Possible bug with defining AuthenticationFlows in relying-party.xml

[Travis Schmidt]

I have tried to override the default authentication flow defined in
idp.properties with the following override in relying-party.xml

 <bean parent="RelyingPartyByName" c:relyingPartyIds="
http://shib-cas-sp/shibboleth">
            <property name="profileConfigurations">
              <list>
                  <bean parent="SAML2.SSO"
p:authenticationFlows="#{{'PwdDuo'}}"
p:postAuthenticationFlows="#{{'attribute-release'}}" />
                </list>
            </property>
        </bean>

Here is the pertinent lines form the idp logs:

2016-01-04 22:28:19,376 - DEBUG
[net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:149] - Profile
Action PopulateAuthenticationContext: Filtered out authentication flow
authn/Password due to profile configuration
2016-01-04 22:28:19,377 - WARN
[net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:165] - Profile
Action PopulateAuthenticationContext: No authentication flows are active
for this request
2016-01-04 22:28:19,383 - DEBUG
[net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:53] - Profile
Action FilterFlowsByForcedAuthn: Request does not have forced
authentication requirement, nothing to do
2016-01-04 22:28:19,387 - DEBUG
[net.shibboleth.idp.authn.impl.FilterFlowsByPassivity:53] - Profile Action
FilterFlowsByPassivity: Request does not have passive requirement, nothing
to do
2016-01-04 22:28:19,391 - DEBUG
[net.shibboleth.idp.authn.impl.FilterFlowsByNonBrowserSupport:53] - Profile
Action FilterFlowsByNonBrowserSupport: Request does not have non-browser
requirement, nothing to do
2016-01-04 22:28:19,398 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:257] - Profile
Action SelectAuthenticationFlow: No specific Principals requested
2016-01-04 22:28:19,399 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:292] - Profile
Action SelectAuthenticationFlow: No usable active results available,
selecting an inactive flow
2016-01-04 22:28:19,400 - ERROR
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:296] - Profile
Action SelectAuthenticationFlow: No potential flows left to choose from,
authentication will fail
2016-01-04 22:28:19,422 - WARN
[org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred
while processing the request: NoPotentialFlow
2016-01-04 22:28:19,424 - DEBUG
[org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:184] -
Error event NoPotentialFlow will be handled with response

So it seems to know to deactivate the default flow, but does not seem to
insert the flow defined in the override.  I am able to define an override
authentication flow for the CASLoginConfiguration, but it fails with
SAML2.SSO for some reason.

Thanks
Travis
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160104/31841d85/attachment.html>