Package net.shibboleth.idp.plugin.authn.duo.impl

Class PostValidatePasswordlessEvaluation

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.idp.authn.AbstractAuthenticationAction
net.shibboleth.idp.plugin.authn.duo.impl.PostValidatePasswordlessEvaluation
All Implemented Interfaces:
Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action
public class PostValidatePasswordlessEvaluation extends AbstractAuthenticationAction
This is a convoluted step that implements some of the cookie management logic needed after second-factor use, but before the possible opt-in to passwordless.

The EventIds.PROCEED_EVENT_ID event is a signal that no further steps are required and the flow should complete as is.

The PROMPT_USER_EVENT event is a signal that the user should be asked to opt into passwordless use in the future, resulting in the creation of a guard cookie.

This action will also remove the cookie if a non-cacheable login happens and is set to react to that, and will remove the cookie if the existing cookie's value doesn't match the username in the transaction.

This is also where the cleanup hook is relocated, in order to defer that step and preserve access to the Duo state.

Since:
2.1.0
Event:
PROMPT_USER_EVENT, EventIds.PROCEED_EVENT_ID, EventIds.INVALID_PROFILE_CTX
Precondition:
      ProfileRequestContext.getSubcontext(AuthenticationContext.class) != null
, 
      AuthenticationContext.getSubcontext(DuoOIDCAuthenticationContext.class) != null
, 
      DuoOIDCAuthenticationContext.getDuoIntegration() != null

  • Field Details

    • PROMPT_USER_EVENT

      @Nonnull @NotEmpty public static final String PROMPT_USER_EVENT
      Custom event to signal that a prompt to opt into passwordless should be presented.
      See Also:

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • cleanupHook

      @Nullable private Consumer<ProfileRequestContext> cleanupHook
      A cleanup hook to execute after processing.

    • passwordlessCondition

      @Nonnull private Predicate<ProfileRequestContext> passwordlessCondition
      Condition governing "new" eligibility.

    • cookieManager

      @NonnullAfterInit private PasswordlessCookieManager cookieManager
      Cookie manager to use.

    • requireResultCacheable

      private boolean requireResultCacheable
      Whether to require the authentication be cacheable to allow this.

    • detectUsernameMismatch

      private boolean detectUsernameMismatch
      Whether to detect mismatches between cookie and current username.

  • Constructor Details

    • PostValidatePasswordlessEvaluation

      public PostValidatePasswordlessEvaluation()
      Constructor.

  • Method Details