Help - AbstractUserPasswordValidationAction Problems
Charles Syperski
csyperski at dupage88.net
Mon Sep 26 10:29:10 EDT 2016
My fault, it was a scoping issue with my bean, I change
scope="prototype" and all is good.
Thanks
On 09/26/2016 08:30 AM, Charles Syperski wrote:
>
> I am having an issue with my IDP authenticating again a custom
> AbstractUserPasswordValidationAction.... The first request/user works
> fine and can authentication and gets processed, but the 2nd and on
> fail with a response of "An error occured"
>
>
> I am getting the following error:
>
>
> oder.doDecode(HTTPPostDecoder.java:57)
> 2016-09-26 07:00:35,496 - WARN
> [org.opensaml.profile.action.impl.LogEvent:76] - An error event
> occurred while processing the request: UnableToDecode
> 2016-09-26 07:00:54,049 - ERROR
> [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] -
> Profile Action SelectSubjectCanonicalizationFlow: No potential flows
> left to choose from, canonicalization will fail
> 2016-09-26 07:00:54,050 - WARN
> [org.opensaml.profile.action.impl.LogEvent:76] - An error event
> occurred while processing the request: SubjectCanonicalizationError
> 2016-09-26 07:02:21,223 - ERROR
> [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] -
> Profile Action SelectSubjectCanonicalizationFlow: No potential flows
> left to choose from, canonicalization will fail
> 2016-09-26 07:02:21,223 - WARN
> [org.opensaml.profile.action.impl.LogEvent:76] - An error event
> occurred while processing the request: SubjectCanonicalizationError
> 2016-09-26 07:02:31,380 - ERROR
> [org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action
> DecodeMessage: Unable to decode incoming request
> org.opensaml.messaging.decoder.MessageDecodingException: This message
> decoder only supports the HTTP POST method
> at
> org.opensaml.saml.saml2.binding.decoding.impl.HTTPPostDecoder.doDecode(HTTPPostDecoder.java:57)
> 2016-09-26 07:02:31,382 - WARN
> [org.opensaml.profile.action.impl.LogEvent:76] - An error event
> occurred while processing the request: UnableToDecode
> 2016-09-26 07:05:04,591 - ERROR
> [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] -
> Profile Action SelectSubjectCanonicalizationFlow: No potential flows
> left to choose from, canonicalization will fail
> 2016-09-26 07:05:04,592 - WARN
> [org.opensaml.profile.action.impl.LogEvent:76] - An error event
> occurred while processing the request: SubjectCanonicalizationError
> 2016-09-26 07:05:07,560 - ERROR
> [org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action
> DecodeMessage: Unable to decode incoming request
> org.opensaml.messaging.decoder.MessageDecodingException: This message
> decoder only supports the HTTP POST method
> at
> org.opensaml.saml.saml2.binding.decoding.impl.HTTPPostDecoder.doDecode(HTTPPostDecoder.java:57)
> 2016-09-26 07:05:07,560 - WARN
> [org.opensaml.profile.action.impl.LogEvent:76] - An error event
> occurred while processing the request: UnableToDecode
> 2016-09-26 07:06:43,449 - WARN
> [net.dupage88.usercentralsaml.authn.ValidateUsernamePasswordAgainstUCM:98]
> - Login Failed: [christine.pahopos at sbcglobal.net] Authentication
> failed! - InvalidCredentials
> 2016-09-26 07:07:11,572 - ERROR
> [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] -
> Profile Action SelectSubjectCanonicalizationFlow: No potential flows
> left to choose from, canonicalization will fail
> 2016-09-26 07:07:11,573 - WARN
> [org.opensaml.profile.action.impl.LogEvent:76] - An error event
> occurred while processing the request: SubjectCanonicalizationError
> 2016-09-26 07:07:49,955 - ERROR
> [org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action
> DecodeMessage: Unable to decode incoming request
> org.opensaml.messaging.decoder.MessageDecodingException: This message
> decoder only supports the HTTP POST method
> at
> org.opensaml.saml.saml2.binding.decoding.impl.HTTPPostDecoder.doDecode(HTTPPostDecoder.java:57)
> 2016-09-26 07:07:49,955 - WARN
> [org.opensaml.profile.action.impl.LogEvent:76] - An error event
> occurred while processing the request: UnableToDecode
> 2016-09-26 07:07:51,452 - ERROR
> [org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action
> DecodeMessage: Unable to decode incoming request
> org.opensaml.messaging.decoder.MessageDecodingException: This message
> decoder only supports the HTTP POST method
> at
> org.opensaml.saml.saml2.binding.decoding.impl.HTTPPostDecoder.doDecode(HTTPPostDecoder.java:57)
> 2016-09-26 07:07:51,453 - WARN
> [org.opensaml.profile.action.impl.LogEvent:76] - An error event
> occurred while processing the request: UnableToDecode
> 2016-09-26 07:08:35,798 - ERROR
> [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] -
> Profile Action
>
>
>
> Here is my class that extends
> AbstractUsernamePasswordValidationAction.....
