Add nonce support and the missing authorize/token request parameters

[scweber-cisco]

What

Closes the gap between what Duo's OIDC endpoints accept and what this SDK sends, for three parameters.

Nonce

The SDK could already validate a nonce — DuoIdTokenValidator has a nonce constructor and enforces the claim — but Client had no way to send one, so the feature was unreachable through the public API. This adds the send side:

• createAuthUrl(username, state, nonce) puts the nonce in the authorize query string. That matches duo_universal_python and Duo's documented precedence rule that a query value wins over the same value in the signed request JWT. The nonce is URL encoded, so a caller-supplied value containing & cannot introduce additional query parameters.
• exchangeAuthorizationCodeFor2FAResult(duoCode, username, nonce) builds the existing 5-arg DuoIdTokenValidator, which fails validation if the ID token's nonce claim doesn't match.
• Validator.validateNonce enforces Duo's documented 16–1024 characters, inclusive on both ends.
• Token exposes the nonce claim, alongside amr.

The existing 2-arg overloads delegate with a null nonce, so current callers send no nonce and behave exactly as before.

Note on what this buys us: preferred_username is already checked unconditionally, so the nonce is not protecting against cross-user token substitution here. What it adds is binding the ID token to this authorization request, which is defense against same-user replay of a previously issued token.

iss / aud on the authorize request

The signed request JWT now carries iss (the client id) and aud (https://{api_host}). Both are optional per Duo's docs, but every other Duo Universal SDK sends them and this was the only one that didn't.

client_id on the token POST

/oauth/v1/token now receives client_id as a form field, again matching the other SDKs.

API surface

New public methods, no removals:

Client.createAuthUrl(String, String, String)	new overload
Client.exchangeAuthorizationCodeFor2FAResult(String, String, String)	new overload
Token.getNonce() / setNonce(String)	new
DuoConnector.exchangeAuthorizationCodeFor2FAResult(..., String clientId)	new overload

DuoConnector.exchangeAuthorizationCodeFor2FAResult needed the clientId, and it's public, so the six-argument signature is retained as an overload that delegates with a null client id. Retrofit drops null @Fields from the form body, so anyone calling the connector directly keeps both source compatibility and their exact previous request.

Testing

Built with TDD; every new behavior has a test that was watched failing first.

• mvn install — 66 tests, 0 failures, checkstyle clean on both modules.
• New tests cover: nonce in the query string, nonce absent when not supplied, nonce URL encoding (the pre-fix version let nonce&redirect_uri=evil inject a second redirect_uri), the 16/1024 length boundaries and both out-of-range cases, iss/aud claims, client_id on the token POST, ID token rejection on nonce mismatch and acceptance on match, and Token nonce equality/toString.

The duo-example app was updated to generate a nonce, store it next to the state, and pass it to both calls — so the demo exercises the new path end to end. I also ran the duo-example app to confirm that it successfully completes with a nonce, and that if the nonce doesn't match, an error is received.

🤖 Generated with Claude Code