SPNEGO Activation condition breaks session manager properties

[Robert Duncan]

Hi,

I have SPNEGO login flow active and working well, however I do need to restrict its' availability and am trying the activation condition based on the examples:
https://wiki.shibboleth.net/confluence/display/IDP30/SPNEGOAuthnConfiguration#SPNEGOAuthnConfiguration-ExampleConditionsinJavaScript:

Here are my edits to general-authn.xml

<bean id="authn/SPNEGO" parent="shibboleth.AuthenticationFlow"
                p:nonBrowserSupported="false"
                p:activationCondition-ref="shibboleth.SPNEGO.ActivationCondition">
            <property name="supportedPrincipals">
                <list>
                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
                        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos" />
                    <bean parent="shibboleth.SAML1AuthenticationMethod"
                        c:method="urn:ietf:rfc:1510" />
                </list>
            </property>
        </bean>

        <bean id="shibboleth.SPNEGO.ActivationCondition" parent="shibboleth.Conditions.Scripted" factory-method="inlineScript"
                 p:customObject-ref="shibboleth.HttpServletRequest">
             <constructor-arg>
                <value>
                  <![CDATA[
                        var activate = false;
                        if (custom.remoteAddr.startsWith("192.168.42.")) {
                        activate = true;
                        }
                        activate;
                     ]]>
                </value>
            </constructor-arg>
       </bean>


This should disable SPNEGO on my VLAN for testing, but the idp complains:

Error creating bean with name 'shibboleth.SessionManager' defined in file [/opt/shibboleth-idp/system/conf/session-manager-system.xml]: Error setting property values; nested exception is org.springframework.beans.PropertyBatchUpdateException; nested PropertyAccessExceptions (1) are:
PropertyAccessException 1: org.springframework.beans.TypeMismatchException: Failed to convert property value of type [java.util.ArrayList] to required type [java.lang.Iterable] for property 'authenticationFlowDescriptors'; nested exception is java.lang.ClassCastException: net.shibboleth.idp.profile.logic.ScriptedPredicate cannot be cast to net.shibboleth.idp.authn.AuthenticationFlowDescriptor

Tomcat reports the same
Failed to convert property value of type [java.util.ArrayList] to required type [java.lang.Iterable] for property 'authenticationFlowDescriptors'; nested exception is java.lang.ClassCastException: net.shibboleth.idp.profile.logic.ScriptedPredicate cannot be cast to net.shibboleth.idp.authn.AuthenticationFlowDescriptor

I don't see any javax.script.ScriptException errors

My idp.properties
idp.authn.flows=SPNEGO|Password

I have extended the password flow and added the velocity markup which is all working as expected, but whenever I try the above activation condition the session manager complains.

Thanks,
Robert Duncan

________________________________

The information contained and transmitted in this e-mail is confidential information, and is intended only for the named recipient to which it is addressed. The content of this e-mail may not have been sent with the authority of National College of Ireland. Any views or opinions presented are solely those of the author and do not necessarily represent those of National College of Ireland. If the reader of this message is not the named recipient or a person responsible for delivering it to the named recipient, you are notified that the review, dissemination, distribution, transmission, printing or copying, forwarding, or any other use of this message or any part of it, including any attachments, is strictly prohibited. If you have received this communication in error, please delete the e-mail and destroy all record of this communication. Thank you for your assistance.
________________________________