<div dir="ltr">Here is a part of general-authn.xml:<br>authn/Password is not commented out. Others are.<br>-----------------------------<br><util:list id="shibboleth.AvailableAuthenticationFlows"><br><br><!-- <br> <bean id="authn/IPAddress" parent="shibboleth.AuthenticationFlow"<br> p:passiveAuthenticationSupported="true"<br> p:lifetime="PT60S" p:inactivityTimeout="PT60S"><br> <property name="supportedPrincipals"><br> <util:list><br> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol" /><br> </util:list><br> </property><br> </bean><br><br> <bean id="authn/External" parent="shibboleth.AuthenticationFlow"<br> p:nonBrowserSupported="false" /><br><br> <bean id="authn/RemoteUser" parent="shibboleth.AuthenticationFlow"<br> p:nonBrowserSupported="false" /><br><br> <bean id="authn/RemoteUserInternal" parent="shibboleth.AuthenticationFlow" /><br><br> <bean id="authn/X509" parent="shibboleth.AuthenticationFlow"<br> p:nonBrowserSupported="false"><br> <property name="supportedPrincipals"><br> <util:list><br> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:X509" /><br> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient" /><br> <bean parent="shibboleth.SAML1AuthenticationMethod"<br> c:method="urn:ietf:rfc:2246" /><br> </util:list><br> </property><br> </bean><br><br> <bean id="authn/X509Internal" parent="shibboleth.AuthenticationFlow"><br> <property name="supportedPrincipals"><br> <util:list><br> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:X509" /><br> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient" /><br> <bean parent="shibboleth.SAML1AuthenticationMethod"<br> c:method="urn:ietf:rfc:2246" /><br> </util:list><br> </property><br> </bean><br>--><br><br> <bean id="authn/Password" parent="shibboleth.AuthenticationFlow"<br> p:passiveAuthenticationSupported="true"<br> p:forcedAuthenticationSupported="true" /><br><br> </util:list><br>--------------------------<br><br><br><br>password-authn-config.xml:<br>jaas-authn-config is chosen<br>--------------------------<br><?xml version="1.0" encoding="UTF-8"?><br><beans xmlns="<a href="http://www.springframework.org/schema/beans">http://www.springframework.org/schema/beans</a>"<br> xmlns:context="<a href="http://www.springframework.org/schema/context">http://www.springframework.org/schema/context</a>"<br> xmlns:util="<a href="http://www.springframework.org/schema/util">http://www.springframework.org/schema/util</a>"<br> xmlns:p="<a href="http://www.springframework.org/schema/p">http://www.springframework.org/schema/p</a>"<br> xmlns:c="<a href="http://www.springframework.org/schema/c">http://www.springframework.org/schema/c</a>"<br> xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"<br> xsi:schemaLocation="<a href="http://www.springframework.org/schema/beans">http://www.springframework.org/schema/beans</a> <a href="http://www.springframework.org/schema/beans/spring-beans.xsd">http://www.springframework.org/schema/beans/spring-beans.xsd</a><br> <a href="http://www.springframework.org/schema/context">http://www.springframework.org/schema/context</a> <a href="http://www.springframework.org/schema/context/spring-context.xsd">http://www.springframework.org/schema/context/spring-context.xsd</a><br> <a href="http://www.springframework.org/schema/util">http://www.springframework.org/schema/util</a> <a href="http://www.springframework.org/schema/util/spring-util.xsd">http://www.springframework.org/schema/util/spring-util.xsd</a>"<br> <br> default-init-method="initialize"<br> default-destroy-method="destroy"><br> <br> <!-- Choose an import based on the back-end you want to use. --><br> <import resource="jaas-authn-config.xml" /><br> <!-- <import resource="krb5-authn-config.xml" /> --><br> <!-- <import resource="ldap-authn-config.xml" /> --><br> <br> <br> <!-- Names of form fields to pull username and password from. --><br> <bean id="shibboleth.authn.Password.UsernameFieldName" class="java.lang.String" c:_0="j_username" /><br> <bean id="shibboleth.authn.Password.PasswordFieldName" class="java.lang.String" c:_0="j_password" /><br> <bean id="shibboleth.authn.Password.SSOBypassFieldName" class="java.lang.String" c:_0="donotcache" /><br><br> <!-- Simple transforms to apply to username before validation. --><br> <util:constant id="shibboleth.authn.Password.Lowercase" static-field="java.lang.Boolean.FALSE"/><br> <util:constant id="shibboleth.authn.Password.Uppercase" static-field="java.lang.Boolean.FALSE"/><br> <util:constant id="shibboleth.authn.Password.Trim" static-field="java.lang.Boolean.TRUE"/><br><br> <!-- Apply any regular expression replacement pairs before validation. --><br> <util:list id="shibboleth.authn.Password.Transforms"><br> <!--<br> <bean parent="shibboleth.Pair" p:first="^(.+)@example\.edu$" p:second="$1" /><br> --><br> </util:list><br> <!--<br> Define entries here to map error messages detected by validation actions and classify them as particular<br> kinds of errors for use in your templates and as events in flows.