Odd Duo Exception after upgrading to 3.3.0 from 3.2.0

[Christopher Bongaarts]

On 3/27/2017 6:14 PM, Cantor, Scott wrote:
> In Unicon's case, they're using annotations to autowire these beans into the various lists and objects inside the IdP's Spring wiring:
>
> https://github.com/Unicon/shib-mfa-duo-auth/blob/master/src/main/groovy/net/unicon/iam/shibboleth/idp/authn/duo/global/Config.groovy
>
> While there's no specific reason that that should have stopped working (the bean names referenced are "public" and have not changed names or definitions), it's also unsupported because we have an official, if possibly not clearly documented, rule that annotations are unsupported.
>
> If it did break, which seems to be the case, it would be interesting to know why, but mostly as a "this is why they're not supported" exercise demonstrating the reason for avoiding them.

I believe it was an interaction between their autowiring, my munging of 
the search paths in web.xml, and my workarounds to get it loaded (i.e. 
deleting the webflow config class from the unicon .jar) that lead to our 
wacky results.  And I'm not *too* surprised, as the install instructions 
for the plugin already required fuzzing for 3.2.1.

This most recent one was extra confusing to me, as it seemed awfully 
late in the game for the IdP to not have an auth flow descriptor for the 
Duo flow, seeing as how it had recently finished running to authenticate 
me.... :/  So I figure it was that somehow the descriptor got wired in 
in one place, or the global Config class kinda-sorta wired it in, but it 
didn't end up in the AFD list that got injected into the StorageManager 
somehow (but I'm not sure how - the default storage manager bean def is 
just injecting a ref to the main shibboleth.AvailableAuthenticationFlows 
list bean).

I'm pretty sure that the Unicon plugin could be pretty easily massaged 
to be installable in 3.3.x, by figuring out which Config classes needed 
to be updated to avoid registering things twice, and shuffling the jar 
structure around to use the new layout.  I'd only see that as worth 
doing if there are a lot of people using it who haven't gone to 3.3 
already, though.

But yeah, I'm pretty sure it's just a packaging/plugin 
registration/configuration issue; I didn't need to touch the actual code 
or flows themselves - once the IdP can find them, they Just Work.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%