Package net.shibboleth.idp.plugin.authn.duo.impl

Class ValidateDuoTokenAuthenticationResult

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.authn.AbstractAuthenticationAction

net.shibboleth.idp.authn.AbstractValidationAction

net.shibboleth.idp.authn.impl.AbstractAuditingValidationAction

net.shibboleth.idp.plugin.authn.duo.impl.ValidateDuoTokenAuthenticationResult

All Implemented Interfaces:

PrincipalSupportingComponent, Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class ValidateDuoTokenAuthenticationResult
extends AbstractAuditingValidationAction

A validation action that checks for a valid Duo authentication token and directly produces an AuthenticationResult based on the identity described by the token.

Event:

EventIds.PROCEED_EVENT_ID, AuthnEventIds.AUTHN_EXCEPTION, AuthnEventIds.INVALID_AUTHN_CTX

Precondition:

      ProfileRequestContext.getSubcontext(AuthenticationContext.class, false) != null
      

,

      AuthenticationContext.getSubcontext(DuoOIDCAuthenticationContext.class, false) != null
      

Field Summary

Fields

Modifier and Type	Field	Description
private com.nimbusds.jwt.JWTClaimsSet	claimsSet	The parsed claimset.
private Function<ProfileRequestContext,Collection<Principal>>	contextToPrincipalMappingStrategy	Hook to map context information (often Duo factors in the Duo token) to principal collections.
private static final String	DEFAULT_METRIC_NAME	Default prefix for metrics.
private DuoOIDCAuthenticationContext	duoContext	Duo authentiction context.
private DuoOIDCIntegration	duoIntegration	The Duo integration.
private String	factorUsed	Factor used.
private final org.slf4j.Logger	log	Class logger.
private ProfileRequestContext	prc	The profile request context.
private String	username	Attempted username.

Constructor Summary

Constructors

Constructor	Description
ValidateDuoTokenAuthenticationResult()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	buildAuthenticationResult(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)
protected void	doExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)
private Instant	extractAuthenticationTime()	Extract the auth_time claim from the ID Token if present.
private void	extractClaims()	Extract the second-factor used for authentication as taken from the auth_context and other details to be stored in the Duo context.
Function<ProfileRequestContext,Collection<Principal>>	getContextToPrincipalMappingStrategy()	Get the context to principal mapping strategy for mapping context information into principal collections e.g.
protected Subject	populateSubject(Subject subject)
void	setContextToPrincipalMappingStrategy(Function<ProfileRequestContext,Collection<Principal>> hook)	Set the context to principal mapping strategy for mapping context information into principal collections e.g.

Methods inherited from class net.shibboleth.idp.authn.impl.AbstractAuditingValidationAction

doAudit, doExecute, getAuditContext, getAuditFields, recordFailure, recordSuccess, setAuditContextCreationStrategy, setPopulateAuditContextAction, setWriteAuditLogAction

Methods inherited from class net.shibboleth.idp.authn.AbstractValidationAction

addDefaultPrincipals, getClassifiedErrors, getCleanupHook, getMetricName, getRequesterLookupStrategy, getResponderLookupStrategy, getResultCachingPredicate, getSubject, getSupportedPrincipals, handleError, handleError, handleWarning, setAddDefaultPrincipals, setClassifiedMessages, setCleanupHook, setMetricName, setRequesterLookupStrategy, setResponderLookupStrategy, setResultCachingPredicate, setSupportedPrincipals

Methods inherited from class net.shibboleth.idp.authn.AbstractAuthenticationAction

doExecute, doPreExecute, setAuthenticationContextLookupStrategy

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

DEFAULT_METRIC_NAME

@Nonnull
@NotEmpty
private static final String DEFAULT_METRIC_NAME

Default prefix for metrics.

See Also:

• Constant Field Values

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

contextToPrincipalMappingStrategy

@Nullable
private Function<ProfileRequestContext,Collection<Principal>> contextToPrincipalMappingStrategy

Hook to map context information (often Duo factors in the Duo token) to principal collections.

prc

@Nullable
private ProfileRequestContext prc

The profile request context.

duoContext

@NonnullBeforeExec
private DuoOIDCAuthenticationContext duoContext

Duo authentiction context.

duoIntegration

@NonnullBeforeExec
private DuoOIDCIntegration duoIntegration

The Duo integration.

claimsSet

@NonnullBeforeExec
private com.nimbusds.jwt.JWTClaimsSet claimsSet

The parsed claimset.

username

@NonnullBeforeExec
@NotEmpty
private String username

Attempted username.

factorUsed

@Nullable
private String factorUsed

Factor used.

Constructor Details

ValidateDuoTokenAuthenticationResult

public ValidateDuoTokenAuthenticationResult()

Constructor.

Method Details

getContextToPrincipalMappingStrategy

@Nullable
public Function<ProfileRequestContext,Collection<Principal>> getContextToPrincipalMappingStrategy()

Get the context to principal mapping strategy for mapping context information into principal collections e.g. Duo factors.

Returns:

the mapping hook

setContextToPrincipalMappingStrategy

public void setContextToPrincipalMappingStrategy(@Nullable
 Function<ProfileRequestContext,Collection<Principal>> hook)

Set the context to principal mapping strategy for mapping context information into principal collections e.g. Duo factors.

Parameters:

hook - principal mapping hook

doPreExecute

protected boolean doPreExecute(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AuthenticationContext authenticationContext)

Overrides:

doPreExecute in class AbstractValidationAction

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AuthenticationContext authenticationContext)

Overrides:

doExecute in class AbstractAuthenticationAction

extractAuthenticationTime

@Nullable
private Instant extractAuthenticationTime()

Extract the auth_time claim from the ID Token if present. Return null if not present or there is an error in obtaining the value.

Returns:

the authentication time, or null if the claim is absent or cannot be parsed

extractClaims

private void extractClaims()

Extract the second-factor used for authentication as taken from the auth_context and other details to be stored in the Duo context.

populateSubject

@Nonnull
protected Subject populateSubject(@Nonnull
 Subject subject)

Specified by:

populateSubject in class AbstractValidationAction

buildAuthenticationResult

protected void buildAuthenticationResult(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AuthenticationContext authenticationContext)

Overrides:

buildAuthenticationResult in class AbstractValidationAction