<html><body>Thanks for your suggestion, Scott. I've plumbed it into my password-authn-config.xml file, but still can't seem to define the bean correctly. Is it just a case of decorating your <util:list> with the id="shibboleth.authn.JAAS.LoginConfigurations" attribute? When I do this, I end up with the exception...<BR>
<BR>
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.authn.Password.Validators': Cannot resolve reference to bean 'shibboleth.JAASValidator' while setting bean property 'sourceList' with key [0]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'ValidateUsernamePasswordAgainstJAAS' defined in class path resource [net/shibboleth/idp/flows/authn/password-authn-beans.xml]: Error setting property values; nested exception is org.springframework.beans.PropertyBatchUpdateException; nested PropertyAccessExceptions (1) are: PropertyAccessException 1: org.springframework.beans.TypeMismatchException: Failed to convert property value of type 'java.util.ArrayList' to required type 'java.util.Collection' for property 'loginConfigurations'; nested exception is java.lang.ClassCastException: class javax.security.auth.Subject cannot be cast to class java.util.Collection (javax.security.auth.Subject and java.util.Collection are in module java.base of loader 'bootstrap')<BR>
<BR>
...so I guess I need to specify the bean type explicitly somewhere, but can't find an example of how.<BR>
<BR>
After spending the day trying to crack this problem, my additions to password-authn-config.xml currently look like this:<BR>
<BR>
<bean id="Subject1" class="javax.security.auth.Subject"><BR>
<constructor-arg><value>false</value></constructor-arg><BR>
<constructor-arg><BR>
<util:set value-type="java.security.Principal"><BR>
<bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" /><BR>
<bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" /><BR>
</util:set><BR>
</constructor-arg><BR>
<constructor-arg><util:set value-type="java.security.Principal" /></constructor-arg><BR>
<constructor-arg><util:set value-type="java.security.Principal" /></constructor-arg><BR>
</bean><BR>
<BR>
<bean id="Subject2" class="javax.security.auth.Subject"><BR>
<constructor-arg><value>false</value></constructor-arg><BR>
<constructor-arg><BR>
<util:set value-type="java.security.Principal"><BR>
<bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="MySpecialClassRef" /><BR>
</util:set><BR>
</constructor-arg><BR>
<constructor-arg><util:set value-type="java.security.Principal" /></constructor-arg><BR>
<constructor-arg><util:set value-type="java.security.Principal" /></constructor-arg><BR>
</bean><BR>
<BR>
<util:list id="shibboleth.authn.JAAS.LoginConfigurations"><BR>
<bean id="Login1" parent="shibboleth.Pair"><BR>
<property name="first"><value>ShibUserPassAuth1</value></property><BR>
<property name="second" ref="Subject1" /><BR>
</bean><BR>
<bean id="Login2" parent="shibboleth.Pair"><BR>
<property name="first"><value>ShibUserPassAuth2</value></property><BR>
<property name="second" ref="Subject2" /><BR>
</bean><BR>
</util:list><BR>
<BR>
Another pointer would be much appreciated!<BR>
<BR>
BTW, the reason I'm still using JAAS is that I'm authenticating against a SQL database via JDBC; I'm not using LDAP at all.<BR>
<BR>
Thanks,<BR>
Phil.<BR>
<BR>
-----Original Message-----<BR>
From: users <users-bounces@shibboleth.net> On Behalf Of Cantor, Scott<BR>
Sent: 19 May 2021 16:56<BR>
To: Shib Users <users@shibboleth.net><BR>
Subject: Re: LoginConfigStrategy example?<BR>
<BR>
On 5/19/21, 10:12 AM, "users on behalf of Phil Chapman" <users-bounces@shibboleth.net on behalf of phil.chapman@adept.co.uk> wrote:<BR>
<BR>
> I believe this should be possible by writing a shibboleth.authn.JAAS.LoginConfigStrategy Function bean, but<BR>
> can't get the syntax right and can't find any appropriate examples online. Does anyone have a sample that they<BR>
> can share which would meet my needs?<BR>
<BR>
Doesn't require a function, though I probably would argue it's easier syntax.<BR>
<BR>
"If the information the function would return is static, a bean named shibboleth.authn.JAAS.LoginConfigurations can be defined."<BR>
<BR>
This is static (you're just associating each JAAS config with one or more principals).<BR>
<BR>
Bean type is Collection<Pair<String,Subject>><BR>
<BR>
<util:list><BR>
<!-- one config --><BR>
<bean parent="shibboleth.Pair"><BR>
<constructor-arg>config1</constructor-arg><BR>
<constructor-arg><BR>
<bean class="javax.security.auth.Subject"><BR>
<constructor-arg>false</ constructor-arg><BR>
<constructor-arg><BR>
<util:set><BR>
<bean parent="shibboleth.SAML2AuthnContextClassRef"<BR>
c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" /> </util:set><BR>
</constructor-arg><BR>
<constructor-arg><null/></constructor-arg><BR>
<constructor-arg><null/></constructor-arg><BR>
</bean><BR>
</constructor-arg><BR>
</bean><BR>
<!-- etc. --><BR>
</util:list><BR>
<BR>
It's something like that, but I doubt it's exact.<BR>
<BR>
FWIW, the historical advice to use JAAS is also largely out of date, that was needed when it was impractical to chain LDAPs or LDAP with other options. The IdP does this natively now and JAAS is slower comparatively speaking.<BR>
<BR>
-- Scott<BR>
<BR>
<BR>
-- <BR>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><BR>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><BR>
</body></html>