Package net.shibboleth.idp.authn.duo.impl

Class ValidateDuoAuthAPI

  • All Implemented Interfaces:
    net.shibboleth.idp.authn.principal.PrincipalSupportingComponent, net.shibboleth.utilities.java.support.component.Component, net.shibboleth.utilities.java.support.component.DestructableComponent, net.shibboleth.utilities.java.support.component.InitializableComponent, org.opensaml.profile.action.ProfileAction, Aware, MessageSource, MessageSourceAware, Action
    public class ValidateDuoAuthAPI
extends net.shibboleth.idp.authn.AbstractValidationAction
    An action that checks for a DuoAuthenticationContext and directly produces an AuthenticationResult based on that identity by authenticating against the Duo AuthAPI.
    Event:
    EventIds.PROCEED_EVENT_ID, AuthnEventIds.AUTHN_EXCEPTION, AuthnEventIds.ACCOUNT_LOCKED, AuthnEventIds.ACCOUNT_WARNING, AuthnEventIds.ACCOUNT_ERROR, AuthnEventIds.NO_CREDENTIALS, AuthnEventIds.INVALID_CREDENTIALS
    Precondition:
          ProfileRequestContext.getSubcontext(AuthenticationContext.class).getAttemptedFlow() != null
    Postcondition:
    If AuthenticationContext.getSubcontext(DuoAuthenticationContext.class) != null, then an AuthenticationResult is saved to the AuthenticationContext on a successful login. On a failed login, the AbstractValidationAction.handleError(ProfileRequestContext, AuthenticationContext, String, String) method is called.

    • Method Summary

      All Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      protected void buildAuthenticationResult​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
      protected void doExecute​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
      protected void doInitialize()
      protected boolean doPreExecute​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
      protected Subject populateSubject​(Subject subject)
      void setAuthAuthenticator​(DuoAuthAuthenticator authenticator)
      Set the DuoAuthAuthenticator.
      void setDuoIntegration​(net.shibboleth.idp.authn.duo.DuoIntegration duo)
      Set DuoIntegration details to use directly.
      void setDuoIntegrationLookupStrategy​(Function<org.opensaml.profile.context.ProfileRequestContext,​net.shibboleth.idp.authn.duo.DuoIntegration> strategy)
      Set DuoIntegration lookup strategy to use.
      void setPreauthAuthenticator​(DuoPreauthAuthenticator authenticator)
      Set the DuoPreauthAuthenticator.
      void setUsernameLookupStrategy​(Function<org.opensaml.profile.context.ProfileRequestContext,​String> strategy)
      Set the lookup strategy to use for the username to match against Duo identity.

      • Methods inherited from class net.shibboleth.idp.authn.AbstractValidationAction

        addDefaultPrincipals, getClassifiedErrors, getMetricName, getRequesterLookupStrategy, getResponderLookupStrategy, getResultCachingPredicate, getSubject, getSupportedPrincipals, handleError, handleError, handleWarning, recordFailure, recordSuccess, setAddDefaultPrincipals, setClassifiedMessages, setMetricName, setRequesterLookupStrategy, setResponderLookupStrategy, setResultCachingPredicate, setSupportedPrincipals

      • Methods inherited from class net.shibboleth.idp.authn.AbstractAuthenticationAction

        doExecute, doPreExecute, setAuthenticationContextLookupStrategy

      • Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

        doExecute, execute, getMessage, getMessage, getMessage, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

      • Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

        getActivationCondition, setActivationCondition

      • Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

        doPostExecute, doPostExecute, execute, getHttpServletRequest, getHttpServletResponse, getLogPrefix, setHttpServletRequest, setHttpServletResponse

      • Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

        destroy, doDestroy, initialize, isDestroyed, isInitialized

      • Methods inherited from interface net.shibboleth.utilities.java.support.component.InitializableComponent

        initialize, isInitialized

    • Field Detail

      • DEFAULT_METRIC_NAME

        @Nonnull
@NotEmpty
private static final String DEFAULT_METRIC_NAME
        Default prefix for metrics.
        See Also:
        Constant Field Values

      • log

        @Nonnull
@NotEmpty
private final org.slf4j.Logger log
        Class logger.

