Package net.shibboleth.idp.plugin.authn.duo.impl

Class DuoAuthenticationTimeClaimsValidator

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator
net.shibboleth.idp.plugin.authn.duo.impl.DuoAuthenticationTimeClaimsValidator
All Implemented Interfaces:
ClaimsValidator, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent
public class DuoAuthenticationTimeClaimsValidator extends AbstractClaimsValidator
A Duo specific version of the AuthenticationTimeClaimsValidator that performs the same logic but does not throw an error if the setAuthnLifetimeLookupStrategy(java.util.function.Function) returns null, instead it ignores the check.

The logic defined by this validator depends on the result of the authnLifetimeLookupStrategy. That is:

  • A null lifetime indicates that authentication time validation should not be enforced.
  • A lifetime of Duration.ZERO indicates that fresh authentication is required. In this case, the auth_time value must be later than the time at which the authentication request was made.
  • A positive lifetime indicates the maximum permitted age of the authentication. In this case, the auth_time value must fall within the specified lifetime window, subject to any configured clock skew allowance.
TODO: remove the Duo specific version if oidc-common supports null authnLifetimeLookupStrategy outcomes

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • authnLifetimeLookupStrategy

      @Nonnull private Function<ProfileRequestContext,Duration> authnLifetimeLookupStrategy
      Lookup strategy to find the amount of time for which a token is valid after if it was first issued. (Default value: 60 seconds)

    • authnRequestTimeLookupStrategy

      @Nonnull private Function<ProfileRequestContext,Instant> authnRequestTimeLookupStrategy
      Lookup strategy to find the time at which the authentication request was made. Defaults to now minus the clockskew.

    • clockSkew

      @Nonnull private Duration clockSkew
      Positive clock skew adjustment to consider when checking auth_time is not in the future or has expired. (Default value: 60 seconds).

  • Constructor Details

    • DuoAuthenticationTimeClaimsValidator

      public DuoAuthenticationTimeClaimsValidator()
      Constructor.

  • Method Details

    • setClockSkew

      public void setClockSkew(@Nonnull Duration skew)
      Set the clock skew.
      Parameters:
      skew - clock skew to set

    • setAuthnRequestTimeLookupStrategy

      public void setAuthnRequestTimeLookupStrategy(Function<ProfileRequestContext,Instant> strategy)
      Set the lookup strategy to find out when the authentication request (if any) was made.
      Parameters:
      strategy - the strategy

    • setAuthnLifetime

      public void setAuthnLifetime(@Nonnull Duration lifetime)
      Sets the amount of time for which a token is valid from when the original authentication took place.
      Parameters:
      lifetime - amount of time for which a token is valid

    • setAuthnLifetimeLookupStrategy

      public void setAuthnLifetimeLookupStrategy(@Nonnull Function<ProfileRequestContext,Duration> strategy)
      Set the lookup strategy used to locate the amount of time for which a token is valid from when the original authentication took place.
      Parameters:
      strategy - the strategy
      Since:
      2.2.0

    • doValidate

      public void doValidate(@Nonnull com.nimbusds.jwt.JWTClaimsSet claimsSet, @Nonnull ProfileRequestContext context) throws JWTValidationException
      Specified by:
      doValidate in class AbstractClaimsValidator
      Throws:
      JWTValidationException