authn/Duo flow failure

[Cantor, Scott]

> Thanks.  Converting to the one provided by the project is exactly what I want
> to do, but I'm not sure how to do it.  The conf/authn/duo.properties file that
> comes with 3.3.1 seems to be a stub:

How could it be anything else?

> For the upgrade, I copied the original values for these properties to duo.properties
> under conf/authn, added the optional "duo.failmode = safe",

That is not a feature of our plugin, nor is it documented as one.

> and changed the pointer to it in conf/idp.properties (idp.additionalProperties) to
> /conf/authn/duo.properties.  The old installation did not have the idp.
> prefixed to these property names and the upgrade gives me errors when it
> does not have the plain unprefixed form.  If I do give it the plain duo.- form,
> it gives the error on loading the authn/Duo flow.

The properties you need to use are documented in the wiki and shown in the default file. What you had before needs to be removed, completely.
 
-- Scott