<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.pl-ent
{mso-style-name:pl-ent;}
span.pl-e
{mso-style-name:pl-e;}
span.pl-s
{mso-style-name:pl-s;}
span.pl-pds
{mso-style-name:pl-pds;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle25
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Thanks, I am not using MFA (only CAS). I should have mentioned that I am using Shibboleth docker image.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Sunil<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of Michael A Grady <mgrady@unicon.net><br>
<b>Reply-To: </b>Shib Users <users@shibboleth.net><br>
<b>Date: </b>Saturday, June 20, 2020 at 5:21 PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Subject: </b>Re: Shibboleth IdP v3.X plugin for authentication via an external CAS Server<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">I thought that someone had fixed the documentation to be clearer, but it doesn't appear that they have. You need to be be sure that in the IdPs' conf/authn/gneeral-authn.xml file that you add any and all needed principal names to the authn/External
bean. E.g. (if you wanted the usual Password class and also wanted it to handle REFEDS MFA. You might need to add other password-type principals depending on what any services you are integrated with might be sending as a requested authn context. You will
need whateve principals you had previously listed on the authn./Shibcas bean in that same file, if you were using an older version of this plugin.)<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<pre style="background:#F6F8FA;box-sizing: border-box;word-wrap: normal;border-top-left-radius: 3px;border-top-right-radius: 3px;border-bottom-right-radius: 3px;border-bottom-left-radius: 3px;caret-color: rgb(36, 41, 46);overflow:auto"><span style="font-family:Consolas;color:#24292E"><</span><span class="pl-ent"><span style="font-family:Consolas;color:#22863A">bean</span></span><span style="font-family:Consolas;color:#24292E"> </span><span class="pl-e"><span style="font-family:Consolas;color:#6F42C1">id</span></span><span style="font-family:Consolas;color:#24292E">=</span><span class="pl-pds"><span style="font-family:Consolas;color:#032F62">"</span></span><span class="pl-s"><span style="font-family:Consolas;color:#032F62">authn/External</span></span><span class="pl-pds"><span style="font-family:Consolas;color:#032F62">"</span></span><span style="font-family:Consolas;color:#24292E"> </span><span class="pl-e"><span style="font-family:Consolas;color:#6F42C1">parent</span></span><span style="font-family:Consolas;color:#24292E">=</span><span class="pl-pds"><span style="font-family:Consolas;color:#032F62">"</span></span><span class="pl-s"><span style="font-family:Consolas;color:#032F62">shibboleth.AuthenticationFlow</span></span><span class="pl-pds"><span style="font-family:Consolas;color:#032F62">"</span></span><span style="font-family:Consolas;color:#24292E"><o:p></o:p></span></pre>
<pre style="background:#F6F8FA"><span style="font-family:Consolas;color:#24292E"> </span><span class="pl-e"><span style="font-family:Consolas;color:#6F42C1">p:passiveAuthenticationSupported</span></span><span style="font-family:Consolas;color:#24292E">=</span><span class="pl-pds"><span style="font-family:Consolas;color:#032F62">"</span></span><span class="pl-s"><span style="font-family:Consolas;color:#032F62">true</span></span><span class="pl-pds"><span style="font-family:Consolas;color:#032F62">"</span></span><span style="font-family:Consolas;color:#24292E"><o:p></o:p></span></pre>
<pre style="background:#F6F8FA"><span style="font-family:Consolas;color:#24292E"> </span><span class="pl-e"><span style="font-family:Consolas;color:#6F42C1">p:forcedAuthenticationSupported</span></span><span style="font-family:Consolas;color:#24292E">=</span><span class="pl-pds"><span style="font-family:Consolas;color:#032F62">"</span></span><span class="pl-s"><span style="font-family:Consolas;color:#032F62">true</span></span><span class="pl-pds"><span style="font-family:Consolas;color:#032F62">"</span></span><span style="font-family:Consolas;color:#24292E"><o:p></o:p></span></pre>
<pre style="background:#F6F8FA"><span style="font-family:Consolas;color:#24292E"> </span><span class="pl-e"><span style="font-family:Consolas;color:#6F42C1">p:nonBrowserSupported</span></span><span style="font-family:Consolas;color:#24292E">=</span><span class="pl-pds"><span style="font-family:Consolas;color:#032F62">"</span></span><span class="pl-s"><span style="font-family:Consolas;color:#032F62">false</span></span><span class="pl-pds"><span style="font-family:Consolas;color:#032F62">"</span></span><span style="font-family:Consolas;color:#24292E">><o:p></o:p></span></pre>
