<div dir="ltr">Hi Leonard,<div><br></div><div>I had the same issue when attempting to upgrade to the latest CAS plugin. I found that the additions to web.xml where not required. </div><div><br></div><div>I think the following line of code in the file main/java/net/unicon/idp/externalauth/ShibcasAuthServlet.java </div><div><br></div><div><span class="gmail-pl-k" style="box-sizing:border-box;color:rgb(215,58,73);font-family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;font-size:12px;white-space:pre">@WebServlet</span><span style="color:rgb(36,41,46);font-family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;font-size:12px;white-space:pre">(</span><span class="gmail-pl-c1" style="box-sizing:border-box;color:rgb(0,92,197);font-family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;font-size:12px;white-space:pre">name</span><span style="color:rgb(36,41,46);font-family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;font-size:12px;white-space:pre"> </span><span class="gmail-pl-k" style="box-sizing:border-box;color:rgb(215,58,73);font-family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;font-size:12px;white-space:pre">=</span><span style="color:rgb(36,41,46);font-family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;font-size:12px;white-space:pre"> </span><span class="gmail-pl-s" style="box-sizing:border-box;color:rgb(3,47,98);font-family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;font-size:12px;white-space:pre"><span class="gmail-pl-pds" style="box-sizing:border-box">"</span>ShibcasAuthServlet<span class="gmail-pl-pds" style="box-sizing:border-box">"</span></span><span style="color:rgb(36,41,46);font-family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;font-size:12px;white-space:pre">, </span><span class="gmail-pl-c1" style="box-sizing:border-box;color:rgb(0,92,197);font-family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;font-size:12px;white-space:pre">urlPatterns</span><span style="color:rgb(36,41,46);font-family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;font-size:12px;white-space:pre"> </span><span class="gmail-pl-k" style="box-sizing:border-box;color:rgb(215,58,73);font-family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;font-size:12px;white-space:pre">=</span><span style="color:rgb(36,41,46);font-family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;font-size:12px;white-space:pre"> {</span><span class="gmail-pl-s" style="box-sizing:border-box;color:rgb(3,47,98);font-family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;font-size:12px;white-space:pre"><span class="gmail-pl-pds" style="box-sizing:border-box">"</span>/Authn/External/*<span class="gmail-pl-pds" style="box-sizing:border-box">"</span></span><span style="color:rgb(36,41,46);font-family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;font-size:12px;white-space:pre">})</span> </div><div><br></div><div>is clashing with recommended changes to web.xml. The IdPs I have tested the new CAS extensions on seem to work just fine without changes to web.xml.</div><div><br></div><div>Thanks,</div><div>Terry.</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jan 29, 2020 at 6:59 AM Leonard J Peirce <<a href="mailto:leonard.peirce@wmich.edu">leonard.peirce@wmich.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 2020-01-28 3:25 p.m., Jones, Brian wrote:<br>
> Hi Leonard,<br>
> <br>
> There is a little more detail in the release notes for shib-cas-authn3 v3.3.0:<br>
> <br>
> <a href="https://github.com/Unicon/shib-cas-authn3/releases/tag/3.3.0" rel="noreferrer" target="_blank">https://github.com/Unicon/shib-cas-authn3/releases/tag/3.3.0</a><br>
> <br>
> I don't know for sure but maybe the error is related to the 3rd bulletpoint on that page (pasted below):<br>
> <br>
> ## begin paste ##<br>
> <br>
> Remove the authn/Shibcas bean in IDP_HOME/conf/authn/general-authn.xml:<br>
> <br>
> ...<br>
> <util:list id="shibboleth.AvailableAuthenticationFlows"><br>
> <br>
> <bean id="authn/Shibcas" parent="shibboleth.AuthenticationFlow"<br>
> p:passiveAuthenticationSupported="true"<br>
> p:forcedAuthenticationSupported="true"<br>
> p:nonBrowserSupported="false" /><br>
> ...<br>
> <br>
> Note that if you an additional settings for this bean defined, such as one for supportedPrincipals, they need to be moved and applied to the authn/External bean instead in the same file, such that:<br>
> <br>
> <bean id="authn/External" parent="shibboleth.AuthenticationFlow"<br>
> p:passiveAuthenticationSupported="true"<br>
> p:forcedAuthenticationSupported="true"<br>
> p:nonBrowserSupported="false"><br>
> <property name="supportedPrincipals"><br>
> <list><br>
> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br>
> c:classRef="<a href="https://refeds.org/profile/mfa" rel="noreferrer" target="_blank">https://refeds.org/profile/mfa</a>" /><br>
> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br>
> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" /><br>
> </list><br>
> </property><br>
> </bean><br>
> <br>
> ## end paste ##<br>
<br>
I saw that but at least in the README it appears to be related<br>
to 2FA which we aren't running. At any rate I'm running the<br>
general-authn.xml unmodified.<br>
<br>
The online README also mentions removing IDP_HOME/flows/authn/Shibcas<br>
which I don't have. Same result.<br>
<br>
Does anyone from Unicon have an idea?<br>
<br>
- Leonard<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>