<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">How this is configured, and what all is required, for a given version of shib-cas-authn3 and the Shib IdP has changed over time. Which is why -- but clearly not anywheres obvious enough -- the top-level Github page does say, in the Installation section:<div class=""><br class=""></div><div class=""> NOTE: You should ALWAYS refers to the README.md file that is packaged with the release for instructions.</div><div class=""><br class=""></div><div class="">and which links to this:</div><div class=""><br class=""></div><div class=""> <a href="https://github.com/Unicon/shib-cas-authn3/releases" class="">https://github.com/Unicon/shib-cas-authn3/releases</a></div><div class=""><br class=""></div><div class="">It is clear that top-level README page needs some modification, perhaps best to have very little and point of to the release documentation much more boldly. I'll ask th team to take a look at, and to double-check the shib-cas-authn3 release 3.3.0 specific instructions.<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Jan 28, 2020, at 6:56 PM, Terry Smith <<a href="mailto:t.smith@aaf.edu.au" class="">t.smith@aaf.edu.au</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">Hi Leonard,<div class=""><br class=""></div><div class="">I had the same issue when attempting to upgrade to the latest CAS plugin. I found that the additions to web.xml where not required. </div><div class=""><br class=""></div><div class="">I think the following line of code in the file main/java/net/unicon/idp/externalauth/ShibcasAuthServlet.java </div><div class=""><br class=""></div><div class=""><span class="gmail-pl-k" style="box-sizing: border-box; color: rgb(215, 58, 73); font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace; font-size: 12px; white-space: pre;">@WebServlet</span><span style="color: rgb(36, 41, 46); font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace; font-size: 12px; white-space: pre;" class="">(</span><span class="gmail-pl-c1" style="box-sizing: border-box; color: rgb(0, 92, 197); font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace; font-size: 12px; white-space: pre;">name</span><span style="color: rgb(36, 41, 46); font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace; font-size: 12px; white-space: pre;" class=""> </span><span class="gmail-pl-k" style="box-sizing: border-box; color: rgb(215, 58, 73); font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace; font-size: 12px; white-space: pre;">=</span><span style="color: rgb(36, 41, 46); font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace; font-size: 12px; white-space: pre;" class=""> </span><span class="gmail-pl-s" style="box-sizing: border-box; color: rgb(3, 47, 98); font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace; font-size: 12px; white-space: pre;"><span class="gmail-pl-pds" style="box-sizing: border-box;">"</span>ShibcasAuthServlet<span class="gmail-pl-pds" style="box-sizing: border-box;">"</span></span><span style="color: rgb(36, 41, 46); font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace; font-size: 12px; white-space: pre;" class="">, </span><span class="gmail-pl-c1" style="box-sizing: border-box; color: rgb(0, 92, 197); font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace; font-size: 12px; white-space: pre;">urlPatterns</span><span style="color: rgb(36, 41, 46); font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace; font-size: 12px; white-space: pre;" class=""> </span><span class="gmail-pl-k" style="box-sizing: border-box; color: rgb(215, 58, 73); font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace; font-size: 12px; white-space: pre;">=</span><span style="color: rgb(36, 41, 46); font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace; font-size: 12px; white-space: pre;" class=""> {</span><span class="gmail-pl-s" style="box-sizing: border-box; color: rgb(3, 47, 98); font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace; font-size: 12px; white-space: pre;"><span class="gmail-pl-pds" style="box-sizing: border-box;">"</span>/Authn/External/*<span class="gmail-pl-pds" style="box-sizing: border-box;">"</span></span><span style="color: rgb(36, 41, 46); font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace; font-size: 12px; white-space: pre;" class="">})</span> </div><div class=""><br class=""></div><div class="">is clashing with recommended changes to web.xml. The IdPs I have tested the new CAS extensions on seem to work just fine without changes to web.xml.</div><div class=""><br class=""></div><div class="">Thanks,</div><div class="">Terry.