<pre style="background:#F6F8FA"><span style="font-family:Consolas;color:#24292E"> <</span><span class="pl-ent"><span style="font-family:Consolas;color:#22863A">property</span></span><span style="font-family:Consolas;color:#24292E"> </span><span class="pl-e"><span style="font-family:Consolas;color:#6F42C1">name</span></span><span style="font-family:Consolas;color:#24292E">=</span><span class="pl-pds"><span style="font-family:Consolas;color:#032F62">"</span></span><span class="pl-s"><span style="font-family:Consolas;color:#032F62">supportedPrincipals</span></span><span class="pl-pds"><span style="font-family:Consolas;color:#032F62">"</span></span><span style="font-family:Consolas;color:#24292E">><o:p></o:p></span></pre>
<pre style="background:#F6F8FA"><span style="font-family:Consolas;color:#24292E"> <</span><span class="pl-ent"><span style="font-family:Consolas;color:#22863A">list</span></span><span style="font-family:Consolas;color:#24292E">><o:p></o:p></span></pre>
<pre style="background:#F6F8FA"><span style="font-family:Consolas;color:#24292E"> <</span><span class="pl-ent"><span style="font-family:Consolas;color:#22863A">bean</span></span><span style="font-family:Consolas;color:#24292E"> </span><span class="pl-e"><span style="font-family:Consolas;color:#6F42C1">parent</span></span><span style="font-family:Consolas;color:#24292E">=</span><span class="pl-pds"><span style="font-family:Consolas;color:#032F62">"</span></span><span class="pl-s"><span style="font-family:Consolas;color:#032F62">shibboleth.SAML2AuthnContextClassRef</span></span><span class="pl-pds"><span style="font-family:Consolas;color:#032F62">"</span></span><span style="font-family:Consolas;color:#24292E"><o:p></o:p></span></pre>
<pre style="background:#F6F8FA"><span style="font-family:Consolas;color:#24292E"> </span><span class="pl-e"><span style="font-family:Consolas;color:#6F42C1">c:classRef</span></span><span style="font-family:Consolas;color:#24292E">=</span><span class="pl-pds"><span style="font-family:Consolas;color:#032F62">"</span></span><span class="pl-s"><span style="font-family:Consolas;color:#032F62"><a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Frefeds.org%2Fprofile%2Fmfa&data=02%7C01%7Csmathew%40hbs.edu%7C4c905f56512b4487e02f08d8155fd70b%7C09fd564ebf4243218f2db8e482f8635c%7C0%7C0%7C637282848674309081&sdata=PKdK02s2KbGwGtPfwgW7uGX2HlxB4CEWkQMgR1kQS8o%3D&reserved=0">https://refeds.org/profile/mfa</a></span></span><span class="pl-pds"><span style="font-family:Consolas;color:#032F62">"</span></span><span style="font-family:Consolas;color:#24292E"> /><o:p></o:p></span></pre>
<pre style="background:#F6F8FA"><span style="font-family:Consolas;color:#24292E"> <</span><span class="pl-ent"><span style="font-family:Consolas;color:#22863A">bean</span></span><span style="font-family:Consolas;color:#24292E"> </span><span class="pl-e"><span style="font-family:Consolas;color:#6F42C1">parent</span></span><span style="font-family:Consolas;color:#24292E">=</span><span class="pl-pds"><span style="font-family:Consolas;color:#032F62">"</span></span><span class="pl-s"><span style="font-family:Consolas;color:#032F62">shibboleth.SAML2AuthnContextClassRef</span></span><span class="pl-pds"><span style="font-family:Consolas;color:#032F62">"</span></span><span style="font-family:Consolas;color:#24292E"><o:p></o:p></span></pre>
<pre style="background:#F6F8FA"><span style="font-family:Consolas;color:#24292E"> </span><span class="pl-e"><span style="font-family:Consolas;color:#6F42C1">c:classRef</span></span><span style="font-family:Consolas;color:#24292E">=</span><span class="pl-pds"><span style="font-family:Consolas;color:#032F62">"</span></span><span class="pl-s"><span style="font-family:Consolas;color:#032F62">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</span></span><span class="pl-pds"><span style="font-family:Consolas;color:#032F62">"</span></span><span style="font-family:Consolas;color:#24292E"> /><o:p></o:p></span></pre>
<pre style="background:#F6F8FA"><span style="font-family:Consolas;color:#24292E"> </</span><span class="pl-ent"><span style="font-family:Consolas;color:#22863A">list</span></span><span style="font-family:Consolas;color:#24292E">><o:p></o:p></span></pre>
<pre style="background:#F6F8FA"><span style="font-family:Consolas;color:#24292E"> </</span><span class="pl-ent"><span style="font-family:Consolas;color:#22863A">property</span></span><span style="font-family:Consolas;color:#24292E">><o:p></o:p></span></pre>
