Hi all,
After reading the section on Duo MFA with multiple providers, I have setup
a couple services to use Duo MFA. My problem is, both CAS/SAML services I
have configured to use Duo, use just one of the Duo applications rather
than each service using just one of the Duo applications.
I have tried changing the ordering of the Duo applications, I have tried
changing the index by which it is configured, and I have tried configuring
both with the same index. None of these configurations seem to work. The
only time the second service uses the proper Duo application is when the
first Duo application is removed from the cas configuration.
The relevant cas configuration is below:
cas.authn.mfa.duo[0].duoSecretKey=
cas.authn.mfa.duo[0].duoApplicationKey=application key 1
cas.authn.mfa.duo[0].duoIntegrationKey=integration key 1
cas.authn.mfa.duo[0].duoApiHost=apihost.duosecurity.com
cas.authn.mfa.duo[0].id=duo-what.example.com
cas.authn.mfa.duo[0].name=what.example.com
cas.authn.mfa.duo[1].duoSecretKey=
cas.authn.mfa.duo[1].duoApplicationKey=application key 2
cas.authn.mfa.duo[1].duoIntegrationKey=integration key 2
cas.authn.mfa.duo[1].duoApiHost=apihost.duosecurity.com
cas.authn.mfa.duo[1].id=shib-test
cas.authn.mfa.duo[1].name=shib-test
The service registries are below:
What-9999999.json
{
@class: org.apereo.cas.services.RegexRegisteredService
description: Testing mod_auth_cas and duo
id: 9999999
name: What
serviceId: https://what.example.com/.*
multifactorPolicy: {
@class:
org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy
enabled: true
ssoEnabled: true
multifactorAuthenticationProviders: ["java.util.LinkedHashSet",
["duo-what.example.com"]]
}
attributeReleasePolicy: {
@class: org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy
allowedAttributes: ["java.util.ArrayList", ["cn", "mail", "sn"]]
}
}
Shibtest-1002.json
{
@class: org.apereo.cas.support.saml.services.SamlRegisteredService
description: Testing a Shibboleth SP
id: 1002
name: Shibtest
serviceId: https://what.example.com/sp
multifactorPolicy: {
@class:
org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy
enabled: true
ssoEnabled: true
multifactorAuthenticationProviders: ["java.util.LinkedHashSet",
["shib-test"]]
}
attributeReleasePolicy: {
@class: org.apereo.cas.services.ReturnMappedAttributeReleasePolicy
allowedAttributes: {
@class: java.util.TreeMap
cn: urn:oid:2.5.4.3
sn: urn:oid:2.5.4.4
mail: urn:oid:0.9.2342.19200300.100.1.3
memberOf: urn:oid:1.2.840.113556.1.2.102
}
}
proxyPolicy: {
@class: org.apereo.cas.services.RefuseRegisteredServiceProxyPolicy
}
metadataLocation: /etc/cas/metadata/shib-test.xml
metadataCriteriaPattern: https://what.example.com/sp
metadataCriteriaRoles: SPSSODescriptor
}
I have attached the cas.log for a login session up to the point of Duo. I
am stumped by this and the docs don't seem to be clear on how this all
works.
Thanks,
Mac Reid
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/c2a8e814-fe88-43b5-b423-d4d9a596d938%40apereo.org.
