Package net.shibboleth.idp.plugin.authn.duo.impl
package net.shibboleth.idp.plugin.authn.duo.impl
Duo OIDC 2FA login flow implementation classes.
-
ClassesClassDescriptionA base class for authentication actions which call a Duo AuthAPI endpont.A profile action to clear the passwordless guard cookie.Finalization action that creates the passwordless guard cookkie based on the canonical principal name after the flow completes.The default implementation of the
DuoAdminClientfor looking up information from the DuoAdmin API.The default Duo Client registry for mapping aDuoOIDCIntegrationto either a new or existingDuoOIDCClient(assumed thread-safe) singleton instance.Constructive, pure, function that returns a redirect_uri from one of (ordered): A pre-registered redirect_uri on the Duo integration,DynamicDuoOIDCIntegration.getRegisteredRedirectURI().Looks up the audience from the clientID in theDuoOIDCIntegrationinside the context.Describes the results of a Duo AuthAPI call, intended for use with a jacksonObjectMapper.Implementation of the the Duo AuthApi /v2/auth endpoint.Describes the results of an authentication attempt via the Duo AuthAPI, intended for use with a jacksonObjectMapper.Represents a Duo device, intended for use with a jacksonObjectMapper.Describes the failure of a Duo AuthAPI call.Find the issuer from theDuoOIDCIntegration.Find the nonce from theDuoOIDCAuthenticationContext.MVC controller for managing Duo 2FA exchanges implemented as anExternalAuthenticationmechanism.Implementation of the the Duo AuthAPI /v2/preauth endpoint.Describes the results of an pre-authentication attempt via the Duo AuthAPI.DuoResponseWrapper<T extends DuoAuthAPIResponse>Handle a generic object returned from the response that will come from the Duo AuthAPI.Helper methods for Duo 2FA.Find the authenticating principals username from theDuoOIDCAuthenticationContext.Action to exchange the authorization code in the Duo 2FA response for a Duo id_token that describes the result of 2FA.An action that extracts the Duo factor and device or passcode from HTTP request headers into aDuoAuthenticationContext, and attaches it to theAuthenticationContext.An action that checks the health of the Duo 2FA endpoint for the established Duo integration.An action to create (or lookup) and populate theDuoOIDCAuthenticationContextwith the username, chosenDuoOIDCIntegration, andDuoOIDCClientappropriate for this request.A profile action to extract passwordless username from a sealed cookie and populate it into an existingDuoPasswordlessContext.This is a convoluted step that implements some of the cookie management logic needed after second-factor use, but before the possible opt-in to passwordless.An action that checks for aDuoAuthenticationContextand directly produces anAuthenticationResultbased on that identity by authenticating against the Duo AuthAPI.Authentication action that validates the Duo response state parameter (which is required in the Duo flow) matches that in the 2FA request.A validation action that checks for a valid Duo authentication token and directly produces anAuthenticationResultbased on the identity described by the token.An action that checks for anExternalAuthenticationContextfor a signaled event via theExternalAuthenticationContext.getAuthnError()method.Action that validates the claims of the Duo id_token using the suppliedClaimsValidator.A cleanup hook that removes the 'nonce' parameter from theDuoOIDCAuthenticationContextso it could not be reused.Action to validate the JWT signature.