<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hello,<div class=""><br class=""></div><div class="">Reaching out for help.</div><div class=""><br class=""></div><div class="">As a fix for the ‘Spring4Shell’ vulnerability, I am working on an emergency upgrade of our Shibboleth IDP v4.0.1 to v4.1.6. I am doing a quick POC of the upgrade to document the steps. In my POC, I noticed that a custom authentication definition/flow that we were using before the upgrade is broken post upgrade and it no longer works. I get an error message in the “idp-process.log” as below</div><div class=""><br class=""></div><div class=""><div class=""><font face="Courier New" class="">2022-04-06 17:57:24,989 - 172.19.38.154 - ERROR [net.shibboleth.idp.authn:-2] - Uncaught runtime exception</font></div><div class=""><font face="Courier New" class="">org.springframework.webflow.definition.registry.NoSuchFlowDefinitionException: No flow definition 'authn/CustomMfa' found</font></div><div class=""><font face="Courier New" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>at org.springframework.webflow.definition.registry.FlowDefinitionRegistryImpl.getFlowDefinitionHolder(FlowDefinitionRegistryImpl.java:123)</font></div><div class=""><font face="Courier New" class="">2022-04-06 17:57:25,003 - 172.19.38.154 - WARN [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event occurred while processing the request: RuntimeException</font></div></div><div class=""><font face="Courier New" class=""><br class=""></font></div><div class="">Upon checking the “modules” enabled, I noticed that my custom module was not enabled. Trying to enable it also returns the below error</div><div class=""><br class=""></div><div class=""><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; color: rgb(0, 0, 0);" class=""><span style="font-variant-ligatures: no-common-ligatures;" class=""><font face="Courier New" class=""># ./module.sh -e idp.authn.CustomMfa</font></span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; color: rgb(0, 0, 0);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><font face="Courier New" class="">WARN - Unable to find property resource 'class path resource [../conf/authn/duo.properties]' (check idp.additionalProperties?)</font></span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; color: rgb(0, 0, 0);" class=""><span style="font-variant-ligatures: no-common-ligatures;" class=""><font face="Courier New" class="">Unknown modules: [idp.authn.CustomMfa]</font></span></div></div><div class=""><br class=""></div><div class="">My CustomMFA definition gets invoked from the MFA Authentication definition with - “<span style="color: rgb(0, 0, 0); font-family: Menlo; font-size: 11px;" class="">mfa-authn-config.xml</span>” having a Java script for conditional invocation based on a user’s AD attribute. </div><div class=""><br class=""></div><div class="">Post upgrade, I see the custom authentication definition continues to have the bean definition entry in - “<span style="color: rgb(255, 19, 255); font-family: Menlo; font-size: 11px;" class="">authn/general-authn.xml</span>”. But I dont see any entry added for it in “<span style="color: rgb(255, 19, 255); font-family: Menlo; font-size: 11px;" class="">authn/authn.properties</span>” for it. </div><div class=""><br class=""></div><div class="">Can someone provide pointers on what I am missing as part of the upgrade and what is required to have my authentication flow restored with 4.1.6 ?</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Thanks,</div><div class="">Prasanna</div></body></html>