<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 2/2/2024 10:59 AM, Cantor, Scott
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:7EE7D4C9-8B0C-4F05-865B-D3519E0514C9@osu.edu"><span
style="white-space: pre-wrap">
</span>
<pre class="moz-quote-pre" wrap="">Could be legacy issues if you haven't migrated to all of the new syntaxes, you can't combine approaches there. The flow descriptors from pre-4.1 days will totally supplant what the properties do (i.e. you'd have to remove them or use the XML syntax to add the supportedPrincipals setting).
The other common mistake is missing commas, it's really easy because of that multi-line mess to overlook them not being there. The syntax is bad, but it was about the only way to make it work without XML.
e.g. idp.authn.MFA.supportedPrincipals = \
saml2/something, \
saml1/something \
saml2/somethingelse
Looks fine but the last line won't be included correctly, the comma after the second one is missing.
</pre>
</blockquote>
<p>Turns out it was even simpler than that - I was missing the
protocol identifier (saml2/) in front of them. The IdP even
helpfully told me so in the logs if I had been looking closer:</p>
<p><font face="monospace">2024-02-02 12:04:08,489 - - ERROR
[net.shibboleth.idp.authn.principal.PrincipalServiceManager:125]
- No PrincipalService registered under ID 'https:'<br>
2024-02-02 12:04:08,490 - - ERROR
[net.shibboleth.idp.authn.principal.PrincipalServiceManager:128]
- Principal string was not in the expected format<br>
</font><br>
</p>
<p>So it's all working as expected now. Thanks for the pointers as
always!<br>
</p>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>