Idp 3.3.1 authentication flow problem

Sun Jun 11 12:09:08 EDT 2017

Here is a part of general-authn.xml:
authn/Password is not commented out. Others are.
-----------------------------
<util:list id="shibboleth.AvailableAuthenticationFlows">

<!--
        <bean id="authn/IPAddress" parent="shibboleth.AuthenticationFlow"
                p:passiveAuthenticationSupported="true"
                p:lifetime="PT60S" p:inactivityTimeout="PT60S">
            <property name="supportedPrincipals">
                <util:list>
                    <bean parent="shibboleth.SAML2AuthnContextClassRef"

c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol" />
                </util:list>
            </property>
        </bean>

        <bean id="authn/External" parent="shibboleth.AuthenticationFlow"
            p:nonBrowserSupported="false" />

        <bean id="authn/RemoteUser" parent="shibboleth.AuthenticationFlow"
            p:nonBrowserSupported="false" />

        <bean id="authn/RemoteUserInternal"
parent="shibboleth.AuthenticationFlow" />

        <bean id="authn/X509" parent="shibboleth.AuthenticationFlow"
                p:nonBrowserSupported="false">
            <property name="supportedPrincipals">
                <util:list>
                    <bean parent="shibboleth.SAML2AuthnContextClassRef"

c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:X509" />
                    <bean parent="shibboleth.SAML2AuthnContextClassRef"

c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient" />
                    <bean parent="shibboleth.SAML1AuthenticationMethod"
                        c:method="urn:ietf:rfc:2246" />
                </util:list>
            </property>
        </bean>

        <bean id="authn/X509Internal"
parent="shibboleth.AuthenticationFlow">
            <property name="supportedPrincipals">
                <util:list>
                    <bean parent="shibboleth.SAML2AuthnContextClassRef"

c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:X509" />
                    <bean parent="shibboleth.SAML2AuthnContextClassRef"

c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient" />
                    <bean parent="shibboleth.SAML1AuthenticationMethod"
                        c:method="urn:ietf:rfc:2246" />
                </util:list>
            </property>
        </bean>
-->

        <bean id="authn/Password" parent="shibboleth.AuthenticationFlow"
                p:passiveAuthenticationSupported="true"
                p:forcedAuthenticationSupported="true" />

    </util:list>
--------------------------

password-authn-config.xml:
jaas-authn-config is chosen
--------------------------
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:util="http://www.springframework.org/schema/util"
       xmlns:p="http://www.springframework.org/schema/p"
       xmlns:c="http://www.springframework.org/schema/c"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans.xsd
                           http://www.springframework.org/schema/context
http://www.springframework.org/schema/context/spring-context.xsd
                           http://www.springframework.org/schema/util
http://www.springframework.org/schema/util/spring-util.xsd"

       default-init-method="initialize"
       default-destroy-method="destroy">

    <!-- Choose an import based on the back-end you want to use. -->
    <import resource="jaas-authn-config.xml" />
    <!-- <import resource="krb5-authn-config.xml" /> -->
    <!-- <import resource="ldap-authn-config.xml" /> -->

    <!-- Names of form fields to pull username and password from. -->
    <bean id="shibboleth.authn.Password.UsernameFieldName"
class="java.lang.String" c:_0="j_username" />
    <bean id="shibboleth.authn.Password.PasswordFieldName"
class="java.lang.String" c:_0="j_password" />
    <bean id="shibboleth.authn.Password.SSOBypassFieldName"
class="java.lang.String" c:_0="donotcache" />

    <!-- Simple transforms to apply to username before validation. -->
    <util:constant id="shibboleth.authn.Password.Lowercase"
static-field="java.lang.Boolean.FALSE"/>
    <util:constant id="shibboleth.authn.Password.Uppercase"
static-field="java.lang.Boolean.FALSE"/>
    <util:constant id="shibboleth.authn.Password.Trim"
static-field="java.lang.Boolean.TRUE"/>

