Hello, I've rolled back to simple LDAP Authentication + Yubikey, my service definition (generated via cas-management webapp) is :
{
@class: org.apereo.cas.services.RegexRegisteredService
serviceId: https?://myserver.example.com/testcas/cas5v3.php
name: test mfa
id: 3139139547012322
description: Test MFA Yubikey
evaluationOrder: 1
logoutType: NONE
attributeReleasePolicy:
{
@class: org.apereo.cas.services.ReturnAllAttributeReleasePolicy
principalAttributesRepository:
{
@class:
org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository
expiration: 2
timeUnit: HOURS
}
authorizedToReleaseCredentialPassword: false
authorizedToReleaseProxyGrantingTicket: false
}
multifactorPolicy:
{
@class:
org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy
multifactorAuthenticationProviders:
[
java.util.HashSet
[
mfa-yubikey
]
]
failureMode: CLOSED
}
accessStrategy:
{
@class: org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy
enabled: true
ssoEnabled: true
requireAllAttributes: true
caseInsensitive: false
}
}
Yubikey web-flow seems to be registered :
2016-09-20 09:20:09,895 DEBUG
[org.springframework.webflow.definition.registry.FlowDefinitionRegistryImpl]
- <Registering flow definition 'URL
[jar:file:/var/tomcat/inst2/webapps/cas/WEB-INF/lib/cas-server-support-yubikey-5.0.0.RC1.jar!/webflow/mfa-yubikey/mfa-yubikey-webflow.xml]'
under id 'mfa-yubikey'>
...
2016-09-20 09:20:36,003 WARN
[org.apereo.cas.web.flow.resolver.impl.RegisteredServiceAuthenticationPolicyWebflowEventResolver]
- <Transition definition cannot be found for event [mfa-yubikey]>
In MFA wiki page (
https://apereo.github.io/cas/development/installation/Configuring-Multifactor-Authentication.html#yubikey
), there's a mention of "id" field, but I didn't find any reference in
my configuration files.
Regards.
Le 16/09/2016 à 16:57, Philippe MARASSE a écrit :
> Hello,
>
> I'm trying to trigger MFA (with yubikey), on a service access.
> Triggering seems to work but mfa-yubikey webflow is not found ??
>
> Extract from logs :
> 2016-09-16 16:28:03,438 DEBUG
> [org.springframework.webflow.engine.builder.DefaultFlowHolder] -
> <Assembling the flow for the first time>
> 2016-09-16 16:28:04,503 DEBUG
> [org.springframework.webflow.definition.registry.FlowDefinitionRegistryImpl]
> - <*Registering flow definition* 'URL
> [jar:file:/var/tomcat/inst2/webapps/cas/WEB-INF/lib/cas-server-support-yubikey-5.0.0.RC1.jar!/webflow/mfa-yubikey/mfa-yubikey-webflow.xml]'
> under id '*mfa-yubikey*'>
> 2016-09-16 16:28:08,806 INFO
> [org.apereo.cas.configuration.CasConfigurationRebinder] - <Reloaded
> CAS configuration
> cas-org.apereo.cas.configuration.CasConfigurationProperties>
> ...
> 2016-09-16 16:28:41,259 INFO [org.ldaptive.auth.Authenticator] -
> <Authentication succeeded for dn: uid=myuser,ou=users,dc=example,dc=com>
> 2016-09-16 16:28:41,267 INFO
> [org.apereo.cas.authentication.PolicyBasedAuthenticationManager] -
> <LdapAuthenticationHandler successfully authenticated myuser>
> 2016-09-16 16:28:41,299 INFO
> [org.apereo.cas.authentication.PolicyBasedAuthenticationManager] -
> <Authenticated myuser with credentials [myuser].>
> 2016-09-16 16:28:41,533 WARN
> [org.apereo.cas.web.flow.resolver.impl.RegisteredServiceAuthenticationPolicyWebflowEventResolver]
> - <*Transition definition cannot be found for event [mfa-yubikey]*>
> 2016-09-16 16:28:41,538 DEBUG
> [org.springframework.webflow.execution.ActionExecutor] - <Finished
> executing org.apereo.cas.web.flow.AuthenticationViaFormAction@b553;
> result = authenticationFailure>
>
> Is login-webflow.xml needing modifications (documentation does not
> mention this) ?
>
> Regards.
> --
> Philippe MARASSE
>
> Responsable pôle Infrastructures - DSIO
> Centre Hospitalier Henri Laborit
> CS 10587 - 370 avenue Jacques Cœur
> 86021 Poitiers Cedex
> Tel : 05.49.44.57.19
> --
> You received this message because you are subscribed to the Google
> Groups "CAS Community" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to [email protected]
> <mailto:[email protected]>.
> To post to this group, send email to [email protected]
> <mailto:[email protected]>.
> Visit this group at
> https://groups.google.com/a/apereo.org/group/cas-user/.
> To view this discussion on the web visit
> https://groups.google.com/a/apereo.org/d/msgid/cas-user/dd99844e-7ea7-12e4-9872-323d46c2f8a9%40ch-poitiers.fr
> <https://groups.google.com/a/apereo.org/d/msgid/cas-user/dd99844e-7ea7-12e4-9872-323d46c2f8a9%40ch-poitiers.fr?utm_medium=email&utm_source=footer>.
> For more options, visit https://groups.google.com/a/apereo.org/d/optout.
--
Philippe MARASSE
Responsable pôle Infrastructures - DSIO
Centre Hospitalier Henri Laborit
CS 10587 - 370 avenue Jacques Cœur
86021 Poitiers Cedex
Tel : 05.49.44.57.19
--
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/6e14fc0f-fe47-5d79-7d4b-213425026bba%40ch-poitiers.fr.
For more options, visit https://groups.google.com/a/apereo.org/d/optout.
smime.p7s
Description: Signature cryptographique S/MIME
