Shibcas + Duo

[Justin Andrews]

Thank you all for the reassurance. Maybe some novice questions... but...

I'm troubleshooting the username being used in the Duo flow - any way to
dial this into DEBUG logging? I worry since the nameid returned by our CAS
is a user's employee/student number instead of their username. I'm assuming
I'm going to have to tinker with
leveraging shibboleth.authn.Duo.UsernameLookupStrategy but don't want to
jeopardize security. Any working examples of that bean?

This is what I'm seeing presently after successful logon into CAS..

2017-08-08 14:56:41,069 - DEBUG
[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:192] -
Profile Action TransitionMultiFactorAuthentication: Preserving
authentication result from 'authn/Shibcas' flow
2017-08-08 14:56:41,069 - DEBUG
[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:209] -
Profile Action TransitionMultiFactorAuthentication: Applying MFA transition
rule to exit state 'authn/Shibcas'
2017-08-08 14:56:41,102 - DEBUG
[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:221] -
Profile Action TransitionMultiFactorAuthentication: MFA flow transition
after 'proceed' event to 'authn/Duo' flow
2017-08-08 14:56:41,370 - ERROR [net.shibboleth.idp.authn.duo:-2] -
DuoWebException
org.springframework.expression.ExpressionInvocationTargetException: A
problem occurred when trying to execute method 'generateSignedRequestToken'
on object of type [java.lang.Class]
at
org.springframework.expression.spel.ast.MethodReference.throwSimpleExceptionIfPossible(MethodReference.java:227)
Caused by: com.duosecurity.duoweb.DuoWebException: ERR|The username passed
to sign_request() is invalid.
at
net.shibboleth.idp.authn.duo.impl.DuoSupport.generateSignedRequestToken(DuoSupport.java:64)

Justin Andrews
Enterprise Systems Integrator
Information Technology Services
University of West Florida

On Mon, Aug 7, 2017 at 10:56 AM, Justin Andrews <jandrews at uwf.edu> wrote:

> Hi folks - does anyone have a working IDP with Shibcas & Duo?
>
> Asking for a sanity check, thanks.
>
> Justin Andrews
> Enterprise Systems Integrator
> Information Technology Services
> University of West Florida
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170808/b8b8bfa8/attachment.html>