IdP 3.4.6 with Unicon plugin for external CAS

[Michael A Grady]

How this is configured, and what all is required,  for a given version of shib-cas-authn3 and the Shib IdP has changed over time. Which is why -- but clearly not anywheres obvious enough -- the top-level Github page does say, in the Installation section:

 NOTE: You should ALWAYS refers to the README.md file that is packaged with the release for instructions.

and which links to this:

  https://github.com/Unicon/shib-cas-authn3/releases <https://github.com/Unicon/shib-cas-authn3/releases>

It is clear that top-level README page needs some modification, perhaps best to have very little and point of to the release documentation much more boldly. I'll ask th team to take a look at, and to double-check the shib-cas-authn3 release 3.3.0 specific instructions.

> On Jan 28, 2020, at 6:56 PM, Terry Smith <t.smith at aaf.edu.au> wrote:
> 
> Hi Leonard,
> 
> I had the same issue when attempting to upgrade to the latest CAS plugin. I found that the additions to web.xml where not required.  
> 
> I think the following line of code in the file main/java/net/unicon/idp/externalauth/ShibcasAuthServlet.java 
> 
> @WebServlet(name = "ShibcasAuthServlet", urlPatterns = {"/Authn/External/*"}) 
> 
> is clashing with recommended changes to web.xml. The IdPs I have tested the new CAS extensions on seem to work just fine without changes to web.xml.
> 
> Thanks,
> Terry.
> 
> 
> On Wed, Jan 29, 2020 at 6:59 AM Leonard J Peirce <leonard.peirce at wmich.edu <mailto:leonard.peirce at wmich.edu>> wrote:
> On 2020-01-28 3:25 p.m., Jones, Brian wrote:
> > Hi Leonard,
> > 
> > There is a little more detail in the release notes for shib-cas-authn3 v3.3.0:
> > 
> > https://github.com/Unicon/shib-cas-authn3/releases/tag/3.3.0 <https://github.com/Unicon/shib-cas-authn3/releases/tag/3.3.0>
> > 
> > I don't know for sure but maybe the error is related to the 3rd bulletpoint on that page (pasted below):
> > 
> > ## begin paste ##
> > 
> >      Remove the authn/Shibcas bean in IDP_HOME/conf/authn/general-authn.xml:
> > 
> > ...
> >      <util:list id="shibboleth.AvailableAuthenticationFlows">
> > 
> >          <bean id="authn/Shibcas" parent="shibboleth.AuthenticationFlow"
> >                  p:passiveAuthenticationSupported="true"
> >                  p:forcedAuthenticationSupported="true"
> >                  p:nonBrowserSupported="false" />
> > ...
> > 
> > Note that if you an additional settings for this bean defined, such as one for supportedPrincipals, they need to be moved and applied to the authn/External bean instead in the same file, such that:
> > 
> > <bean id="authn/External" parent="shibboleth.AuthenticationFlow"
> >    p:passiveAuthenticationSupported="true"
> >    p:forcedAuthenticationSupported="true"
> >    p:nonBrowserSupported="false">
> >      <property name="supportedPrincipals">
> >          <list>
> >              <bean parent="shibboleth.SAML2AuthnContextClassRef"
> >                    c:classRef="https://refeds.org/profile/mfa <https://refeds.org/profile/mfa>" />
> >                <bean parent="shibboleth.SAML2AuthnContextClassRef"
> >                    c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
> >          </list>
> >      </property>
> > </bean>
> > 
> > ## end paste ##
> 
> I saw that but at least in the README it appears to be related
> to 2FA which we aren't running.  At any rate I'm running the
> general-authn.xml unmodified.
> 
> The online README also mentions removing IDP_HOME/flows/authn/Shibcas
> which I don't have.  Same result.
> 
> Does anyone from Unicon have an idea?
> 
> - Leonard
> -- 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg <https://wiki.shibboleth.net/confluence/x/coFAAg>
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net <mailto:users-unsubscribe at shibboleth.net>
> 
>  
> This email has been scanned for spam and viruses by Proofpoint Essentials. Click here <https://us2.proofpointessentials.com/index01.php?mod_id=11&mod_option=logitem&mail_id=1580259444-K-xBWzkfg8IH&r_address=mgrady%40unicon.net&report=1> to report this email as spam.
> 
> 
> -- 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg <https://wiki.shibboleth.net/confluence/x/coFAAg>
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net <mailto:users-unsubscribe at shibboleth.net>
--
Michael A. Grady
IAM Architect, Unicon, Inc.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200128/cccc38e5/attachment.html>