Package net.shibboleth.idp.plugin.authn.duo

Class DuoAuthenticationLifetimeLookupStrategy

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.idp.plugin.authn.duo.DuoAuthenticationLifetimeLookupStrategy
All Implemented Interfaces:
Function<ProfileRequestContext,Duration>, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent
public class DuoAuthenticationLifetimeLookupStrategy extends AbstractIdentifiableInitializableComponent implements Function<ProfileRequestContext,Duration>
An authentication lifetime lookup strategy that determines the authentication lifetime to enforce.

The lifetime is determined as follows:

  1. If the DuoOIDCIntegration explicitly specifies a maximum authentication age, that value is used.
  2. Otherwise, if a non-zero max_age value was stored in the DuoOIDCAuthenticationContext , that value is used.
  3. Otherwise, if a fresh authentication was requested (max_age=0), the reauthentication lifetime lookup strategy is used.
  4. Otherwise, the default authentication lifetime lookup strategy is used.

If either lookup strategy returns null or if no lifetime can be determined, null is returned. Callers should interpret null as meaning that no authentication lifetime should be enforced.

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • authnLifetimeLookupStrategy

      @Nonnull private Function<ProfileRequestContext,Duration> authnLifetimeLookupStrategy
      Lookup strategy to find the amount of time for which the auth_time inside a token is valid for. Used when no request-specific authentication age requirement has been established.

    • reauthnLifetimeLookupStrategy

      @Nonnull private Function<ProfileRequestContext,Duration> reauthnLifetimeLookupStrategy
      Lookup strategy to find the amount of time for which the auth_time inside a token is valid for when a 'fresh' authentication is requested. Used when no request-specific authentication age requirement has been established from the Duo Integration used.

  • Constructor Details

    • DuoAuthenticationLifetimeLookupStrategy

      public DuoAuthenticationLifetimeLookupStrategy()
      Constructor.

  • Method Details

    • setReauthnLifetime

      public void setReauthnLifetime(@Nullable Duration lifetime)
      Sets the amount of time for which the auth_time inside a token is valid for. This only applies to requests that require a fresh authentication and no integration-specific authentication age override is present.
      Parameters:
      lifetime - amount of time for which the auth_time inside a token is valid for. Can be null if a lifetime should not be enforced.

    • setReauthnLifetimeLookupStrategy

      public void setReauthnLifetimeLookupStrategy(@Nonnull Function<ProfileRequestContext,Duration> strategy)
      Sets the strategy to determine the amount of time for which the auth_time inside a token is valid for. This only applies to requests that require a fresh authentication and no integration-specific authentication age override is present.
      Parameters:
      strategy - the strategy. Can return null if a lifetime should not be enforced.

    • setAuthnLifetime

      public void setAuthnLifetime(@Nullable Duration lifetime)
      Set the Lookup strategy to find the default amount of time for which the auth_time inside a token is valid for. This only applies to requests that did not specify an authentication age.
      Parameters:
      lifetime - amount of time for which the auth_time inside a token is valid for. Can be null if a lifetime should not be enforced.

    • setAuthnLifetimeLookupStrategy

      public void setAuthnLifetimeLookupStrategy(@Nonnull Function<ProfileRequestContext,Duration> strategy)
      Set the Lookup strategy to find the default amount of time for which the auth_time inside a token is valid for. This only applies to requests that did not specify an authentication age.
      Parameters:
      strategy - the strategy. Can return null if a lifetime should not be enforced.

    • apply

      public Duration apply(@Nullable ProfileRequestContext prc)
      Specified by:
      apply in interface Function<ProfileRequestContext,Duration>