[root@host cas]# tail -f /var/log/cas/cas.log
2017-11-15 11:20:43,154 INFO [org.apereo.cas.services.DefaultServicesManager] -
<Loaded [7] service(s) from [JsonServiceRegistryDao].>
2017-11-15 11:21:01,482 DEBUG [org.apereo.cas.services.DefaultServicesManager]
- <Loading services from [JsonServiceRegistryDao]>
2017-11-15 11:21:01,485 DEBUG [org.apereo.cas.services.DefaultServicesManager]
- <Adding registered service [https://sp.testshib.org/shibboleth-sp]>
2017-11-15 11:21:01,485 DEBUG [org.apereo.cas.services.DefaultServicesManager]
- <Adding registered service [Apereo]>
2017-11-15 11:21:01,485 DEBUG [org.apereo.cas.services.DefaultServicesManager]
- <Adding registered service [https://foo.com/.*]>
2017-11-15 11:21:01,485 DEBUG [org.apereo.cas.services.DefaultServicesManager]
- <Adding registered service [HTTPSandIMAPS]>
2017-11-15 11:21:01,485 DEBUG [org.apereo.cas.services.DefaultServicesManager]
- <Adding registered service
[https://cas-test.example.com/cas/idp/profile/SAML2/POST/SSO/Callback.+]>
2017-11-15 11:21:01,485 DEBUG [org.apereo.cas.services.DefaultServicesManager]
- <Adding registered service [https://what.example.com/sp]>
2017-11-15 11:21:01,485 DEBUG [org.apereo.cas.services.DefaultServicesManager]
- <Adding registered service [https://what.example.com/.*]>
2017-11-15 11:21:01,486 INFO [org.apereo.cas.services.DefaultServicesManager] -
<Loaded [7] service(s) from [JsonServiceRegistryDao].>
2017-11-15 11:21:18,770 INFO
[org.apereo.cas.support.saml.web.idp.profile.AbstractSamlProfileHandlerController]
- <Received SAML profile request [/cas/idp/profile/SAML2/Redirect/SSO]>
2017-11-15 11:21:18,775 DEBUG
[org.apereo.cas.support.saml.web.idp.profile.AbstractSamlProfileHandlerController]
- <Decoded SAML object [{urn:oasis:names:tc:SAML:2.0:protocol}AuthnRequest]
from http request>
2017-11-15 11:21:18,775 DEBUG
[org.apereo.cas.support.saml.web.idp.profile.AbstractSamlProfileHandlerController]
- <Located issuer [https://what.example.com/sp] from authentication request>
2017-11-15 11:21:18,776 DEBUG
[org.apereo.cas.support.saml.web.idp.profile.AbstractSamlProfileHandlerController]
- <Checking service access in CAS service registry for
[https://what.example.com/sp]>
2017-11-15 11:21:18,777 DEBUG
[org.apereo.cas.support.saml.web.idp.profile.AbstractSamlProfileHandlerController]
- <Located SAML service in the registry as [https://what.example.com/sp] with
the metadata location of [/etc/cas/metadata/shib-test.xml]>
2017-11-15 11:21:18,777 DEBUG
[org.apereo.cas.support.saml.web.idp.profile.AbstractSamlProfileHandlerController]
- <Fetching saml metadata adaptor for [https://what.example.com/sp]>
2017-11-15 11:21:18,778 INFO
[org.apereo.cas.support.saml.services.idp.metadata.SamlRegisteredServiceServiceProviderMetadataFacade]
- <Adapting SAML metadata for CAS service [Shibtest] issued by
[https://what.example.com/sp]>
2017-11-15 11:21:18,778 INFO
[org.apereo.cas.support.saml.services.idp.metadata.SamlRegisteredServiceServiceProviderMetadataFacade]
- <Locating metadata for entityID [https://what.example.com/sp] with binding
[urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST] by attempting to run through
the metadata chain...>
2017-11-15 11:21:18,782 DEBUG
[org.apereo.cas.support.saml.services.idp.metadata.cache.DefaultSamlRegisteredServiceCachingMetadataResolver]
- <Resolving metadata for [Shibtest] at [/etc/cas/metadata/shib-test.xml].>
2017-11-15 11:21:18,787 INFO
[org.apereo.cas.support.saml.services.idp.metadata.cache.ChainingMetadataResolverCacheLoader]
- <Loading SAML metadata from [/etc/cas/metadata/shib-test.xml]>
