<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div>Greetings,</div><div><br></div><div>We're running Shib IdP v4.1.0 and we're trying to setup MFA to obtain the Users IP. However, we are getting the following error:</div><div><br></div><div style="margin-left: 3ch;">2021-05-13 16:21:22,719 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:214] - Profile Action TransitionMultiFactorAuthentication: Applying MFA transition rule to exit state 'authn/Password'</div><div style="margin-left: 3ch;">021-05-13 16:21:22,933 - INFO [net.shibboleth.idp.attribute:8] - user IP: xxx.xxx.xxx.xxx</div><div style="margin-left: 3ch;"><font color="#800000"><b>2021-05-13 16:21:23,072 - INFO [net.shibboleth.idp.attribute:30] - DEBUG: before error</b></font></div><div style="margin-left: 3ch;"><font color="#800000"><b>2021-05-13 16:21:23,089 - ERROR [net.shibboleth.idp.authn:-2] - Uncaught runtime exception</b></font></div><div style="margin-left: 3ch;"><font color="#800000"><b>java.lang.ClassCastException: Cannot cast java.util.LinkedHashMap to net.shibboleth.utilities.java.support.service.ReloadableService</b></font></div><div style="margin-left: 3ch;"><font color="#800000"><b> at java.base/java.lang.Class.cast(Class.java:3605)</b></font></div><div style="margin-left: 3ch;">2021-05-13 16:21:23,097 - 142.55.118.43 - WARN [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event occurred while processing the request: RuntimeException</div><div style="margin-left: 3ch;"><br></div><div>I've isolated the error to this line in mfa-authn-config.xml:</div><div><br></div><div style="margin-left: 3ch;">logger.info("DEBUG: before error");</div><div style="margin-left: 3ch;"> resCtx.resolveAttributes(custom);</div><div style="margin-left: 3ch;"><div>logger.info("DEBUG: after error");</div></div><div><br></div><div>The error dissappears if I change <b>p:customObject-ref="secondFactorHelpersMap" </b>back to <b>p:customObject-ref="shibboleth.AttributeResolverService", </b>and comment out the IP retrieval bits. Below is relevant mfa-authn-config.xml lines. How do I fix this? </div><div><br></div><div style="margin-left: 3ch;"> <bean id="checkDepartment" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript" <b>p:customObject-ref="secondFactorHelpersMap"</b>></div><div style="margin-left: 3ch;"> <constructor-arg></div><div style="margin-left: 3ch;"> <value></div><div style="margin-left: 3ch;"> <![CDATA[</div><div style="margin-left: 3ch;"> nextFlow = null;</div><div style="margin-left: 3ch;"> logger = Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.attribute");</div><div style="margin-left: 3ch;"><br></div><div style="margin-left: 3ch;"> // Determine the user IP address</div><div style="margin-left: 3ch;"> httpRequestServletContext = custom.get("httpServletRequestContext");</div><div style="margin-left: 3ch;"> logger.info(" user IP: " + httpRequestServletContext.remoteAddr);</div><div style="margin-left: 3ch;"><br></div><div style="margin-left: 3ch;"> // Go straight to second factor if we have to, or set up for an attribute lookup first.</div><div style="margin-left: 3ch;"> authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");</div><div style="margin-left: 3ch;"> mfaCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");</div><div style="margin-left: 3ch;"><br></div><div style="margin-left: 3ch;"> if (mfaCtx.isAcceptable()) {</div><div style="margin-left: 3ch;"><br></div><div style="margin-left: 3ch;"> // Attribute check is required to decide if first factor alone is enough.</div><div style="margin-left: 3ch;"> resCtx = input.getSubcontext("net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext", true);</div><div style="margin-left: 3ch;"><br></div><div style="margin-left: 3ch;"> // Look up the username</div><div style="margin-left: 3ch;"> usernameLookupStrategyClass = Java.type("net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy");</div><div style="margin-left: 3ch;"> usernameLookupStrategy = new usernameLookupStrategyClass();</div><div style="margin-left: 3ch;"> username = usernameLookupStrategy.apply(input).toLowerCase();</div><div style="margin-left: 3ch;"> resCtx.setPrincipal(username);</div><div style="margin-left: 3ch;"><br></div><div style="margin-left: 3ch;"> resCtx.getRequestedIdPAttributeNames().add("someAttribute");</div><div style="margin-left: 3ch;"> <b><font color="#800000">logger.info("DEBUG: before error");</font></b></div><div style="margin-left: 3ch;"><b><font color="#800000"> resCtx.resolveAttributes(custom);</font></b></div><div style="margin-left: 3ch;"><b><font color="#800000"> logger.info("DEBUG: after error");</font></b></div><div style="margin-left: 3ch;"><br></div><div style="margin-left: 3ch;"> ... snip ...</div><div style="margin-left: 3ch;"> input.removeSubcontext(resCtx); // cleanup</div><div style="margin-left: 3ch;"> }</div><div style="margin-left: 3ch;"> nextFlow; // pass control to second factor or end with the first</div><div style="margin-left: 3ch;"> ]]></div><div style="margin-left: 3ch;"> </value ></div><div style="margin-left: 3ch;"> </constructor-arg></div><div style="margin-left: 3ch;"> </bean></div><div style="margin-left: 3ch;"><br></div><div style="margin-left: 3ch;"> <util:map id="secondFactorHelpersMap"></div><div style="margin-left: 3ch;"> <entry key="attributeResolver" value-ref="shibboleth.AttributeResolverService" /></div><div style="margin-left: 3ch;"> <entry key="httpServletRequestContext" value-ref="shibboleth.HttpServletRequest" /></div><div style="margin-left: 3ch;"> </util:map></div><div><br></div><div>regards,</div><div>Ryan</div><div class="-x-evo-signature-wrapper"><span class="-x-evo-signature" id="none"></span></div></body></html>