IdP 3.4.6 with Unicon plugin for external CAS

[Terry Smith]

Hi Leonard,

I had the same issue when attempting to upgrade to the latest CAS plugin. I
found that the additions to web.xml where not required.

I think the following line of code in the
file main/java/net/unicon/idp/externalauth/ShibcasAuthServlet.java

@WebServlet(name = "ShibcasAuthServlet", urlPatterns = {"/Authn/External/*"
})

is clashing with recommended changes to web.xml. The IdPs I have tested the
new CAS extensions on seem to work just fine without changes to web.xml.

Thanks,
Terry.


On Wed, Jan 29, 2020 at 6:59 AM Leonard J Peirce <leonard.peirce at wmich.edu>
wrote:

> On 2020-01-28 3:25 p.m., Jones, Brian wrote:
> > Hi Leonard,
> >
> > There is a little more detail in the release notes for shib-cas-authn3
> v3.3.0:
> >
> > https://github.com/Unicon/shib-cas-authn3/releases/tag/3.3.0
> >
> > I don't know for sure but maybe the error is related to the 3rd
> bulletpoint on that page (pasted below):
> >
> > ## begin paste ##
> >
> >      Remove the authn/Shibcas bean in
> IDP_HOME/conf/authn/general-authn.xml:
> >
> > ...
> >      <util:list id="shibboleth.AvailableAuthenticationFlows">
> >
> >          <bean id="authn/Shibcas" parent="shibboleth.AuthenticationFlow"
> >                  p:passiveAuthenticationSupported="true"
> >                  p:forcedAuthenticationSupported="true"
> >                  p:nonBrowserSupported="false" />
> > ...
> >
> > Note that if you an additional settings for this bean defined, such as
> one for supportedPrincipals, they need to be moved and applied to the
> authn/External bean instead in the same file, such that:
> >
> > <bean id="authn/External" parent="shibboleth.AuthenticationFlow"
> >    p:passiveAuthenticationSupported="true"
> >    p:forcedAuthenticationSupported="true"
> >    p:nonBrowserSupported="false">
> >      <property name="supportedPrincipals">
> >          <list>
> >              <bean parent="shibboleth.SAML2AuthnContextClassRef"
> >                    c:classRef="https://refeds.org/profile/mfa" />
> >                <bean parent="shibboleth.SAML2AuthnContextClassRef"
> >
> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
> />
> >          </list>
> >      </property>
> > </bean>
> >
> > ## end paste ##
>
> I saw that but at least in the README it appears to be related
> to 2FA which we aren't running.  At any rate I'm running the
> general-authn.xml unmodified.
>
> The online README also mentions removing IDP_HOME/flows/authn/Shibcas
> which I don't have.  Same result.
>
> Does anyone from Unicon have an idea?
>
> - Leonard
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200129/f480382b/attachment.html>