Question about Shibboleth and MFA - Google Authenticator

[Melvin Lasky]

Hey everyone,
	I have successfully gotten Shibboleth to work with my Banner services thanks to everyone here. Next up, MFA. Now, I have successfully gotten that to work as well, with Duo.

However, we are looking into using Google Authenticator. I found this plugin: https://github.com/korteke/Shibboleth-IdP3-TOTP-Auth <https://github.com/korteke/Shibboleth-IdP3-TOTP-Auth>

The plugin says it’s for 3.2.x but I’m running 3.4.3 not sure if that makes a difference.

I tried using it, and,  it is no way the same polish as the Duo plugin. Not sure end users would be happy “registering a token?”.

Anyhow,  that being said, i Can’t get it to work. I still set my authn.flows to MFA, and replaced Duo with the Totp, and then did the rest of the instructions. 

When I log in, I. have to log in twice. Then after that, it brings me to a Token screen, where I can hit register new token. I. click that. Then. I’m getting:

Web Login Service - Uncaught Exception
A software error was encountered that prevents normal operation:

$encoder.encodeForHTML($flowExecutionException.getCause().toString())

Please report this problem to your Help Desk or administrative staff. It has also been logged for an administrator to review.

In my logs I see:

shib-idp;idp-process.log;dev;nothing;2019-02-15 15:08:49,286 - ERROR [org.springframework.webflow.execution.repository.NoSuchFlowExecutionException:76] - 
shib-idp;idp-process.log;dev;nothing;org.springframework.webflow.execution.repository.NoSuchFlowExecutionException: No flow execution could be found with key 'e1s3' -- perhaps this executing flow has ended or expired? This could happen if your users are relying on browser history (typically via the back button) that references ended flows.
shib-idp;idp-process.log;dev;nothing;	at org.springframework.webflow.execution.repository.support.AbstractFlowExecutionRepository.getConversation(AbstractFlowExecutionRepository.java:172)
shib-idp;idp-process.log;dev;nothing;Caused by: org.springframework.webflow.conversation.NoSuchConversationException: No conversation could be found with id '1' -- perhaps this conversation has ended? 
shib-idp;idp-process.log;dev;nothing;	at org.springframework.webflow.conversation.impl.ConversationContainer.getConversation(ConversationContainer.java:126)
shib-idp;idp-warn.log;dev;nothing;2019-02-15 15:08:49,286 - ERROR [org.springframework.webflow.execution.repository.NoSuchFlowExecutionException:76] - 
shib-idp;idp-warn.log;dev;nothing;org.springframework.webflow.execution.repository.NoSuchFlowExecutionException: No flow execution could be found with key 'e1s3' -- perhaps this executing flow has ended or expired? This could happen if your users are relying on browser history (typically via the back button) that references ended flows.
shib-idp;idp-warn.log;dev;nothing;	at org.springframework.webflow.execution.repository.support.AbstractFlowExecutionRepository.getConversation(AbstractFlowExecutionRepository.java:172)
shib-idp;idp-warn.log;dev;nothing;Caused by: org.springframework.webflow.conversation.NoSuchConversationException: No conversation could be found with id '1' -- perhaps this conversation has ended? 
shib-idp;idp-warn.log;dev;nothing;	at org.springframework.webflow.conversation.impl.ConversationContainer.getConversation(ConversationContainer.java:126)
shib-idp;idp-process.log;dev;nothing;2019-02-15 15:08:49,288 - WARN [net.shibboleth.ext.spring.error.ExtendedMappingExceptionResolver:136] - Resolved [org.springframework.webflow.execution.repository.NoSuchFlowExecutionException: No flow execution could be found with key 'e1s3' -- perhaps this executing flow has ended or expired? This could happen if your users are relying on browser history (typically via the back button) that references ended flows.] to ModelAndView: reference to view with name 'error'; model is {exception=org.springframework.webflow.execution.repository.NoSuchFlowExecutionException: No flow execution could be found with key 'e1s3' -- perhaps this executing flow has ended or expired? This could happen if your users are relying on browser history (typically via the back button) that references ended flows., request=org.apache.catalina.connector.RequestFacade at 4f585d82, encoder=class net.shibboleth.utilities.java.support.codec.HTMLEncoder, springContext=Root WebApplicationContext: startup date [Fri Feb 15 14:59:47 UTC 2019]; root of context hierarchy}