      • duoIntegrationLookupStrategy

        @Nonnull
private Function<org.opensaml.profile.context.ProfileRequestContext,​net.shibboleth.idp.authn.duo.DuoIntegration> duoIntegrationLookupStrategy
        Lookp strategy for Duo integration.

      • usernameLookupStrategy

        @Nonnull
private Function<org.opensaml.profile.context.ProfileRequestContext,​String> usernameLookupStrategy
        Lookup strategy for username to match against Duo identity.

      • authAuthenticator

        @Nonnull
private DuoAuthAuthenticator authAuthenticator
        Implementation of Duo AuthApi /auth endpoint.

      • preauthAuthenticator

        @Nonnull
private DuoPreauthAuthenticator preauthAuthenticator
        Implementation of Duo AuthApi /preauth enpoint.

      • duoContext

        @Nonnull
@NotEmpty
private net.shibboleth.idp.authn.duo.context.DuoAuthenticationContext duoContext
        DuoApi context for tokens.

      • duoIntegration

        @Nullable
private net.shibboleth.idp.authn.duo.DuoIntegration duoIntegration
        Duo integration to use.

      • username

        @Nullable
@NotEmpty
private String username
        Attempted username.

    • Constructor Detail

      • ValidateDuoAuthAPI

        public ValidateDuoAuthAPI()
        Constructor.

    • Method Detail

      • setDuoIntegrationLookupStrategy

        public void setDuoIntegrationLookupStrategy​(@Nonnull
                                            Function<org.opensaml.profile.context.ProfileRequestContext,​net.shibboleth.idp.authn.duo.DuoIntegration> strategy)
        Set DuoIntegration lookup strategy to use.
        Parameters:
        strategy - lookup strategy

      • setDuoIntegration

        public void setDuoIntegration​(@Nonnull
                              net.shibboleth.idp.authn.duo.DuoIntegration duo)
        Set DuoIntegration details to use directly.
        Parameters:
        duo - Duo integration details

      • setUsernameLookupStrategy

        public void setUsernameLookupStrategy​(@Nonnull
                                      Function<org.opensaml.profile.context.ProfileRequestContext,​String> strategy)
        Set the lookup strategy to use for the username to match against Duo identity.
        Parameters:
        strategy - lookup strategy

      • setAuthAuthenticator

        public void setAuthAuthenticator​(@Nonnull
                                 DuoAuthAuthenticator authenticator)
        Set the DuoAuthAuthenticator.
        Parameters:
        authenticator - a Duo AuthAPI /auth endpoint implementation

      • doInitialize

        protected void doInitialize()
                     throws net.shibboleth.utilities.java.support.component.ComponentInitializationException
        Overrides:
        doInitialize in class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent
        Throws:
        net.shibboleth.utilities.java.support.component.ComponentInitializationException

      • doPreExecute

        protected boolean doPreExecute​(@Nonnull
                               org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                               @Nonnull
                               net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
        Overrides:
        doPreExecute in class net.shibboleth.idp.authn.AbstractValidationAction

      • doExecute

        protected void doExecute​(@Nonnull
                         org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                         @Nonnull
                         net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
        Overrides:
        doExecute in class net.shibboleth.idp.authn.AbstractAuthenticationAction

      • populateSubject

        protected Subject populateSubject​(@Nonnull
                                  Subject subject)
        Specified by:
        populateSubject in class net.shibboleth.idp.authn.AbstractValidationAction

      • buildAuthenticationResult

        protected void buildAuthenticationResult​(@Nonnull
                                         org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                                         @Nonnull
                                         net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
        Overrides:
        buildAuthenticationResult in class net.shibboleth.idp.authn.AbstractValidationAction