Displaying a simple error page from a flow

[Wessel, Keith]

Just to follow up to the list, the shortcut didn't work. It ignored the extra code and terminated the flow with a proceed event, passing me through with password authentication. The more complex route worked, though.

I only have one remaining issue: step-up authentication doesn't seem to be working. When I sign into an SP requesting password or no default then log into an SP requesting DUO or Duo/password, I get:

2016-12-08 16:21:03,054 - ERROR [net.shibboleth.idp.profile.context.navigate.ScriptedContextLookupFunction:163] [session=48bdmbla838qxq7ju37h0m4p] [ip=108.227.228.204] - Scripted Function from Inline: Error while executing Function script
javax.script.ScriptException: TypeError: null has no such function "getPrincipalName" in <eval> at line number 14
	at jdk.nashorn.api.scripting.NashornScriptEngine.throwAsScriptException(NashornScriptEngine.java:470)
Caused by: jdk.nashorn.internal.runtime.ECMAException: TypeError: null has no such function "getPrincipalName"
	at jdk.nashorn.internal.runtime.ECMAErrors.error(ECMAErrors.java:57)
2016-12-08 16:21:03,060 - ERROR [net.shibboleth.idp.authn:-2] [session=48bdmbla838qxq7ju37h0m4p] [ip=108.227.228.204] - Uncaught runtime exception
java.lang.RuntimeException: javax.script.ScriptException: TypeError: null has no such function "getPrincipalName" in <eval> at line number 14
	at net.shibboleth.idp.profile.context.navigate.ScriptedContextLookupFunction.apply(ScriptedContextLookupFunction.java:167)
Caused by: javax.script.ScriptException: TypeError: null has no such function "getPrincipalName" in <eval> at line number 14
	at jdk.nashorn.api.scripting.NashornScriptEngine.throwAsScriptException(NashornScriptEngine.java:470)
Caused by: jdk.nashorn.internal.runtime.ECMAException: TypeError: null has no such function "getPrincipalName"
	at jdk.nashorn.internal.runtime.ECMAErrors.error(ECMAErrors.java:57)
2016-12-08 16:21:03,064 - WARN [org.opensaml.profile.action.impl.LogEvent:105] [session=48bdmbla838qxq7ju37h0m4p] [ip=108.227.228.204] - A non-proceed event occurred while processing the request: RuntimeException

The getPrincipal call is exactly taken from the sample function shipped with the IdP and comes right after initializing the variable to the AttributeResolverContext subcontext, of course.

I would assume that the password flow is being called and proceeding silently since it's already been satisfied, but I'm confused why the subjectCanonicalizationContext subcontext is returning a null object.

Any thoughts?

Thanks,
Keith

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, December 07, 2016 4:01 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Displaying a simple error page from a flow

On 12/7/16, 4:49 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

> That's all a lot more than it would take if I had just allowed for event signaling.

If you want to try something out, this might work without all the overhead of the new flow.

Once you pick an event ID to use, you still need to add it to authn-events-flow.xml and map it to a template in errors.vm, all that's the same.

To try and signal it, have your transition rule script in the MFA flow return null back, but in the script, do this:

input.getSubcontext("org.opensaml.profile.context.EventContext", true).setEvent("MyEvent");

I don't know if that will work. I think it will work in some cases, but possibly not all.

-- Scott


-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net