<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 2/3/2017 3:46 PM, Cantor, Scott wrote:<br>
<blockquote cite="mid:F42BF7FC-0F6F-4A52-A2D3-2F941C59FF72@osu.edu"
type="cite">
<pre wrap="">On 2/3/17, 4:35 PM, "users on behalf of Christopher Bongaarts" <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:users-bounces@shibboleth.netonbehalfofcab@umn.edu"><users-bounces@shibboleth.net on behalf of cab@umn.edu></a> wrote:
</pre>
<blockquote type="cite" style="color: #000066;">
<pre wrap=""> We had a similar error that we fixed by updating our customized web.xml file from 3.2.1 with the new version in 3.3.0
and reapplying our changes. We did <b class="moz-txt-star"><span class="moz-txt-tag">*</span>not<span class="moz-txt-tag">*</span></b> have to add the classpath settings that the Duo module doc installation
recommends; 3.3.0 already has those paths included.
</pre>
</blockquote>
<pre wrap="">I don't know why that would be exactly, but there were/are specific things the Unicon flow was doing that certainly might have stopped working, including the way it was trying to programmatically define the flow to the IdP, which isn't supported.
I'm not aware of any web.xml changes that should matter.
</pre>
</blockquote>
<br>
The two changes we made that we effectively reverted to the 3.3.0
delivered version were the contextConfigLocation values, which we
had modified as directed by the Duo module docs. The one at the
webapp level is different between (stock) 3.2.1 and (stock) 3.3.0:<br>
<br>
<tt><param-value>${idp.home}/system/conf/global-system.xml,classpath*:/META-INF/net.shibboleth.idp/config.xml</param-value></tt><tt><br>
</tt>becomes<br>
<tt><param-value>classpath*:/META-INF/net.shibboleth.idp/preconfig.xml,${idp.home}/system/conf/global-system.xml,classpath*:/META-INF/net.shibboleth.idp/config.xml,classpath*:/META-INF/net.shibboleth.idp/postconfig.xml</param-value></tt><tt><br>
</tt><br>
The one in the idp servlet definition is identical between the stock
versions:<br>
<br>
<tt><param-value>${idp.home}/system/conf/mvc-beans.xml,
${idp.home}/system/conf/webflow-config.xml</param-value></tt><tt><br>
</tt><br>
So our mucking with the values, and/or the (lack of) change to the
webapp-level parameter, apparently is enough to make the IdP unable
to find certain parent flows (Mark's couldn't find the c10n flow; in
our case it couldn't find the abstract authn flow).<br>
<br>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>