shib-idp;idp-warn.log;dev;nothing;2019-02-15 15:08:49,288 - WARN [net.shibboleth.ext.spring.error.ExtendedMappingExceptionResolver:136] - Resolved [org.springframework.webflow.execution.repository.NoSuchFlowExecutionException: No flow execution could be found with key 'e1s3' -- perhaps this executing flow has ended or expired? This could happen if your users are relying on browser history (typically via the back button) that references ended flows.] to ModelAndView: reference to view with name 'error'; model is {exception=org.springframework.webflow.execution.repository.NoSuchFlowExecutionException: No flow execution could be found with key 'e1s3' -- perhaps this executing flow has ended or expired? This could happen if your users are relying on browser history (typically via the back button) that references ended flows., request=org.apache.catalina.connector.RequestFacade at 4f585d82, encoder=class net.shibboleth.utilities.java.support.codec.HTMLEncoder, springContext=Root WebApplicationContext: startup date [Fri Feb 15 14:59:47 UTC 2019]; root of context hierarchy}
shib-idp;idp-process.log;dev;nothing;2019-02-15 15:08:58,333 - WARN [org.ldaptive.AbstractOperation$ReopenOperationExceptionHandler:277] - Operation exception encountered, reopening connection
shib-idp;idp-warn.log;dev;nothing;2019-02-15 15:08:58,333 - WARN [org.ldaptive.AbstractOperation$ReopenOperationExceptionHandler:277] - Operation exception encountered, reopening connection
shib-idp;idp-warn.log;dev;nothing;2019-02-15 15:08:58,377 - WARN [org.ldaptive.AbstractOperation$ReopenOperationExceptionHandler:277] - Operation exception encountered, reopening connection
shib-idp;idp-process.log;dev;nothing;2019-02-15 15:08:58,377 - WARN [org.ldaptive.AbstractOperation$ReopenOperationExceptionHandler:277] - Operation exception encountered, reopening connection
shib-idp;idp-process.log;dev;nothing;2019-02-15 15:08:58,418 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:152] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'melvin.lasky' succeeded
shib-idp;idp-process.log;dev;nothing;2019-02-15 15:09:01,217 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:152] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'melvin.lasky' succeeded
shib-idp;idp-process.log;dev;nothing;2019-02-15 15:09:02,414 - ERROR [net.shibboleth.idp.authn:-2] - Uncaught runtime exception
shib-idp;idp-process.log;dev;nothing;org.springframework.webflow.engine.NoMatchingTransitionException: No transition found on occurence of event 'GenerateTokenSecrets' in state 'DisplayTotpForm' of flow 'authn/Totp' -- valid transitional criteria are array<TransitionCriteria>[proceed] -- likely programmer error, check the set of TransitionCriteria for this state
shib-idp;idp-process.log;dev;nothing;	at org.springframework.webflow.engine.TransitionableState.getRequiredTransition(TransitionableState.java:93)
shib-idp;idp-warn.log;dev;nothing;2019-02-15 15:09:02,414 - ERROR [net.shibboleth.idp.authn:-2] - Uncaught runtime exception
shib-idp;idp-warn.log;dev;nothing;org.springframework.webflow.engine.NoMatchingTransitionException: No transition found on occurence of event 'GenerateTokenSecrets' in state 'DisplayTotpForm' of flow 'authn/Totp' -- valid transitional criteria are array<TransitionCriteria>[proceed] -- likely programmer error, check the set of TransitionCriteria for this state
shib-idp;idp-warn.log;dev;nothing;	at org.springframework.webflow.engine.TransitionableState.getRequiredTransition(TransitionableState.java:93)
shib-idp;idp-process.log;dev;nothing;2019-02-15 15:09:02,419 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: RuntimeException
shib-idp;idp-warn.log;dev;nothing;2019-02-15 15:09:02,419 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: RuntimeException
shib-idp;idp-audit.log;dev;nothing;20190215T150902Z||||https://www.apereo.org/cas/protocol/login|||||||||
shib-idp;idp-process.log;dev;nothing;2019-02-15 15:09:02,434 - INFO [Shibboleth-Audit.SSO:275] - 20190215T150902Z||||https://www.apereo.org/cas/protocol/login|||||||||

Any suggestions would be awesome! You guys are great!

Melvin Lasky
Associate Director of Enterprise Architecture





Riverdale, NY 10471
Phone: 718-862-7410
melvin.lasky at manhattan.edu <mailto:melvin.lasky at manhattan.edu>
www.manhattan.edu <http://www.manhattan.edu/>




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190215/2e35e806/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: email_logo.jpg
Type: image/jpeg
Size: 7478 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20190215/2e35e806/attachment.jpg>