Can no longer install net.shibboleth.idp.plugin.authn.duo.nimbus plugin in IdP 4.3.1

[Brian Moon]

Hello all,

I am suddenly having some issues with our build process here that seems to
be due to the new release of net.shibboleth.oidc.common
(idp.oidc.common.3).  It seems
that net.shibboleth.idp.plugin.authn.duo.nimbus is
expecting idp.oidc.common.2 and fails to install:

./plugin.sh --truststore
/opt/shibboleth-idp/credentials/net.shibboleth.truststore.asc -I
net.shibboleth.oidc.common \
     && ./plugin.sh -I net.shibboleth.idp.plugin.oidc.config \
     && ./plugin.sh -I net.shibboleth.idp.plugin.oidc.op \
     && ./plugin.sh -I net.shibboleth.idp.plugin.authn.duo.nimbus
<SNIP>
Installing Plugin net.shibboleth.idp.plugin.authn.duo.nimbus version 1.3.0
WARN  - Required module idp.oidc.common.2 is missing or not enabled
ERROR  -  Plugin Install failed: One or more required modules are not
enabled

If I try to install
http://shibboleth.net/downloads/identity-provider/plugins/oidc-common/2.1.0/oidc-common-dist-2.1.0.tar.gz
to back to the idp.oidc.common.2 module, I am now receiving an error saying
that it is not supported on IdP 4.3.1:

./plugin.sh -i
http://shibboleth.net/downloads/identity-provider/plugins/oidc-common/2.1.0/oidc-common-dist-2.1.0.tar.gz
\
    && ./plugin.sh -i
http://shibboleth.net/downloads/identity-provider/plugins/oidc-op/3.3.0/idp-plugin-oidc-op-distribution-3.3.0.tar.gz
\
    && ./plugin.sh -I net.shibboleth.idp.plugin.authn.duo.nimbus
Downloading from HTTPResource [
http://shibboleth.net/downloads/identity-provider/plugins/oidc-common/2.1.0/oidc-common-dist-2.1.0.tar.gz
]
.
Downloading from HTTPResource [
http://shibboleth.net/downloads/identity-provider/plugins/oidc-common/2.1.0/oidc-common-dist-2.1.0.tar.gz.asc
]
ERROR  - Plugin net.shibboleth.oidc.common version 2.1.0 is not supported
with IdP Version 4.3.1
ERROR  -  Plugin Install failed: Version Mismatch

The last successful build I had was on May 12th.  Below is the output so
that you can see that net.shibboleth.oidc.common version 2.1.0 successfully
installed with IdP 4.3.1:

./plugin.sh -I net.shibboleth.oidc.common \
     && ./plugin.sh -I net.shibboleth.idp.plugin.oidc.op \
     && ./plugin.sh -I net.shibboleth.idp.plugin.authn.duo.nimbus
Downloading from HTTPResource [
http://shibboleth.net/downloads/identity-provider/plugins/oidc-common/2.1.0/oidc-common-dist-2.1.0.tar.gz
]
...........................
Downloading from HTTPResource [
http://shibboleth.net/downloads/identity-provider/plugins/oidc-common/2.1.0/oidc-common-dist-2.1.0.tar.gz.asc
]
Installing Plugin net.shibboleth.oidc.common version 2.1.0
Rebuilding /opt/shibboleth-idp/war/idp.war, Version 4.3.1
Initial populate from /opt/shibboleth-idp/dist/webapp to
/opt/shibboleth-idp/webpapp.tmp
Overlay from /opt/shibboleth-idp/dist/plugin-webapp to
/opt/shibboleth-idp/webpapp.tmp
Overlay from /opt/shibboleth-idp/edit-webapp to
/opt/shibboleth-idp/webpapp.tmp
Creating war file /opt/shibboleth-idp/war/idp.war
Downloading from HTTPResource [
http://shibboleth.net/downloads/identity-provider/plugins/oidc-op/3.3.0/idp-plugin-oidc-op-distribution-3.3.0.tar.gz
]
.................................................................................................................................
Downloading from HTTPResource [
http://shibboleth.net/downloads/identity-provider/plugins/oidc-op/3.3.0/idp-plugin-oidc-op-distribution-3.3.0.tar.gz.asc
]
Installing Plugin net.shibboleth.idp.plugin.oidc.op version 3.3.0
Rebuilding /opt/shibboleth-idp/war/idp.war, Version 4.3.1
Initial populate from /opt/shibboleth-idp/dist/webapp to
/opt/shibboleth-idp/webpapp.tmp
Overlay from /opt/shibboleth-idp/dist/plugin-webapp to
/opt/shibboleth-idp/webpapp.tmp
Overlay from /opt/shibboleth-idp/edit-webapp to
/opt/shibboleth-idp/webpapp.tmp
Creating war file /opt/shibboleth-idp/war/idp.war
Module file changes as a result of this install
    bin/oidc-clients.sh created
    conf/oidc-clientinfo-resolvers.xml.idpnew created
    static/openid-configuration.json.idpnew created
    bin/lib/json-web-key-generator-0.8.2-jar-with-dependencies.jar created
    conf/attributes/oidc-claim-rules.xml.idpnew created
    bin/jwtgen.sh created
    bin/issue-access-token.bat created
    conf/authn/oauth2client-authn-config.xml created
    bin/issue-access-token.sh created
    conf/oidc-credentials.xml created
    conf/examples/oidc-attribute-filter.xml created
    bin/jwtgen.bat created
    conf/oidc.properties.idpnew created
    conf/examples/oidc-attribute-resolver.xml created
    bin/oidc-clients.bat created
Downloading from HTTPResource [
http://shibboleth.net/downloads/identity-provider/plugins/duo-oidc/1.3.0/idp-plugin-duo-nimbus-dist-1.3.0.tar.gz
]
.
Downloading from HTTPResource [
http://shibboleth.net/downloads/identity-provider/plugins/duo-oidc/1.3.0/idp-plugin-duo-nimbus-dist-1.3.0.tar.gz.asc
]
Installing Plugin net.shibboleth.idp.plugin.authn.duo.nimbus version 1.3.0
Rebuilding /opt/shibboleth-idp/war/idp.war, Version 4.3.1
Initial populate from /opt/shibboleth-idp/dist/webapp to
/opt/shibboleth-idp/webpapp.tmp
Overlay from /opt/shibboleth-idp/dist/plugin-webapp to
/opt/shibboleth-idp/webpapp.tmp
Overlay from /opt/shibboleth-idp/edit-webapp to
/opt/shibboleth-idp/webpapp.tmp
Creating war file /opt/shibboleth-idp/war/idp.war

I have also tried with net.shibboleth.idp.plugin.authn.duo.sdk, but I get
the same behavior.  Any suggestions for how to work around this would be
much appreciated.

Thanks!

Brian Moon
Senior System Administrator, Enterprise Systems
Santa Clara University
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230517/caf13713/attachment.htm>