idp 5.11 with Jetty 12, duo fail

[Paul B. Henson]

I'm setting up idp 5.11 with jetty 12. As I understand the wiki, jetty
12 is supported but not well tested.

I'm having trouble getting Duo working. I removed all things Duo from my
config and validated correct operation of the idp with just the password
flow.

I then install the duo plugin:

	plugin.sh -I net.shibboleth.oidc.common
	plugin.sh -I net.shibboleth.idp.plugin.authn.duo.nimbus

At that point, with no change in configuration or attempt to use Duo in
any way, the idp breaks. It loads fine with no warnings, but as soon as
I try to authenticate through it I get this:

2024-03-23 19:55:55,954 - / - WARN [net.shibboleth.shared.spring.context.DelimiterAwareApplicationContext:632] - Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.webflow.mvc.servlet.FlowHandlerMapping#0' defined in class path resource [net/shibboleth/idp/conf/mvc-beans.xml]: Cannot resolve reference to bean 'flowRegistry' while setting bean property 'flowRegistry'
2024-03-23 19:55:55,955 - / - ERROR [org.springframework.web.servlet.DispatcherServlet:541] - Context initialization failed
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.webflow.mvc.servlet.FlowHandlerMapping#0' defined in class path resource [net/shibboleth/idp/conf/mvc-beans.xml]: Cannot resolve reference to bean 'flowRegistry' while setting bean property 'flowRegistry'
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'flowRegistry' defined in class path resource [net/shibboleth/idp/conf/webflow-config.xml]: Illegal attempt to register pre-existing flow ID 'authn/DuoOIDC'via resource: URL [jar:file:/var/lib/jetty/tmp/jetty-127_0_0_1-80-idp_war-_idp-any-1521988914299403696/webapp/WEB-INF/lib/idp-plugin-duo-impl-2.0.0.jar!/META-INF/net/shibboleth/idp/flows/authn/DuoOIDC/duo-oidc-authn-flow.xml]

Any thoughts?

On a side note, jetty 12 doesn't come with the logback-access module. Also,
it supports multiple versions of the servlet API. I picked ee9, which is
servlet API 5, it also has ee10 for API 6 and ee8 for 4. The modules are
all versioned, so instead of just deploy, annotations, jsp, etc, they're
ee9-deploy, ee9-annotations, ee9-jsp, etc. It's quite possible I didn't
translate the exemplar jetty 11 config from your repo properly into
jetty 12, but password works fine, so I think I have at least the basics
right :).

I guess I could step back to jetty 11, which I assume will work fine as
that's what all you devs are running. However, per jetty, "Jetty 12 is
the only community supported version of Jetty at this point in time", and
it seems silly to update from my existing 9 to a version that's already
in sunset.

Thanks much...

-- 
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768