Add Alternative Authentication Flow on the Login Page

[Zunan Dong]

Hi,

I'm trying to add a button to trigger X509 authentication flow on Duo login page. I put the following code after the Duo iframe.

<form action="$flowExecutionUrl" method="post">
          <button type="submit" name="_eventId_authn/X509" class="btn btn-primary btn-lg">Login with eToken</button>
</form>

This button should reselect the authentication flow, authn/x509. It works well in v3.3.0. However, after we upgrade our UAT IdP to v4.0.1, this only works for service providers with force authentication enabled. For other service providers, we get the following error message after click on the button.

- DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:214] - Profile Action TransitionMultiFactorAuthentication: Applying MFA transition rule to exit state 'authn/Duo'
 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:231] - Profile Action TransitionMultiFactorAuthentication: MFA flow completing with event 'ReselectFlow'
 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:142] - Profile Action SelectAuthenticationFlow: Moving incomplete flow authn/MFA to intermediate set
 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:190] - Profile Action SelectAuthenticationFlow: Attempting to honor signaled flow authn/X509
 - ERROR [net.shibboleth.idp.authn:-2] - Uncaught runtime exception
java.lang.NullPointerException: null
        at net.shibboleth.idp.authn.impl.SelectAuthenticationFlow.doSelectSignaledFlow(SelectAuthenticationFlow.java:204)

Am I doing anything wrong? Any suggestions will be appreciated.

Thanks,

Zunan Dong

Authentication Systems Specialist

Information Security

Information Technology Service

University of Toronto

Email: zunan.dong at utoronto.ca

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210201/23a8d281/attachment.htm>