IdP 3.4.6 with Unicon plugin for external CAS

[Leonard J Peirce]

On 2020-01-28 3:25 p.m., Jones, Brian wrote:
> Hi Leonard,
> 
> There is a little more detail in the release notes for shib-cas-authn3 v3.3.0:
> 
> https://github.com/Unicon/shib-cas-authn3/releases/tag/3.3.0
> 
> I don't know for sure but maybe the error is related to the 3rd bulletpoint on that page (pasted below):
> 
> ## begin paste ##
> 
>      Remove the authn/Shibcas bean in IDP_HOME/conf/authn/general-authn.xml:
> 
> ...
>      <util:list id="shibboleth.AvailableAuthenticationFlows">
> 
>          <bean id="authn/Shibcas" parent="shibboleth.AuthenticationFlow"
>                  p:passiveAuthenticationSupported="true"
>                  p:forcedAuthenticationSupported="true"
>                  p:nonBrowserSupported="false" />
> ...
> 
> Note that if you an additional settings for this bean defined, such as one for supportedPrincipals, they need to be moved and applied to the authn/External bean instead in the same file, such that:
> 
> <bean id="authn/External" parent="shibboleth.AuthenticationFlow"
>    p:passiveAuthenticationSupported="true"
>    p:forcedAuthenticationSupported="true"
>    p:nonBrowserSupported="false">
>      <property name="supportedPrincipals">
>          <list>
>              <bean parent="shibboleth.SAML2AuthnContextClassRef"
>                    c:classRef="https://refeds.org/profile/mfa" />
>                <bean parent="shibboleth.SAML2AuthnContextClassRef"
>                    c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
>          </list>
>      </property>
> </bean>
> 
> ## end paste ##

I saw that but at least in the README it appears to be related
to 2FA which we aren't running.  At any rate I'm running the
general-authn.xml unmodified.

The online README also mentions removing IDP_HOME/flows/authn/Shibcas
which I don't have.  Same result.

Does anyone from Unicon have an idea?

- Leonard