use
      path - the path component of the API endpoint
      parameters - a map of name value pairs to add to the HTTP request parameters
      Returns:
      the built and signed HTTP request
      Throws:
      DuoException - on error creating the request

    • doAPIRequest

      @Nonnull private <T extends DuoAdminResponseWrapper<?>> T doAPIRequest(@Nonnull org.apache.hc.core5.http.ClassicHttpRequest request, @Nonnull com.fasterxml.jackson.core.type.TypeReference<T> wrapperTypeRef, int backoff) throws DuoException, IOException
      Performs a call to the Duo AdminAPI. Upon a successful call, the JSON response is mapped into the appropriate type of DuoAdminResponseWrapper.
      Type Parameters:
      T - the DuoResponse type being wrapped
      Parameters:
      request - the prepared HTTP request
      wrapperTypeRef - the type of DuoResponseWrapper to use
      backoff - the backoff delay to apply if needed
      Returns:
      a DuoResponseWrapper
      Throws:
      IOException - on an I/O error
      DuoException - on a Duo-related error