>
>
> package net.dupage88.usercentralsaml.authn;
>
> import net.dupage88.usercentrallite.authmethod.PasswordAuthMethod;
> import net.dupage88.usercentrallite.manager.AuthenticationManager;
> import net.dupage88.usercentrallite.users.GuardianUser;
> import net.dupage88.usercentrallite.users.User;
> import net.dupage88.usercentralsaml.authn.context.UcmResponseContext;
> import net.shibboleth.idp.authn.AbstractUsernamePasswordValidationAction;
> import net.shibboleth.idp.authn.AuthnEventIds;
> import net.shibboleth.idp.authn.context.AuthenticationContext;
> import
> net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
> import org.apache.velocity.VelocityContext;
> import org.opensaml.profile.context.ProfileRequestContext;
> import org.slf4j.Logger;
> import org.slf4j.LoggerFactory;
>
> import javax.annotation.Nonnull;
> import javax.annotation.Nullable;
> import javax.security.auth.Subject;
> import java.util.Optional;
>
> public class ValidateUsernamePasswordAgainstUCMextends AbstractUsernamePasswordValidationAction {
>
> private final Loggerlog = LoggerFactory.getLogger(ValidateUsernamePasswordAgainstUCM.class);
>
> private AuthenticationManagerauthenticationManager;
>
> /** {@inheritDoc} */ @Override protected void doExecute(final ProfileRequestContext profileRequestContext,
> final AuthenticationContext authenticationContext) {
> try {
> log.debug("{} Attempting to authenticate user {}", getLogPrefix(), getUsernamePasswordContext()
> .getUsername());
>
> if (authenticationManager ==null ) {
> error(profileRequestContext, authenticationContext,"n/a","Invalid Authentication Manager!", AuthnEventIds.ACCOUNT_ERROR );
> return;
> }
>
> final VelocityContext context =new VelocityContext();
> context.put("usernamePasswordContext", getUsernamePasswordContext());
> final String username = getUsernamePasswordContext().getUsername();
> final String password = getUsernamePasswordContext().getPassword();
>
> log.trace("{} Authentication started for {}", getLogPrefix(), username);
> final Optional<User> maybeUser =authenticationManager.attemptLogin(new PasswordAuthMethod(username, password),"1.1.1.1","");
> if ( maybeUser.isPresent() ) {
> final User user = maybeUser.orElse(null);
>
> log.info("User found: " + username);
> if (! user.isActivated()) {
> log.warn("User {} is not yet activated!", username);
> error(profileRequestContext, authenticationContext, username,"Account has not been verified!", AuthnEventIds.ACCOUNT_ERROR );
> return;
> }
>
> if (!user.isEnabled()) {
> log.warn("User {} is not enabled!", username);
> error(profileRequestContext, authenticationContext, username,"Account is disabled!", AuthnEventIds.ACCOUNT_ERROR );
> return;
> }
>
> if ( ! (userinstanceof GuardianUser) ) {
> log.warn("User {} is not a guardian!", username);
> error(profileRequestContext, authenticationContext, username,"Incorrect account type!", AuthnEventIds.ACCOUNT_ERROR );
> return;
> }
>
> authenticationContext.getSubcontext(UcmResponseContext.class,true)
> .successful(user);
>
> buildAuthenticationResult(profileRequestContext, authenticationContext);
>
> }else {
> log.info("{} Login by '{}' failed", getLogPrefix(), getUsernamePasswordContext().getUsername());
>
> error(profileRequestContext, authenticationContext, username,"Authentication failed!", AuthnEventIds.INVALID_CREDENTIALS );
> }
> }catch (final Exception e) {
> log.warn("{} Login by {} produced exception", getLogPrefix(), getUsernamePasswordContext().getUsername(), e);
> error(profileRequestContext, authenticationContext,"n/a", e.getMessage(), AuthnEventIds.AUTHN_EXCEPTION );
> }
> }
>
> protected void error(final ProfileRequestContext profileRequestContext,
> final AuthenticationContext authenticationContext,
> String username,
> String message,
> String eventId ) {
>
> if ( profileRequestContext !=null && authenticationContext !=null && message !=null && eventId !=null ) {
> authenticationContext.getSubcontext(UcmResponseContext.class,true).failed(message);
> handleError(profileRequestContext, authenticationContext, message, eventId);
> log.warn("Login Failed: [{}] {} - {}", username, message, eventId);
> }
> }
>
>
> public AuthenticationManager getAuthenticationManager() {
> return authenticationManager;
> }
>
> public void setAuthenticationManager(AuthenticationManager authenticationManager) {
> this.authenticationManager = authenticationManager;
> }
> }
>
> Is there any thing obvious that I am doing wrong that is causing...
>
> 2016-09-26 07:08:35,798 - ERROR [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] - Profile Action SelectSubjectCanonicalizationFlow: No potential flows left to choose from, canonicalization will fail
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160926/b9e5cb0c/attachment-0001.html>
More information about the dev
mailing list