Proper IDP 3 login handler syntax

[Patrick Le]

We're finalizing our migration from IDP 2 to 3 and are having issues figuring out the proper conversion for having multiple login handlers.

Current idp 2 config:

Handler.xml:
    <LoginHandler xsi:type="RemoteUser" protectedServletPath="/Authn/SpecialApp1">
        <AuthenticationMethod>urn:mace:university.edu:AuthLevel:SpecialApp1</AuthenticationMethod>
    </LoginHandler>


Relying Party:
    <rp:RelyingParty id="https://testsp.university.edu" provider="https://idp.university.edu/idp/shibboleth" defaultSigningCredentialRef="IdPCredential" defaultAuthenticationMethod="urn:mace:university.edu:AuthLevel:SpecialApp1">
      <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="conditional"/>
    </rp:RelyingParty>

Tomcat web.xml:
    <servlet>
        <servlet-name>SpecialApps1AuthHandler</servlet-name>
        <servlet-class>edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserAuthServlet</servlet-class>
        <load-on-startup>3</load-on-startup>
    </servlet>

    <servlet-mapping>
        <servlet-name>SpecialApp1AuthHandler</servlet-name>
        <url-pattern>/Authn/SpecialApp1</url-pattern>
    </servlet-mapping>


On IDP3,

General-authn.xml:

        <bean id="authn/SpecialApp1" parent="shibboleth.AuthenticationFlow"
            p:nonBrowserSupported="false" />


Tomcat web.xml- Same as IDP 2


Relying Party:
        <bean parent="RelyingPartyByName" c:relyingPartyIds="https://testsp.university.edu/">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:authenticationFlows="#{{'SpecialApp1'}}" />
                </list>
            </property>
        </bean>

Idp-process Logs:

2016-08-08 10:16:00,117 - ERROR [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:296] - Profile Action SelectAuthenticationFlow: No potential flows left to choose from, authentication will fail
2016-08-08 10:16:00,127 - WARN [org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred while processing the request: NoPotentialFlow

Based on my research on the error so far, I know I need to check out the servlet protections. What I am expecting is for the authentication request to be redirected to the special login handler which will invoke a specific external login page. But I'm not seeing any attempts whatsoever to use the SpecialApp1 authentication flow. I'm really looking for confirmation that I'm on the right track. Is the general-authn.xml and relying party configs I have in idp 3 the proper conversion from idp 2? Are there any other files that I might have overlooked?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160808/f1b3ef67/attachment.html>