Help - AbstractUserPasswordValidationAction Problems
Charles Syperski
csyperski at dupage88.net
Mon Sep 26 09:30:02 EDT 2016
I am having an issue with my IDP authenticating again a custom
AbstractUserPasswordValidationAction.... The first request/user works
fine and can authentication and gets processed, but the 2nd and on fail
with a response of "An error occured"
I am getting the following error:
oder.doDecode(HTTPPostDecoder.java:57)
2016-09-26 07:00:35,496 - WARN
[org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred
while processing the request: UnableToDecode
2016-09-26 07:00:54,049 - ERROR
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] -
Profile Action SelectSubjectCanonicalizationFlow: No potential flows
left to choose from, canonicalization will fail
2016-09-26 07:00:54,050 - WARN
[org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred
while processing the request: SubjectCanonicalizationError
2016-09-26 07:02:21,223 - ERROR
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] -
Profile Action SelectSubjectCanonicalizationFlow: No potential flows
left to choose from, canonicalization will fail
2016-09-26 07:02:21,223 - WARN
[org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred
while processing the request: SubjectCanonicalizationError
2016-09-26 07:02:31,380 - ERROR
[org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action
DecodeMessage: Unable to decode incoming request
org.opensaml.messaging.decoder.MessageDecodingException: This message
decoder only supports the HTTP POST method
at
org.opensaml.saml.saml2.binding.decoding.impl.HTTPPostDecoder.doDecode(HTTPPostDecoder.java:57)
2016-09-26 07:02:31,382 - WARN
[org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred
while processing the request: UnableToDecode
2016-09-26 07:05:04,591 - ERROR
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] -
Profile Action SelectSubjectCanonicalizationFlow: No potential flows
left to choose from, canonicalization will fail
2016-09-26 07:05:04,592 - WARN
[org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred
while processing the request: SubjectCanonicalizationError
2016-09-26 07:05:07,560 - ERROR
[org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action
DecodeMessage: Unable to decode incoming request
org.opensaml.messaging.decoder.MessageDecodingException: This message
decoder only supports the HTTP POST method
at
org.opensaml.saml.saml2.binding.decoding.impl.HTTPPostDecoder.doDecode(HTTPPostDecoder.java:57)
2016-09-26 07:05:07,560 - WARN
[org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred
while processing the request: UnableToDecode
2016-09-26 07:06:43,449 - WARN
[net.dupage88.usercentralsaml.authn.ValidateUsernamePasswordAgainstUCM:98]
- Login Failed: [christine.pahopos at sbcglobal.net] Authentication failed!
- InvalidCredentials
2016-09-26 07:07:11,572 - ERROR
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] -
Profile Action SelectSubjectCanonicalizationFlow: No potential flows
left to choose from, canonicalization will fail
2016-09-26 07:07:11,573 - WARN
[org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred
while processing the request: SubjectCanonicalizationError
2016-09-26 07:07:49,955 - ERROR
[org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action
DecodeMessage: Unable to decode incoming request
org.opensaml.messaging.decoder.MessageDecodingException: This message
decoder only supports the HTTP POST method
at
org.opensaml.saml.saml2.binding.decoding.impl.HTTPPostDecoder.doDecode(HTTPPostDecoder.java:57)
2016-09-26 07:07:49,955 - WARN
[org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred
while processing the request: UnableToDecode
2016-09-26 07:07:51,452 - ERROR
[org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action
DecodeMessage: Unable to decode incoming request
org.opensaml.messaging.decoder.MessageDecodingException: This message
decoder only supports the HTTP POST method
at
org.opensaml.saml.saml2.binding.decoding.impl.HTTPPostDecoder.doDecode(HTTPPostDecoder.java:57)
2016-09-26 07:07:51,453 - WARN
[org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred
while processing the request: UnableToDecode
2016-09-26 07:08:35,798 - ERROR
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] -
Profile Action
Here is my class that extends AbstractUsernamePasswordValidationAction.....
