Difficulties switching from authn/Duo to authn/DuoOIDC

[Dan Oachs]

I'm hoping someone here can point me in the right direction to see what I
am missing when trying to switch our setup from our existing Duo setup with
an iframe to the new Duo setup with Universal prompt.

I am running shibboleth 4.3.0, jetty 9.4.50 and openjdk 11.0.17 on CenOS
7.9.  This system has been upgraded many many times since shibboleth 3.3.1
or so.

I believe I have followed all the instructions from the wiki (
https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1374027959/DuoOIDCAuthnConfiguration
)

When I go to login, I can enter my username and password, it is verified
with ldap, and when it goes to the second step in the MFA flow, I get the
following error in the logs:

2023-01-24 08:32:23,252 - INFO [net.shibboleth.idp.authn.
impl.LDAPCredentialValidator:163] - Credential Validator ldap: Login by
'doachs' succeeded
2023-01-24 08:32:23,265 - ERROR [net.shibboleth.idp.authn:39] - Uncaught
runtime exception
org.springframework.binding.expression.EvaluationException: An ELException
occurred getting the value for expression 'ExtractDuoAuthenticationFromHeaders'
on context [class org.springframework.webflow.engine.impl.
RequestControlContextImpl]
        at org.springframework.binding.expression.spel.
SpringELExpression.getValue(SpringELExpression.java:104)
Caused by: org.springframework.expression.spel.SpelEvaluationException:
EL1021E: A problem occurred whilst attempting to access the property '
ExtractDuoAuthenticationFromHeaders': 'Error creating bean with name '
ExtractDuoAuthenticationFromHeaders' defined in URL
[jar:file:/tmp/jetty-0_0_0_0-443-idp_war-_idp-any-
14858854228761629283/webinf/WEB-INF/lib/idp-plugin-duo-
impl-1.3.0.jar!/META-INF/net/shibboleth/idp/flows/authn/
DuoOIDC/duo-oidc-authn-beans.xml]: Cannot resolve reference to bean
'shibboleth.authn.DuoOIDC.internal.HttpServletRequest' while setting bean
property 'httpServletRequest'; nested exception is
org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean
named 'shibboleth.authn.DuoOIDC.internal.HttpServletRequest' available'
        at org.springframework.expression.spel.ast.PropertyOrFieldReference.
readProperty(PropertyOrFieldReference.java:209)
Caused by: org.springframework.beans.factory.BeanCreationException: Error
creating bean with name 'ExtractDuoAuthenticationFromHeaders' defined in
URL [jar:file:/tmp/jetty-0_0_0_0-443-idp_war-_idp-any-
14858854228761629283/webinf/WEB-INF/lib/idp-plugin-duo-
impl-1.3.0.jar!/META-INF/net/shibboleth/idp/flows/authn/
DuoOIDC/duo-oidc-authn-beans.xml]: Cannot resolve reference to bean
'shibboleth.authn.DuoOIDC.internal.HttpServletRequest' while setting bean
property 'httpServletRequest'; nested exception is
org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean
named 'shibboleth.authn.DuoOIDC.internal.HttpServletRequest' available
        at org.springframework.beans.factory.support.
BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.
java:342)
Caused by: org.springframework.beans.factory.NoSuchBeanDefinitionException:
No bean named 'shibboleth.authn.DuoOIDC.internal.HttpServletRequest'
available
        at org.springframework.beans.factory.support.
DefaultListableBeanFactory.getBeanDefinition(DefaultListableBeanFactory.
java:874)
2023-01-24 08:32:23,268 - WARN [org.opensaml.profile.action.impl.LogEvent:101]
- A non-proceed event occurred while processing the request:
RuntimeException

Can anyone point out what step I must have missed in configuring DuoOIDC?
Obviously the issue is that it can't find a bean named
shibboleth.authn.DuoOIDC.internal.HttpServletRequest.  But why?  What did I
not do?

Thanks,
   Dan Oachs
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230124/c611edc9/attachment.htm>