</div><div class=""><br class=""></div></div><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><div class="gmail_quote" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div dir="ltr" class="gmail_attr">On Wed, Jan 29, 2020 at 6:59 AM Leonard J Peirce <<a href="mailto:leonard.peirce@wmich.edu" class="">leonard.peirce@wmich.edu</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); padding-left: 1ex;">On 2020-01-28 3:25 p.m., Jones, Brian wrote:<br class="">> Hi Leonard,<br class="">><span class="Apple-converted-space"> </span><br class="">> There is a little more detail in the release notes for shib-cas-authn3 v3.3.0:<br class="">><span class="Apple-converted-space"> </span><br class="">><span class="Apple-converted-space"> </span><a href="https://github.com/Unicon/shib-cas-authn3/releases/tag/3.3.0" rel="noreferrer" target="_blank" class="">https://github.com/Unicon/shib-cas-authn3/releases/tag/3.3.0</a><br class="">><span class="Apple-converted-space"> </span><br class="">> I don't know for sure but maybe the error is related to the 3rd bulletpoint on that page (pasted below):<br class="">><span class="Apple-converted-space"> </span><br class="">> ## begin paste ##<br class="">><span class="Apple-converted-space"> </span><br class="">> Remove the authn/Shibcas bean in IDP_HOME/conf/authn/general-authn.xml:<br class="">><span class="Apple-converted-space"> </span><br class="">> ...<br class="">> <util:list id="shibboleth.AvailableAuthenticationFlows"><br class="">><span class="Apple-converted-space"> </span><br class="">> <bean id="authn/Shibcas" parent="shibboleth.AuthenticationFlow"<br class="">> p:passiveAuthenticationSupported="true"<br class="">> p:forcedAuthenticationSupported="true"<br class="">> p:nonBrowserSupported="false" /><br class="">> ...<br class="">><span class="Apple-converted-space"> </span><br class="">> Note that if you an additional settings for this bean defined, such as one for supportedPrincipals, they need to be moved and applied to the authn/External bean instead in the same file, such that:<br class="">><span class="Apple-converted-space"> </span><br class="">> <bean id="authn/External" parent="shibboleth.AuthenticationFlow"<br class="">> p:passiveAuthenticationSupported="true"<br class="">> p:forcedAuthenticationSupported="true"<br class="">> p:nonBrowserSupported="false"><br class="">> <property name="supportedPrincipals"><br class="">> <list><br class="">> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br class="">> c:classRef="<a href="https://refeds.org/profile/mfa" rel="noreferrer" target="_blank" class="">https://refeds.org/profile/mfa</a>" /><br class="">> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br class="">> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" /><br class="">> </list><br class="">> </property><br class="">> </bean><br class="">><span class="Apple-converted-space"> </span><br class="">> ## end paste ##<br class=""><br class="">I saw that but at least in the README it appears to be related<br class="">to 2FA which we aren't running. At any rate I'm running the<br class="">general-authn.xml unmodified.<br class=""><br class="">The online README also mentions removing IDP_HOME/flows/authn/Shibcas<br class="">which I don't have. Same result.<br class=""><br class="">Does anyone from Unicon have an idea?<br class=""><br class="">- Leonard<br class="">--<span class="Apple-converted-space"> </span><br class="">For Consortium Member technical support, see<span class="Apple-converted-space"> </span><a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank" class="">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br class="">To unsubscribe from this list send an email to<span class="Apple-converted-space"> </span><a href="mailto:users-unsubscribe@shibboleth.net" target="_blank" class="">users-unsubscribe@shibboleth.net</a><br class=""></blockquote></div><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""> <br class="webkit-block-placeholder"></div><hr style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><p style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">This email has been scanned for spam and viruses by Proofpoint Essentials. Click<span class="Apple-converted-space"> </span><a href="https://us2.proofpointessentials.com/index01.php?mod_id=11&mod_option=logitem&mail_id=1580259444-K-xBWzkfg8IH&r_address=mgrady%40unicon.net&report=1" class="">here</a><span class="Apple-converted-space"> </span>to report this email as spam.</p><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">--<span class="Apple-converted-space"> </span></span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">For Consortium Member technical support, see<span class="Apple-converted-space"> </span></span><a href="https://wiki.shibboleth.net/confluence/x/coFAAg" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">To unsubscribe from this list send an email to<span class="Apple-converted-space"> </span></span><a href="mailto:users-unsubscribe@shibboleth.net" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">users-unsubscribe@shibboleth.net</a></div></blockquote></div><br class=""><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">--<br class="">Michael A. Grady<br class="">IAM Architect, Unicon, Inc.</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><br class="Apple-interchange-newline">
</div>
<br class=""></div></body></html>