<pre style="background:#F6F8FA"><span style="font-family:Consolas;color:#24292E"></</span><span class="pl-ent"><span style="font-family:Consolas;color:#22863A">bean</span></span><span style="font-family:Consolas;color:#24292E">><o:p></o:p></span></pre>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Jun 20, 2020, at 5:55 AM, Mathew, Sunil <<a href="mailto:smathew@hbs.edu">smathew@hbs.edu</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Hi,<span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"> <span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal">We have CAS as the external server and Shibboleth (3.1.1) used to authenticate with Remote User. Instead I am trying to use CAS plugin for Shibboleth (3.4.6) authentication:<span class="apple-converted-space"> </span><a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FUnicon%2Fshib-cas-authn3&data=02%7C01%7Csmathew%40hbs.edu%7C4c905f56512b4487e02f08d8155fd70b%7C09fd564ebf4243218f2db8e482f8635c%7C0%7C0%7C637282848674309081&sdata=Op68KOaMndVTaq8ImW76nZU3Cvwsd50N1fCZYls3B2s%3D&reserved=0"><span style="color:#0563C1">https://github.com/Unicon/shib-cas-authn3</span></a><span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"> <span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal">But I am getting the following error:<span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica">2020-06-20T10:47:25.099968500Z shib-idp;idp-process.log;dev;nothing;2020-06-20 10:47:25,099 - 172.22.0.1 - WARN [net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:219] - Profile
Action PopulateAuthenticationContext: No authentication flows are active for this request<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica">2020-06-20T10:47:25.100032900Z shib-idp;idp-warn.log;dev;nothing;2020-06-20 10:47:25,099 - 172.22.0.1 - WARN [net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:219] - Profile
Action PopulateAuthenticationContext: No authentication flows are active for this request<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica">2020-06-20T10:47:25.199464800Z shib-idp;idp-process.log;dev;nothing;2020-06-20 10:47:25,197 - 172.22.0.1 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:313] - Profile Action
SelectAuthenticationFlow: No potential flows left to choose from, authentication failed<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"> <span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal">Has anyone been able to use the CAS plugin for Shibboleth authentication?<span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"> <span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"> <span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal">Regards,<br>
Sunil<span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"> <span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:Helvetica"> <o:p></o:p></span></p>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="0" width="100%" align="center">
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;caret-color: rgb(0, 0, 0);font-variant-caps: normal;text-align:start;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:13.5pt;font-family:Helvetica">This email has been scanned for spam and viruses by Proofpoint Essentials. Click<span class="apple-converted-space"> </span><a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fus2.proofpointessentials.com%2Findex01.php%3Fmod_id%3D11%26mod_option%3Dlogitem%26mail_id%3D1592650518-xrBgQv6nvMot%26r_address%3Dmgrady%2540unicon.net%26report%3D1&data=02%7C01%7Csmathew%40hbs.edu%7C4c905f56512b4487e02f08d8155fd70b%7C09fd564ebf4243218f2db8e482f8635c%7C0%7C0%7C637282848674319078&sdata=0MT%2FAcBImBY5%2BBkBrRghyS2eI6dfp6DwCJNHUDWJjXE%3D&reserved=0"><span style="color:#0563C1">here</span></a><span class="apple-converted-space"> </span>to
report this email as spam.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:Helvetica">--<span class="apple-converted-space"> </span><br>
For Consortium Member technical support, see<span class="apple-converted-space"> </span></span><a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7Csmathew%40hbs.edu%7C4c905f56512b4487e02f08d8155fd70b%7C09fd564ebf4243218f2db8e482f8635c%7C0%7C0%7C637282848674319078&sdata=wEJp9tNjQ4aso%2BaqRcv8fnZkdrgkkNkByndxzQaI5HQ%3D&reserved=0"><span style="font-size:13.5pt;font-family:Helvetica;color:#0563C1">https://wiki.shibboleth.net/confluence/x/coFAAg</span></a><span style="font-size:13.5pt;font-family:Helvetica"><br>
To unsubscribe from this list send an email to<span class="apple-converted-space"> </span></span><a href="mailto:users-unsubscribe@shibboleth.net"><span style="font-size:13.5pt;font-family:Helvetica;color:#0563C1">users-unsubscribe@shibboleth.net</span></a><o:p></o:p></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:Helvetica;color:black">--<br>
Michael A. Grady<br>
IAM Architect, Unicon, Inc.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:Helvetica;color:black"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>