ECP on an idp configured for MFA

[Paul B. Henson]

> From: Cantor, Scott
> Sent: Tuesday, February 19, 2019 1:59 PM
>
> Basically it just all works except when it doesn't.

You know, I think that would make a perfect epitaph for my tombstone ;).

> Make your MFA logic and all the subordinate flows do whatever's necessary
> to support your use case, basically. There's no recommendation, it depends
> on whatever it is you expect to happen and whether it's technically possible.

Hmm, I think I might have something else going on a bit lower in the stack 8-/. I removed nonBrowserSupported="false" from the authn/Duo bean in general-authn.xml, then I temporarily disabled my own Duo activation so the MFA flow should have only used password, and I finally just set the only active flow to password in the properties file:

idp.authn.flows = Password

All of these still resulted in the same error:

2019-02-19 16:38:39,055 - 2620:df:8000:f000:0:1:250:134/8D99A2CF57F1B12D17F7DD1CF986290E - WARN [net.shibbolet
h.idp.profile.impl.SelectProfileConfiguration:117] - Profile Action SelectProfileConfiguration: Profile http:/
/shibboleth.net/ns/profiles/saml2/sso/ecp is not available for RP configuration RelyingPartyByTag$child#505954
0b (RPID https://cilogon.org/shibboleth)

So I turned on debugging, and it looks like this:

2019-02-19 16:46:56,477 - 2620:df:8000:f000:0:1:250:134/6D53779CBD46FBC60CFC2DC19FE5121A - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:305] - Checking if relying party configuration RelyingPartyByTag$child#5059540b is applicable
2019-02-19 16:46:56,477 - 2620:df:8000:f000:0:1:250:134/6D53779CBD46FBC60CFC2DC19FE5121A - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:307] - Relying party configuration RelyingPartyByTag$child#5059540b is applicable
2019-02-19 16:46:56,477 - 2620:df:8000:f000:0:1:250:134/6D53779CBD46FBC60CFC2DC19FE5121A - DEBUG [net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration:136] - Profile Action SelectRelyingPartyConfiguration: Found relying party configuration RelyingPartyByTag$child#5059540b for request
2019-02-19 16:46:56,483 - 2620:df:8000:f000:0:1:250:134/6D53779CBD46FBC60CFC2DC19FE5121A - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:117] - Profile Action SelectProfileConfiguration: Profile http://shibboleth.net/ns/profiles/saml2/sso/ecp is not available for RP configuration RelyingPartyByTag$child#5059540b (RPID https://cilogon.org/shibboleth)
2019-02-19 16:46:56,490 - 2620:df:8000:f000:0:1:250:134/6D53779CBD46FBC60CFC2DC19FE5121A - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: InvalidProfileConfiguration
2019-02-19 16:46:56,491 - 2620:df:8000:f000:0:1:250:134/6D53779CBD46FBC60CFC2DC19FE5121A - DEBUG [net.shibboleth.idp.saml.saml2.profile.config.logic.SOAPErrorPredicate:84] - No ECP profile configuration found, assuming error handled with SOAP fault

I have ECP enabled in my default relying party configuration:

    <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
        <property name="profileConfigurations">
            <list>
[...]
                <ref bean="SAML2.ECP" />

So I'm not sure why it says it is not available? The entity ID https://cilogon.org/shibboleth is in Incommon metadata, so it should be using the default relying party, not the unverified RelyingParty (which has no profiles enabled)?