<br> --><br><br> <util:map id="shibboleth.authn.Password.ClassifiedMessageMap"><br> <entry key="UnknownUsername"><br> <list><br> <value>NoCredentials</value><br> <value>CLIENT_NOT_FOUND</value><br> <value>DN_RESOLUTION_FAILURE</value><br> </list><br> </entry><br> <entry key="InvalidPassword"><br> <list><br> <value>InvalidCredentials</value><br> <value>PREAUTH_FAILED</value><br> <value>INVALID_CREDENTIALS</value><br> </list><br> </entry><br> <entry key="ExpiredPassword"><br> <list><br> <value>PASSWORD_EXPIRED</value><br> </list><br> </entry><br> <entry key="ExpiringPassword"><br> <list><br> <value>ACCOUNT_WARNING</value><br> </list><br> </entry><br> </util:map><br><br></beans><br>---------------------------------<br><br><br><br>jaas-authn-config.xml:<br>------------------------------<br><?xml version="1.0" encoding="UTF-8"?><br><beans xmlns="<a href="http://www.springframework.org/schema/beans">http://www.springframework.org/schema/beans</a>"<br> xmlns:context="<a href="http://www.springframework.org/schema/context">http://www.springframework.org/schema/context</a>"<br> xmlns:util="<a href="http://www.springframework.org/schema/util">http://www.springframework.org/schema/util</a>"<br> xmlns:p="<a href="http://www.springframework.org/schema/p">http://www.springframework.org/schema/p</a>"<br> xmlns:c="<a href="http://www.springframework.org/schema/c">http://www.springframework.org/schema/c</a>"<br> xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"<br> xsi:schemaLocation="<a href="http://www.springframework.org/schema/beans">http://www.springframework.org/schema/beans</a> <a href="http://www.springframework.org/schema/beans/spring-beans.xsd">http://www.springframework.org/schema/beans/spring-beans.xsd</a><br> <a href="http://www.springframework.org/schema/context">http://www.springframework.org/schema/context</a> <a href="http://www.springframework.org/schema/context/spring-context.xsd">http://www.springframework.org/schema/context/spring-context.xsd</a><br> <a href="http://www.springframework.org/schema/util">http://www.springframework.org/schema/util</a> <a href="http://www.springframework.org/schema/util/spring-util.xsd">http://www.springframework.org/schema/util/spring-util.xsd</a>"<br> <br> default-init-method="initialize"<br> default-destroy-method="destroy"><br> <br> <!-- Specify your JAAS config. --><br> <bean id="JAASConfig" class="org.springframework.core.io.FileSystemResource" c:path="%{idp.home}/conf/authn/jaas.config" /><br><br><br> <br> <util:property-path id="shibboleth.authn.JAAS.JAASConfigURI" path="JAASConfig.URI" /><br> <br> <!-- Specify the application name(s) in the JAAS config. --><br> <util:list id="shibboleth.authn.JAAS.LoginConfigNames"><br> <value>ShibUserPassAuth</value><br> </util:list><br><br> <alias name="ValidateUsernamePasswordAgainstJAAS" alias="ValidateUsernamePassword"/><br><br></beans><br>-----------------------------------------<br><br><br>jaas.config:<br>-------------------<br>ShibUserPassAuth<br>{<br> idp3login.idp3module required;<br>};<br>------------------------<br><br>idp3module is a java class and uses Radius authentication.<br><br>This configuration seems to work with idp 3.2.1<br><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, May 24, 2017 at 4:46 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 5/24/17, 3:34 AM, "users on behalf of Jukka Hakosalo" <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:jhakosal@gmail.com">jhakosal@gmail.com</a>> wrote:<br>
<br>
> There is something wrong with authentication flow.<br>
<br>
</span>What you posted isn't consistent with the error you got, so I don't know what to tell you. It suggests there are no flows configured and barring other warnings in the log I have no explanation for that, everything you posted couldn't really give that result.<br>
<br>
> general-authn.xml<br>
<br>
What you posted can't be the *whole* file, of course, that bean had better be inside the list it's normally declared inside.<br>
<span class=""><br>
> Could there be something with the session? We uncommented<br>
> idp.authn.flows.initial = Password<br>
<br>
</span>That's wrong to do.<br>
<span class=""><br>
> Idp asked and verified username and password. Then the same error appeared.<br>
<br>
</span>That would suggest perhaps that the SP was asking for some specific context class that the Password flow didn't support. I think you'd get slightly different logging and status codes from that, but that's all that comes to mind. Something must be filtering out Password from the set of options it can try, and it's left with nothing.<br>
<br>
Maybe you're not using the config you think you are.<br>
<span class=""><br>
> Should we try to install 3.3.1 from scratch?<br>
<br>
</span>No. Upgrades are safe and certainly don't break anything like this. Not unless you're using third party features that were implemented incorrectly to start with. A JAAS module wouldn't have any problem like that, it's the simplest case. Upgrading wouldn't touch any of the files involved here.<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
</font></span></blockquote></div><br></div>