    <!-- Apply any regular expression replacement pairs before validation.
-->
    <util:list id="shibboleth.authn.Password.Transforms">
        <!--
        <bean parent="shibboleth.Pair" p:first="^(.+)@example\.edu$"
p:second="$1" />
        -->
    </util:list>
    <!--
    Define entries here to map error messages detected by validation
actions and classify them as particular
    kinds of errors for use in your templates and as events in flows.
    -->

   <util:map id="shibboleth.authn.Password.ClassifiedMessageMap">
        <entry key="UnknownUsername">
            <list>
                <value>NoCredentials</value>
                <value>CLIENT_NOT_FOUND</value>
                <value>DN_RESOLUTION_FAILURE</value>
            </list>
        </entry>
        <entry key="InvalidPassword">
            <list>
                <value>InvalidCredentials</value>
                <value>PREAUTH_FAILED</value>
                <value>INVALID_CREDENTIALS</value>
            </list>
        </entry>
        <entry key="ExpiredPassword">
            <list>
                <value>PASSWORD_EXPIRED</value>
            </list>
        </entry>
        <entry key="ExpiringPassword">
            <list>
                <value>ACCOUNT_WARNING</value>
            </list>
        </entry>
    </util:map>

</beans>
---------------------------------

jaas-authn-config.xml:
------------------------------
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:util="http://www.springframework.org/schema/util"
       xmlns:p="http://www.springframework.org/schema/p"
       xmlns:c="http://www.springframework.org/schema/c"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans.xsd
                           http://www.springframework.org/schema/context
http://www.springframework.org/schema/context/spring-context.xsd
                           http://www.springframework.org/schema/util
http://www.springframework.org/schema/util/spring-util.xsd"

       default-init-method="initialize"
       default-destroy-method="destroy">

    <!-- Specify your JAAS config. -->
    <bean id="JAASConfig"
class="org.springframework.core.io.FileSystemResource"
c:path="%{idp.home}/conf/authn/jaas.config" />

    <util:property-path id="shibboleth.authn.JAAS.JAASConfigURI"
path="JAASConfig.URI" />

    <!-- Specify the application name(s) in the JAAS config. -->
    <util:list id="shibboleth.authn.JAAS.LoginConfigNames">
        <value>ShibUserPassAuth</value>
    </util:list>

    <alias name="ValidateUsernamePasswordAgainstJAAS"
alias="ValidateUsernamePassword"/>

</beans>
-----------------------------------------

jaas.config:
-------------------
ShibUserPassAuth
{
  idp3login.idp3module required;
};
------------------------

idp3module is a java class and uses Radius authentication.

This configuration seems to work with idp 3.2.1

On Wed, May 24, 2017 at 4:46 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 5/24/17, 3:34 AM, "users on behalf of Jukka Hakosalo" <
> users-bounces at shibboleth.net on behalf of jhakosal at gmail.com> wrote:
>
> > There is something wrong with authentication flow.
>
> What you posted isn't consistent with the error you got, so I don't know
> what to tell you. It suggests there are no flows configured and barring
> other warnings in the log I have no explanation for that, everything you
> posted couldn't really give that result.
>
> > general-authn.xml
>
> What you posted can't be the *whole* file, of course, that bean had better
> be inside the list it's normally declared inside.
>
> > Could there be something with the session? We uncommented
> > idp.authn.flows.initial = Password
>
> That's wrong to do.
>
> > Idp asked and verified username and password. Then the same error
> appeared.
>
> That would suggest perhaps that the SP was asking for some specific
> context class that the Password flow didn't support. I think you'd get
> slightly different logging and status codes from that, but that's all that
> comes to mind. Something must be filtering out Password from the set of
> options it can try, and it's left with nothing.
>
> Maybe you're not using the config you think you are.
>
> > Should we try to install 3.3.1 from scratch?
>
> No. Upgrades are safe and certainly don't break anything like this. Not
> unless you're using third party features that were implemented incorrectly
> to start with. A JAAS module wouldn't have any problem like that, it's the
> simplest case. Upgrading wouldn't touch any of the files involved here.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170611/c179cdca/attachment-0001.html>