Package net.shibboleth.idp.plugin.authn.duo

Class DefaultDuoOIDCIntegration

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.idp.plugin.authn.duo.DefaultDuoOIDCIntegration
All Implemented Interfaces:
PrincipalSupportingComponent, DuoOIDCIntegration, DynamicDuoOIDCIntegration, Component, DestructableComponent, InitializableComponent
@ThreadSafe public final class DefaultDuoOIDCIntegration extends AbstractInitializableComponent implements DynamicDuoOIDCIntegration
Data wrapper for use with Duo OIDC integrations. Holds shared-state.

Despite most fields being 'effectively immutable' once published by Spring, the redirectURI is allowed to change, but in a guarded, shared-thread-safe manor.

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • passwordless

      private boolean passwordless
      Passwordless indicator.

    • apiHost

      @NonnullAfterInit @NotEmpty private String apiHost
      API host.

    • clientId

      @NonnullAfterInit @NotEmpty private String clientId
      Integration key.

    • secretKey

      @NonnullAfterInit @NotEmpty private String secretKey
      Secret key.

    • redirectURI

      @Nullable private String redirectURI
      The used (by clients) redirect_uri to send the client after authorisation .

    • registeredRedirectURI

      @Nullable private String registeredRedirectURI
      A statically set (pre-registered) redirectURI to send the client to after authorisation.

    • allowedOrigins

      @Nonnull @NonnullElements private Set<String> allowedOrigins
      A set of 'allowed' origins that can be used as the scheme, host, and port portion of the redirectURI.

    • allowedFactors

      @Nullable @NonnullElements private Set<String> allowedFactors
      A set of 'allowed' factors.

    • healthEndpoint

      @NonnullAfterInit @NotEmpty private String healthEndpoint
      The URL path to the health endpoint.

    • authorizeEndpoint

      @NonnullAfterInit @NotEmpty private String authorizeEndpoint
      The URL path to the authorization endpoint.

    • tokenEndpoint

      @NonnullAfterInit @NotEmpty private String tokenEndpoint
      The URL path to the token endpoint.

    • supportedPrincipals

      @Nonnull private final Subject supportedPrincipals
      Container for supported principals.

    • contextToPrincipalMappingStrategy

      @Nullable private Function<ProfileRequestContext,Collection<Principal>> contextToPrincipalMappingStrategy
      Hook to map context information to principal collections.

  • Constructor Details

    • DefaultDuoOIDCIntegration

      public DefaultDuoOIDCIntegration()
      Constructor.

  • Method Details

    • setPasswordless

      public void setPasswordless(boolean flag)
      Sets whether this integration is suitable for use as a single factor.

      Defaults to false.

      Parameters:
      flag - flag to set
      Since:
      2.1.0

    • isPasswordless

      public boolean isPasswordless()
      Gets whether the integration is suitable for use as a passwordless single factor.

      Defaults to false.

      Specified by:
      isPasswordless in interface DuoOIDCIntegration
      Returns:
      true iff the integration limits methods to passwordless

    • setAllowedOrigins

      public void setAllowedOrigins(@Nullable @NonnullElements Collection<String> hosts)
      Set the origins that are allowed to form the scheme, host, and port part of a computed redirect_uri.
      Parameters:
      hosts - the hostnames to allow.

    • getAllowedOrigins

      @Nonnull @NotLive @Unmodifiable public Set<String> getAllowedOrigins()
      Get a list of URL origins that are allowed to appear in computed redirect URIs.
      Specified by:
      getAllowedOrigins in interface DynamicDuoOIDCIntegration
      Returns:
      a set of unmodifiable allowed origins. Never null but could be empty.

    • setAllowedFactors

      public void setAllowedFactors(@Nullable @NonnullElements Collection<String> factors)
      Set the allowable factors.
      Parameters:
      factors - the factors to allow
      Since:
      2.1.0

    • getAllowedFactors

      @Nullable @NotLive @Unmodifiable public Set<String> getAllowedFactors()
      Gets the set of allowable factors to enforce during validation.
      Specified by:
      getAllowedFactors in interface DuoOIDCIntegration
      Returns:
      allowable factors, or null for any

    • getAPIHost

      @Nonnull @NotEmpty public String getAPIHost()
      Get the name of the API host to contact.
      Specified by:
      getAPIHost in interface DuoOIDCIntegration
      Returns:
      name of API host

    • setAPIHost

      public void setAPIHost(@Nonnull @NotEmpty String host)
      Set the API host to use.
      Parameters:
      host - API host

    • getHealthCheckEndpoint

      @Nonnull @NotEmpty public String getHealthCheckEndpoint()
      Get the path of the health check endpoint.
      Specified by:
      getHealthCheckEndpoint in interface DuoOIDCIntegration
      Returns:
      the path of the health check endpoint

    • setHealthCheckEndpoint

      public void setHealthCheckEndpoint(@Nonnull @NotEmpty String endpoint)
      Set the health check endpoint URL path.
      Parameters:
      endpoint - the endpoint.

