Shibboleth IdP Removing flow authn/RemoteUser, it does not support forced authentication

[Mathew, Sunil]

Hi,

I have set up a new SP in Shibboleth IdP 4.2.1.

When I try to login using url:
https://shibboleth-staging.vmock.com/vmock/shib/Shibboleth.sso/Login?entityID=https%3A%2F%2Fsso.hbsstg.org%2Fidp%2Fshibboleth&target=https://shibboleth-staging.vmock.com/vmock/shib/attributes.php

I get the following error message:
2024-11-14 17:01:43,011 -  - DEBUG [org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters:213] - Profile Action PopulateSignatureSigningParameters: Signing not enabled
2024-11-14 17:01:43,053 -  - DEBUG [org.opensaml.saml.common.profile.impl.VerifyChannelBindings:156] - Profile Action VerifyChannelBindings: No channel bindings found to verify, nothing to do
2024-11-14 17:01:43,064 -  - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:169] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.saml2.binding.impl.ExtractProxiedRequestersHandler' on INBOUND message context
2024-11-14 17:01:43,064 -  - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:190] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2024-11-14 17:01:43,190 -  - DEBUG [net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:213] - Profile Action PopulateAuthenticationContext: Installed 1 potential authentication flows into AuthenticationContext
2024-11-14 17:01:43,208 -  - DEBUG [net.shibboleth.idp.authn.impl.InitializeRequestedPrincipalContext:152] - Profile Action InitializeRequestedPrincipalContext: Profile configuration did not supply any default authentication methods
2024-11-14 17:01:43,209 -  - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:79] - Profile Action FilterFlowsByForcedAuthn: Removing flow authn/RemoteUser, it does not support forced authentication
2024-11-14 17:01:43,209 -  - INFO [net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:86] - Profile Action FilterFlowsByForcedAuthn: No potential authentication flows remain after filtering
2024-11-14 17:01:43,210 -  - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByNonBrowserSupport:57] - Profile Action FilterFlowsByNonBrowserSupport: Request does not have non-browser requirement, nothing to do
2024-11-14 17:01:43,214 -  - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:274] - Profile Action SelectAuthenticationFlow: No specific Principals requested
2024-11-14 17:01:43,214 -  - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:277] - Profile Action SelectAuthenticationFlow: Forced authentication requested, selecting an inactive flow
2024-11-14 17:01:43,215 -  - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:281] - Profile Action SelectAuthenticationFlow: No potential flows left to choose from, authentication failed
2024-11-14 17:01:43,227 -  - DEBUG [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:172] - Error event NoPotentialFlow will be handled with response
2024-11-14 17:01:43,241 -  - DEBUG [org.opensaml.saml.saml2.profile.impl.AbstractResponseShellAction:216] - Profile Action AddStatusResponseShell: Setting Issuer to https://sso.hbsstg.org/idp/shibboleth
2024-11-14 17:01:43,251 -  - DEBUG [org.opensaml.saml.common.profile.impl.AddInResponseToToResponse:107] - Profile Action AddInResponseToToResponse: Attempting to add InResponseTo to outgoing Response
2024-11-14 17:01:43,263 -  - DEBUG [org.opensaml.saml.saml2.profile.impl.AddStatusToResponse:191] - Profile Action AddStatusToResponse: Detailed errors are disabled

Here are the IdP configurations (SP metadata attached):
metadata.xml:
    <!-- ============ Vmock Setup ========== -->
    <MetadataProvider id="VmockMD"
                      xsi:type="FilesystemMetadataProvider"
                      metadataFile="%{idp.home}/metadata/vmock-metadata.xml"/>


relying-party.xml:
        <!-- VMock -->
        <bean parent="RelyingPartyByName" c:relyingPartyIds="https://shibboleth-staging.vmock.com/vmock/shibboleth-sp">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO">
                        <property name="encryptAssertions" value="false" />
                    </bean>
                </list>
            </property>
        </bean>

Instead of taking me to the login page, it redirects me back to the vendor with the following message:
Session Error
requestURL: https://shibboleth-staging.vmock.com/vmock/shib/Shibboleth.sso/SAML2/POST
errorType: opensaml::FatalProfileException
errorText: SAML response reported an IdP error.
entityID: https://sso.hbsstg.org/idp/shibboleth
statusCode: urn:oasis:names:tc:SAML:2.0:status:Requester
statusCode2: urn:oasis:names:tc:SAML:2.0:status:AuthnFailed
statusMessage: An error occurred.

Please let me know if you have any suggestions.


Regards,
Sunil

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241114/a4b09f5e/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: vmock-metadata.xml
Type: application/xml
Size: 7844 bytes
Desc: vmock-metadata.xml
URL: <http://shibboleth.net/pipermail/users/attachments/20241114/a4b09f5e/attachment.wsdl>