defining custom password validator in 3.2.0?

[Jeffrey Eaton]

I have had to develop a custom password authentication validation routine for my Shibboleth 3.2.0 server.  I essentially copied ValidateUsernamePasswordAgainstJAAS as CMUValidateUsernamePasswordAgainstJAAS, and if I define the my custom bean in system/flows/authn/password-authn-beans.xml, everything works as I expect.

However, I'm aware that I should not be editing the stuff under system/, so I've been trying to figure out where to define the bean otherwise.  I somewhat naively tried to create a file flows/authn/password-authn-beans.xml containing my bean definition, but that doesn't work. I get:

2015-12-14 13:17:19,269 - ERROR [net.shibboleth.idp.authn:-2] - Uncaught runtime exception
org.springframework.binding.expression.PropertyNotFoundException: Property not found
        at org.springframework.binding.expression.spel.SpringELExpression.getValue(SpringELExpression.java:87)
Caused by: org.springframework.expression.spel.SpelEvaluationException: EL1008E:(pos 0): Property or field 'ValidateUsernamePassword' cannot be found on object of type 'org.springframework.webflow.engine.impl.RequestControlContextImpl' - maybe not public?
        at org.springframework.expression.spel.ast.PropertyOrFieldReference.readProperty(PropertyOrFieldReference.java:224)


which looks to me like it didn't properly load my bean definition.

Where should I be defining my custom bean?

-jeaton