assertion not always signed

[Rich Graves]

> You apparently do have your fix at least.

Update to 3.3 you mean?

I think the explanation in IDP-1108 (actually IDP-920) is consistent
with what we've seen. So it breaks not based on "time that the IdP
session was alive," but "whether we have previously had a short-lived
session with this SP during the same long-lived IdP session."

The quick and dirty 3.3 ./install.sh seems to have worked after a)
removing the redundant DuoWeb-*.jar and b) restoring the pre-3.3
behavior of leaving credentials in RAM for a while. Is there a quick
fix to replace usernamePasswordContext.getUsername()  with a call to
get the principal elsewhere? Longer-term fix is to switch to the new
3.3 MFA framework, which doesn't look hard, so it's likely that'll be
the short-term fix after all. Here's where the legacy Duo (not
Unicode) chokes "out of the box."

2017-01-17 07:37:40,901 - ERROR
[org.springframework.webflow.execution.ActionExecutionException:76] -
org.springframework.webflow.execution.ActionExecutionException:
Exception thrown executing [AnnotatedAction at 53712e8a targetAction =
[EvaluateAction at 676d5124 expression =
T(com.duosecurity.integrations.DuoShibboleth).instance(environment.getProperty('duo.ikey',
''), environment.getProperty('duo.skey', ''),
environment.getProperty('duo.akey', ''),
environment.getProperty('duo.host', ''),
usernamePasswordContext.getUsername()), resultExpression =
flowScope.duo], attributes = map[[empty]]] in state 'null' of flow
'authn/Duo' -- action execution attributes were 'map[[empty]]'
        at org.springframework.webflow.execution.ActionExecutor.execute(ActionExecutor.java:60)
Caused by: org.springframework.binding.expression.EvaluationException:
An ELException occurred getting the value for expression
'T(com.duosecurity.integrations.DuoShibboleth).instance(environment.getProperty('duo.ikey',
''), environment.getProperty('duo.skey', ''),
environment.getProperty('duo.akey', ''),
environment.getProperty('duo.host', ''),
usernamePasswordContext.getUsername())' on context [class
org.springframework.webflow.engine.impl.RequestControlContextImpl]
        at org.springframework.binding.expression.spel.SpringELExpression.getValue(SpringELExpression.java:92)
Caused by: org.springframework.expression.spel.SpelEvaluationException:
EL1011E:(pos 46): Method call: Attempted to call method getUsername()
on null context object
        at org.springframework.expression.spel.ast.MethodReference.throwIfNotNullSafe(MethodReference.java:144)