IdP 3.4.6 with Unicon plugin for external CAS

[Jones, Brian]

Hi Leonard,

There is a little more detail in the release notes for shib-cas-authn3 v3.3.0:  

https://github.com/Unicon/shib-cas-authn3/releases/tag/3.3.0

I don't know for sure but maybe the error is related to the 3rd bulletpoint on that page (pasted below):  

## begin paste ##

    Remove the authn/Shibcas bean in IDP_HOME/conf/authn/general-authn.xml:

...
    <util:list id="shibboleth.AvailableAuthenticationFlows">

        <bean id="authn/Shibcas" parent="shibboleth.AuthenticationFlow"
                p:passiveAuthenticationSupported="true"
                p:forcedAuthenticationSupported="true"
                p:nonBrowserSupported="false" />
...

Note that if you an additional settings for this bean defined, such as one for supportedPrincipals, they need to be moved and applied to the authn/External bean instead in the same file, such that:

<bean id="authn/External" parent="shibboleth.AuthenticationFlow"
  p:passiveAuthenticationSupported="true"
  p:forcedAuthenticationSupported="true"
  p:nonBrowserSupported="false">
    <property name="supportedPrincipals">
        <list>
            <bean parent="shibboleth.SAML2AuthnContextClassRef"
                  c:classRef="https://refeds.org/profile/mfa" />
              <bean parent="shibboleth.SAML2AuthnContextClassRef"
                  c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
        </list>
    </property>
</bean>

## end paste ##

Again, I don't know if that's what's going on, but I did a similar upgrade awhile back and I seem to recall consulting the release notes page linked above and the README file to get it done.  

Hope this helps and hope I'm not wasting your time!

Thanks,

Brian


Brian Jones 
Programmer Analyst IV 
Enterprise Development and Application Support, OIT 
The University of Alabama




-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Leonard J Peirce
Sent: Tuesday, January 28, 2020 1:54 PM
To: users at shibboleth.net
Subject: IdP 3.4.6 with Unicon plugin for external CAS

We've been using the plugin for a while and I'm attempting to test the latest Unicon plugin for authentication via an external CAS server for a new install of IdP 3.4.6.

The few steps in CAS plugin's README.md are simple.  I copy in the requisite files (no-conversation-state.jsp and both .jar files), update idp.properties, and update web.xml with the provided snippet:

     <!-- Servlet for receiving a callback from an external CAS Server and continues the IdP login flow -->
     <servlet>
         <servlet-name>ShibCas Auth Servlet</servlet-name>
 
<servlet-class>net.unicon.idp.externalauth.ShibcasAuthServlet</servlet-class>
         <load-on-startup>2</load-on-startup>
     </servlet>
     <servlet-mapping>
         <servlet-name>ShibCas Auth Servlet</servlet-name>
         <url-pattern>/Authn/External/*</url-pattern>
     </servlet-mapping>

When I redeploy the IdP refuses to start.  In jetty.log I get

    java.lang.IllegalStateException: Multiple servlets map to path: 
/Authn/External/*: ShibCas Auth Servlet,ShibcasAuthServlet

When I do not add the above snippet to web.xml things seem to work fine.

Is anyone else seeing this?  Or am I missing something?

TIA....

--
Leonard J. Peirce
Western Michigan University
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net