DuoShibboleth { public String performPreauth(String failmode) throws Exception { if (failmode.equals("secure")) { return "auth"; } else if (!failmode.equals("safe")) { throw new IllegalArgumentException("Failmode must be one of either safe or secure."); } for (int i = 0; ; i++) { try { Response preAuthResponse = sendPreAuthRequest(username); int statusCode = preAuthResponse.code(); if (statusCode/100 == 5) { log.warn("Duo 500 error. Fail open for user:" + username); return "allow"; } JSONObject json = new JSONObject(preAuthResponse.body().string()); if (!json.getString("stat").equals("OK")) { throw new Exception( "Duo error code (" + json.getInt("code") + "): " + json.getString("message")); } String result = json.getJSONObject("response").getString("result"); if (result.equals("allow")) { log.info("Duo 2FA bypass for user:" + username); return "allow"; } break; } catch (java.io.IOException e) { if (i >= MAX_TRIES-1){ log.warn("Duo server unreachable. Fail open for user:" + username); return "allow"; } } } return "auth"; } private  DuoShibboleth(); private  DuoShibboleth(String ikey, String skey, String akey, String host, String username); static DuoShibboleth instance(String ikey, String skey, String akey, String host, String username); String performPreauth(String failmode); String signRequest(); boolean verifyResponseEqualsUsername(String duoResponse);  }
@Test public void testPerformPreauth_whenFailmodeSecure() { try { assertEquals("auth", duoShibboleth.performPreauth("secure")); } catch (Exception e) { fail("Unexpected exception thrown."); } }
@Test public void testPerformPreauth_whenFailmodeInvalid() { try { duoShibboleth.performPreauth("bad"); fail("Expected IllegalArgumentException."); } catch (Exception e) { } }
@Test public void testPerformPreauth_whenFailmodeSafeAndDuoUnreachable() { try { assertEquals("allow", duoShibboleth.performPreauth("safe")); } catch (Exception e) { fail("Unexpected exception thrown."); } }