package net.dupage88.usercentralsaml.authn;
import net.dupage88.usercentrallite.authmethod.PasswordAuthMethod;
import net.dupage88.usercentrallite.manager.AuthenticationManager;
import net.dupage88.usercentrallite.users.GuardianUser;
import net.dupage88.usercentrallite.users.User;
import net.dupage88.usercentralsaml.authn.context.UcmResponseContext;
import net.shibboleth.idp.authn.AbstractUsernamePasswordValidationAction;
import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import org.apache.velocity.VelocityContext;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import javax.security.auth.Subject;
import java.util.Optional;
public class ValidateUsernamePasswordAgainstUCMextends AbstractUsernamePasswordValidationAction {
private final Loggerlog = LoggerFactory.getLogger(ValidateUsernamePasswordAgainstUCM.class);
private AuthenticationManagerauthenticationManager;
/** {@inheritDoc} */ @Override protected void doExecute(final ProfileRequestContext profileRequestContext,
final AuthenticationContext authenticationContext) {
try {
log.debug("{} Attempting to authenticate user {}", getLogPrefix(), getUsernamePasswordContext()
.getUsername());
if (authenticationManager ==null ) {
error(profileRequestContext, authenticationContext,"n/a","Invalid Authentication Manager!", AuthnEventIds.ACCOUNT_ERROR );
return;
}
final VelocityContext context =new VelocityContext();
context.put("usernamePasswordContext", getUsernamePasswordContext());
final String username = getUsernamePasswordContext().getUsername();
final String password = getUsernamePasswordContext().getPassword();
log.trace("{} Authentication started for {}", getLogPrefix(), username);
final Optional<User> maybeUser =authenticationManager.attemptLogin(new PasswordAuthMethod(username, password),"1.1.1.1","");
if ( maybeUser.isPresent() ) {
final User user = maybeUser.orElse(null);
log.info("User found: " + username);
if (! user.isActivated()) {
log.warn("User {} is not yet activated!", username);
error(profileRequestContext, authenticationContext, username,"Account has not been verified!", AuthnEventIds.ACCOUNT_ERROR );
return;
}
if (!user.isEnabled()) {
log.warn("User {} is not enabled!", username);
error(profileRequestContext, authenticationContext, username,"Account is disabled!", AuthnEventIds.ACCOUNT_ERROR );
return;
}
if ( ! (userinstanceof GuardianUser) ) {
log.warn("User {} is not a guardian!", username);
error(profileRequestContext, authenticationContext, username,"Incorrect account type!", AuthnEventIds.ACCOUNT_ERROR );
return;
}
authenticationContext.getSubcontext(UcmResponseContext.class,true)
.successful(user);
buildAuthenticationResult(profileRequestContext, authenticationContext);
}else {
log.info("{} Login by '{}' failed", getLogPrefix(), getUsernamePasswordContext().getUsername());
error(profileRequestContext, authenticationContext, username,"Authentication failed!", AuthnEventIds.INVALID_CREDENTIALS );
}
}catch (final Exception e) {
log.warn("{} Login by {} produced exception", getLogPrefix(), getUsernamePasswordContext().getUsername(), e);
error(profileRequestContext, authenticationContext,"n/a", e.getMessage(), AuthnEventIds.AUTHN_EXCEPTION );
}
}
protected void error(final ProfileRequestContext profileRequestContext,
final AuthenticationContext authenticationContext,
String username,
String message,
String eventId ) {
if ( profileRequestContext !=null && authenticationContext !=null && message !=null && eventId !=null ) {
authenticationContext.getSubcontext(UcmResponseContext.class,true).failed(message);
handleError(profileRequestContext, authenticationContext, message, eventId);
log.warn("Login Failed: [{}] {} - {}", username, message, eventId);
}
}
public AuthenticationManager getAuthenticationManager() {
return authenticationManager;
}
public void setAuthenticationManager(AuthenticationManager authenticationManager) {
this.authenticationManager = authenticationManager;
}
}
Is there any thing obvious that I am doing wrong that is causing...
2016-09-26 07:08:35,798 - ERROR [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] - Profile Action SelectSubjectCanonicalizationFlow: No potential flows left to choose from, canonicalization will fail
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160926/193e32eb/attachment-0001.html>
More information about the dev
mailing list