Multiple Duo Integrations with distinct principal sets

[Scott Koranda]

Hello,

I am using IdP version 3.3.0.

I am following the documentation for Multiple Duo Integrations
with Distinct Principal Sets at

https://wiki.shibboleth.net/confluence/display/IDP30/DuoAuthnConfiguration#DuoAuthnConfiguration-Integration-SpecificPrincipalSets

I have two questions:

1) Should

<util:list id="DuoIntegrationList">
   <value-ref="SpecialDuo" />
   <value-ref="DefaultDuo" />
</util:list>

be instead

<util:list id="DuoIntegrationList">
   <ref bean="SpecialDuo" />
   <ref bean="DefaultDuo" />
</util:list>

?

With the former I see in idp-process.log

Line 52 in XML document from file
[/opt/shibboleth-idp/system/flows/authn/../../../conf/authn/duo-authn-config.xml]
is invalid; nested exception is org.xml.sax.SAXParseException;
lineNumber: 52; columnNumber: 13; Element type "value-ref"
must be followed by either attribute specifications, ">" or
"/>".

2) If I make the change above, then the next error I encounter
is

2017-01-09 16:49:50,247 - ERROR [net.shibboleth.idp.authn:-2] - Uncaught runtime exception
java.lang.RuntimeException: java.lang.ClassNotFoundException: net.shibboleth.idp.profile.context.AuthenticationContext
    at jdk.nashorn.internal.runtime.ScriptRuntime.apply(ScriptRuntime.java:397)
Caused by: java.lang.ClassNotFoundException: net.shibboleth.idp.profile.context.AuthenticationContext
    at java.net.URLClassLoader.findClass(URLClassLoader.java:381)

I note that in the source tree for the IdP I see the class

net.shibboleth.idp.authn.context.AuthenticationContext

but I do not see

net.shibboleth.idp.profile.context.AuthenticationContext

Changing the class in the script definition leads to another
error, so before I go on (and dig myself into my own hole) I
would be grateful for clarification on the two items above.

Thanks,

Scott K