eduMFA with fudiscr error

Wed Mar 19 13:38:27 UTC 2025

I'm trying to configure fudiscr with edumfa but getting an error I
can't figure out how to solve. The configuration is as follows:

relying-party.xml
```
<bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
  <property name="profileConfigurations">
    <list>
      <bean parent="SAML2.SSO"
          p:postAuthenticationFlows="#{{'terms-of-use', 'attribute-release'}}"
          p:nameIDFormatPrecedence="#{{'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent','urn:oasis:names:tc:SAML:2.0:nameid-format:transient'}}"
          p:disallowedFeatures-ref="SAML2.SSO.FEATURE_AUTHNCONTEXT">
        <property name="defaultAuthenticationMethods">
          <list>
            <bean parent="shibboleth.SAML2AuthnContextClassRef"
              c:classRef="urn:de:zedat:fudis:SAML:2.0:ac:classes:CR" />
          </list>
        </property>
      </bean>
      <ref bean="SAML2.ECP" />
      <bean parent="SAML2.Logout"
        p:encryptNameIDs="false" />
      <ref bean="SAML2.AttributeQuery" />
      <ref bean="SAML2.ArtifactResolution" />
    </list>
  </property>
</bean>
```

authn.properties
```
idp.authn.flows = MFA

idp.authn.fudiscr.supportedPrincipals = \
   saml2/urn:de:zedat:fudis:SAML:2.0:ac:classes:CR

idp.authn.MFA.supportedPrincipals = \
  saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol, \
  saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport, \
  saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:Password, \
  saml1/urn:oasis:names:tc:SAML:1.0:am:password, \
  saml2/urn:de:zedat:fudis:SAML:2.0:ac:classes:CR
```

fudiscr.properties
```
fudiscr.edumfa.base_uri=<url_edumfa>
fudiscr.edumfa.authorization_token=<token>
```

mfa-authn-config.xml
```
<util:map id="shibboleth.authn.MFA.TransitionMap">
  <entry key="">
    <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/Password" />
  </entry>
  <entry key="authn/Password">
    <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/fudiscr" />
  </entry>
</util:map>
```

eduMFA ist installed and configured as in
https://doku.tid.dfn.de/de:shibidp:plugin-fudiscr and I can create
users and enroll tokens for them via ldap. eduMFA and the IdP are on
the same server, so I have no idea why I'm getting the Authorization
failure. The token is the one I've created and it is correct. The
idp-admin has the proper permissions for tokens.

The error I'm getting is:
```
====================request begin====================
URI         : https://<url_edumfa>/edumfa/token/?user=test_user&active=true
Method      : GET
Headers     : [Accept:"application/json, application/*+json", Authorization:"<MASKED>", Content-Length:"0"]
Request body:
====================request end======================
ERROR - MediaType/ContentType 'text/html;charset=iso-8859-1' is not accepted.
ERROR - MediaType/ContentType 'text/html;charset=iso-8859-1' is not accepted.
TRACE [de.zedat.fudis.rest.interceptors.HttpRequestResponseErrorJsonLoggingInterceptor:230] -
====================response begin===================
Status code  : 403 FORBIDDEN
Status text  : Forbidden
Headers      : [Connection:"Keep-Alive", Content-Length:"215", Content-Type:"text/html; charset=iso-8859-1", Date:"Wed, 19 Mar 2025 13:27:48 GMT", Keep-Alive:"timeout=5, max=100", Server:"Apache/2.4.6 (Red Hat Enterprise Linux)
Response body:
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access /edumfa/token/
on this server.</p>
</body></html>
====================response end=====================

DEBUG - Profile Action InitializeChallengeResponseContext: No UserAgentContext available within AuthenticationContext.
INFO  - Profile Action InitializeChallengeResponseContext: Create ChallengeResponseContext ChallengeResponseContext{user=User{username='test_user', realm='null'}, serviceInformation=ServiceInform
ERROR - MediaType/ContentType 'text/html;charset=iso-8859-1' is not accepted.
ERROR - Connection/Request failed, URI: 'https://<url_edumfa>/edumfa/token/?user=test_user&active=true'
org.springframework.web.client.ResourceAccessException: I/O error on GET request for "https://<url_edumfa>/edumfa/token/": MediaType/ContentType 'text/html;charset=iso-8859-1' is not accepted for this request.
       at org.springframework.web.client.RestTemplate.createResourceAccessException(RestTemplate.java:915)
Caused by: java.io.IOException: MediaType/ContentType 'text/html;charset=iso-8859-1' is not accepted for this request.
       at de.fu.dis.edumfa.client.handler.GeneralEduMfaResponseErrorHandler.handleError(GeneralEduMfaResponseErrorHandler.java:44)
ERROR - Profile Action GetTokens: Exception from backend for user test_user and relying party id https://<url_service>/shibboleth.
de.zedat.fudis.shibboleth.idp.plugin.authn.fudiscr.client.BackendException: Error in API request, see logfiles for details.
       at de.zedat.fudis.shibboleth.idp.plugin.authn.fudiscr.client.edumfa.impl.EduMfaChallengeResponseClient.handleEduMfaClientException(EduMfaChallengeResponseClient.java:591)
Caused by: de.fu.dis.edumfa.client.EduMfaClientException: Error in API request, see logfiles for details.
       at de.fu.dis.edumfa.client.AbstractEduMfaClient.exchange(AbstractEduMfaClient.java:267)
```
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5951 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20250319/6c408cd0/attachment.p7s>