MFA error: Cannot cast java.util.LinkedHashMap to net.shibboleth.utilities.java.support.service.ReloadableService

[Ryan Suarez]

Greetings,

We're running Shib IdP v4.1.0 and we're trying to setup MFA to obtain
the Users IP.  However, we are getting the following error:

   2021-05-13 16:21:22,719 - DEBUG
   [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:214]
   - Profile Action TransitionMultiFactorAuthentication: Applying MFA
   transition rule to exit state 'authn/Password'
   021-05-13 16:21:22,933 - INFO [net.shibboleth.idp.attribute:8] - user
   IP: xxx.xxx.xxx.xxx
   2021-05-13 16:21:23,072 - INFO [net.shibboleth.idp.attribute:30] -
   DEBUG: before error
   2021-05-13 16:21:23,089 - ERROR [net.shibboleth.idp.authn:-2] -
   Uncaught runtime exception
   java.lang.ClassCastException: Cannot cast java.util.LinkedHashMap to
   net.shibboleth.utilities.java.support.service.ReloadableService
   at java.base/java.lang.Class.cast(Class.java:3605)
   2021-05-13 16:21:23,097 - 142.55.118.43 - WARN
   [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event
   occurred while processing the request: RuntimeException
   
I've isolated the error to this line in mfa-authn-config.xml:

   logger.info("DEBUG: before error");
   resCtx.resolveAttributes(custom);
   logger.info("DEBUG: after error");

The error dissappears if I change p:customObject-
ref="secondFactorHelpersMap" back to p:customObject-
ref="shibboleth.AttributeResolverService", and comment out the IP
retrieval bits.  Below is relevant mfa-authn-config.xml lines.  How do
I fix this?  

   <bean id="checkDepartment"
   parent="shibboleth.ContextFunctions.Scripted" factory-
   method="inlineScript" p:customObject-ref="secondFactorHelpersMap">
     <constructor-arg>
       <value>
         <![CDATA[
           nextFlow = null;
           logger =
   Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.attr
   ibute");
   
           // Determine the user IP address
           httpRequestServletContext =
   custom.get("httpServletRequestContext");
           logger.info(" user IP: " +
   httpRequestServletContext.remoteAddr);
   
           // Go straight to second factor if we have to, or set up for an
   attribute lookup first.
           authCtx =
   input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationCon
   text");
           mfaCtx =
   authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuth
   enticationContext");
   
           if (mfaCtx.isAcceptable()) {
   
               // Attribute check is required to decide if first factor
   alone is enough.
               resCtx =
   input.getSubcontext("net.shibboleth.idp.attribute.resolver.context.Attr
   ibuteResolutionContext", true);
   
               // Look up the username
               usernameLookupStrategyClass =
   Java.type("net.shibboleth.idp.session.context.navigate.CanonicalUsernam
   eLookupStrategy");
               usernameLookupStrategy = new usernameLookupStrategyClass();
               username =
   usernameLookupStrategy.apply(input).toLowerCase();
               resCtx.setPrincipal(username);
   
              
    resCtx.getRequestedIdPAttributeNames().add("someAttribute");
                logger.info("DEBUG: before error");
             resCtx.resolveAttributes(custom);
             logger.info("DEBUG: after error");
   
                ... snip ...
               input.removeSubcontext(resCtx); // cleanup
           }
           nextFlow; // pass control to second factor or end with the
   first
         ]]>
       </value >
     </constructor-arg>
   </bean>
   
   <util:map id="secondFactorHelpersMap">
     <entry key="attributeResolver" value-
   ref="shibboleth.AttributeResolverService" />
     <entry key="httpServletRequestContext" value-
   ref="shibboleth.HttpServletRequest" />
   </util:map>

regards,
Ryan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210513/1be9604d/attachment.htm>