    • getAuthorizeEndpoint

      @Nonnull @NotEmpty public String getAuthorizeEndpoint()
      Get the path of the authorization endpoint.
      Specified by:
      getAuthorizeEndpoint in interface DuoOIDCIntegration
      Returns:
      the path of the authorization endpoint

    • setAuthorizeEndpoint

      public void setAuthorizeEndpoint(@Nonnull @NotEmpty String endpoint)
      Set the authorize endpoint URL path.
      Parameters:
      endpoint - the endpoint.

    • getTokenEndpoint

      @Nonnull @NotEmpty public String getTokenEndpoint()
      Get the path of the token endpoint.
      Specified by:
      getTokenEndpoint in interface DuoOIDCIntegration
      Returns:
      the path of the token endpoint;

    • setTokenEndpoint

      public void setTokenEndpoint(@Nonnull @NotEmpty String endpoint)
      Set the token endpoint URL path.
      Parameters:
      endpoint - the endpoint.

    • getRedirectURI

      @Nullable public String getRedirectURI()
      Get the runtime redirectURI to direct the client to after authorisation.
      Specified by:
      getRedirectURI in interface DuoOIDCIntegration
      Returns:
      the redirectURI

    • setRegisteredRedirectURI

      public void setRegisteredRedirectURI(@Nullable String uri)
      Set the redirect_uri to use.
      Parameters:
      uri - the redirect_uri

    • getRegisteredRedirectURI

      @Nullable public String getRegisteredRedirectURI()
      Get the static pre-registered redirect_uri.
      Specified by:
      getRegisteredRedirectURI in interface DynamicDuoOIDCIntegration
      Returns:
      the pre-registered redirect_uri.

    • isRedirectURIPreregistered

      public boolean isRedirectURIPreregistered()
      Has a redirectURI been pre-registered i.e. set in the properties file.
      Specified by:
      isRedirectURIPreregistered in interface DynamicDuoOIDCIntegration
      Returns:
      true iff DynamicDuoOIDCIntegration.getRegisteredRedirectURI() is not null, false otherwise.

    • setRedirectURIIfAbsent

      public void setRedirectURIIfAbsent(@Nonnull @NotEmpty String computedRedirectURI)

      Set the redirectURI from the one given in a thread-safe way.

      Once set, DuoOIDCIntegration.getRedirectURI() should return the value of computedRedirectURI.

      This is a sate changing operation, and should be thread-safe in its operation, as the integration will be shared amongst threads e.g. synchronize the method call.

      Specified by:
      setRedirectURIIfAbsent in interface DynamicDuoOIDCIntegration
      Parameters:
      computedRedirectURI - the runtime computed redirectURI.

    • setClientId

      public void setClientId(@Nonnull @NotEmpty String id)
      Set the client ID to use.
      Parameters:
      id - the client identifier.

    • getClientId

      @Nonnull @NotEmpty public String getClientId()
      Get the clientId key.
      Specified by:
      getClientId in interface DuoOIDCIntegration
      Returns:
      the integration key

    • setSecretKey

      public void setSecretKey(@Nonnull @NotEmpty String key)
      Set the secret key to use.
      Parameters:
      key - secret key

    • getSecretKey

      @Nonnull @NotEmpty public String getSecretKey()
      Get the secret key.
      Specified by:
      getSecretKey in interface DuoOIDCIntegration
      Returns:
      the secret key

    • getSupportedPrincipals

      @Nonnull @NonnullElements @Unmodifiable public <T extends Principal> Set<T> getSupportedPrincipals(@Nonnull Class<T> c)
      Specified by:
      getSupportedPrincipals in interface PrincipalSupportingComponent

    • setSupportedPrincipals

      public <T extends Principal> void setSupportedPrincipals(@Nullable @NonnullElements Collection<T> principals)
      Set supported non-user-specific principals that the action will include in the subjects it generates, in place of any default principals from the flow.

      Setting to a null or empty collection will maintain the default behavior of relying on the flow.

      Type Parameters:
      T - a type of principal to add, if not generic
      Parameters:
      principals - supported principals to include

    • setContextToPrincipalMappingStrategy

      public void setContextToPrincipalMappingStrategy(@Nullable Function<ProfileRequestContext,Collection<Principal>> hook)
      Set the context to principal mapping strategy for mapping context information into principal collections.
      Parameters:
      hook - principal mapping hook

    • getContextToPrincipalMappingStrategy

      @Nullable public Function<ProfileRequestContext,Collection<Principal>> getContextToPrincipalMappingStrategy()
      Get the context to principal mapping strategy for mapping context information into principal collections.
      Specified by:
      getContextToPrincipalMappingStrategy in interface DuoOIDCIntegration
      Returns:
      the mapping hook

    • doInitialize

      protected void doInitialize() throws ComponentInitializationException
      Overrides:
      doInitialize in class AbstractInitializableComponent
      Throws:
      ComponentInitializationException

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object

    • equals

      public boolean equals(Object obj)
      Overrides:
      equals in class Object

    • toString

      public String toString()
      Overrides:
      toString in class Object