idp v3.1.2 webflow IllegalArgumentException in conditions-flow.xml

[Klingenstein, Nate]

The logging on line -2 will never stop cracking me up.

Anyway, I think the problem is the Duo plugin as implemented and released assumes successful login by a user with a username and a password before it runs.  When the user fails to authenticate first, there is no such login to build on.

I don't know whether the JAAS flow produces a UsernamePassword principal, but if it doesn't, you'll need to modify the flow.

You'll need to modify the flow anyhow to manage the case where the user failed to authenticate to JAAS, though.  That involves putting some sort of a trap in the webflow before you send the user in to the Duo section, or asking Duo to modify their implementation to catch prior authentication failures.

But, I don't know what would be in the built-in support in 3.3, so I don't know what to ask you to ask them for. :D

> On Sep 1, 2016, at 9:22 AM, Joe Edwards <joee at uw.edu> wrote:
> 
> 
> Here is another case of the webflow IllegalArgumentException.
> 
> Am I misusing the expression language?
> 
> I configured shibboleth v3.1.2 for duo.
> 
> The documented procedure has duo hard coded to run on every login.
>  <!-- Enable Duo Two-Factor Authentication -->
>  <evaluate expression="ValidateUsernamePassword" />
>  <evaluate expression="'duo'" />
>  <transition on="duo" to="DuoAuth" />
>  <!-- End Duo Two-Factor Authentication -->
> I do not get errors when the jaas login fails.
> Users are returned to the login page to try again.
> 
> I revised conditions-flow.xml to provide duo 2 factor as an option.
>  <!-- Enable Duo Two-Factor Authentication -->
>  <evaluate expression="ValidateUsernamePassword" />
>  <evaluate expression="requestParameters.duoStatus" />
>  <transition on="duo" to="DuoAuth" />
>  <transition on="" to="proceed" />
>  <!-- End Duo Two-Factor Authentication
> That works if the jaas login succeeds.
> It fails if the jaas login fails and I see the following message:
> 
> 2016-09-01 09:06:50,370 - ERROR [net.shibboleth.idp.authn:-2] - Uncaught
> runtime exception java.lang.IllegalArgumentException: Cannot find state
> with id 'InvalidSubjectCanonicalizationContext' in flow 'authn' -- Known
> state ids are 'array<String>['AuthenticationSetup', 'TestForSession',
> 'SessionExists', 'FilterFlows', 'SelectAuthenticationFlow',
> 'CallAuthenticationFlow', 'CallSubjectCanonicalization',
> 'DetectIdentitySwitch', 'HandleIdentitySwitch', 'FinalizeAuthentication',
> 'UpdateSessionWithAuthenticationResult', 'proceed',
> 'AuthenticationException', 'IdentitySwitch', 'InputOutputError',
> 'InvalidCredentials', 'InvalidProfileContext', 'InvalidSubjectContext',
> 'NoCredentials', 'NoPassive', 'NoPotentialFlow', 'RequestUnsupported',
> 'ReselectFlow', 'RuntimeException', 'SubjectCanonicalizationError',
> 'LogRuntimeException']'
>  at org.springframework.webflow.engine.Flow.getStateInstance(Flow.java:342)
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net