2017-11-15 11:21:18,790 DEBUG
[org.apereo.cas.support.saml.services.idp.metadata.cache.ChainingMetadataResolverCacheLoader]
- <No metadata maximum validity criteria is defined for
[/etc/cas/metadata/shib-test.xml], so RequiredValidUntilFilter will not be
invoked>
2017-11-15 11:21:18,791 WARN
[org.apereo.cas.support.saml.services.idp.metadata.cache.ChainingMetadataResolverCacheLoader]
- <No metadata signature location is defined for
[/etc/cas/metadata/shib-test.xml], so SignatureValidationFilter will not be
invoked>
2017-11-15 11:21:18,791 DEBUG
[org.apereo.cas.support.saml.services.idp.metadata.cache.ChainingMetadataResolverCacheLoader]
- <Added entity role filter
[{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor]>
2017-11-15 11:21:18,792 DEBUG
[org.apereo.cas.support.saml.services.idp.metadata.cache.ChainingMetadataResolverCacheLoader]
- <Added entity role filter with roles
[[{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor]]>
2017-11-15 11:21:18,793 DEBUG
[org.apereo.cas.support.saml.services.idp.metadata.cache.ChainingMetadataResolverCacheLoader]
- <Metadata filter chain initialized with [1] filters>
2017-11-15 11:21:18,794 INFO
[org.apereo.cas.support.saml.services.idp.metadata.cache.ChainingMetadataResolverCacheLoader]
- <Initializing metadata resolver from [/etc/cas/metadata/shib-test.xml]>
2017-11-15 11:21:18,815 INFO
[org.apereo.cas.support.saml.services.idp.metadata.cache.ChainingMetadataResolverCacheLoader]
- <Initialized metadata resolver from [/etc/cas/metadata/shib-test.xml]>
2017-11-15 11:21:18,816 DEBUG
[org.apereo.cas.support.saml.services.idp.metadata.cache.DefaultSamlRegisteredServiceCachingMetadataResolver]
- <Loaded and cached SAML metadata
[org.opensaml.saml.metadata.resolver.ChainingMetadataResolver] from
[/etc/cas/metadata/shib-test.xml] for [30] minute(s)>
2017-11-15 11:21:18,817 INFO
[org.apereo.cas.support.saml.services.idp.metadata.SamlRegisteredServiceServiceProviderMetadataFacade]
- <Resolved metadata chain for service [https://what.example.com/sp].
Filtering the chain by entity ID [https://what.example.com/sp] and binding
[urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST]>
2017-11-15 11:21:18,817 DEBUG
[org.apereo.cas.support.saml.services.idp.metadata.SamlRegisteredServiceServiceProviderMetadataFacade]
- <Located EntityDescriptor in metadata for [https://what.example.com/sp]>
2017-11-15 11:21:18,818 DEBUG
[org.apereo.cas.support.saml.services.idp.metadata.SamlRegisteredServiceServiceProviderMetadataFacade]
- <Located SPSSODescriptor in metadata for [https://what.example.com/sp].
Metadata is valid until [null]>
2017-11-15 11:21:18,819 DEBUG
[org.apereo.cas.support.saml.web.idp.profile.AbstractSamlProfileHandlerController]
- <The authentication context is not signed>
2017-11-15 11:21:18,819 DEBUG
[org.apereo.cas.support.saml.web.idp.profile.AbstractSamlProfileHandlerController]
- <Authentication request is not signed, so there is no need to verify its
signature.>
2017-11-15 11:21:18,835 DEBUG [org.apereo.cas.support.saml.SamlUtils] -
<Logging [org.opensaml.saml.saml2.core.impl.AuthnRequestImpl]
[<?xml version="1.0" encoding="UTF-8"?><samlp:AuthnRequest
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL="https://what.example.com/secure/Shibboleth.sso/SAML2/POST";
Destination="https://cas-test.example.com/cas/idp/profile/SAML2/Redirect/SSO";
ID="_1c984794285640195603218a9383e656" IssueInstant="2017-11-15T16:21:18Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Version="2.0"><saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://what.example.com/sp</saml:Issuer><samlp:NameIDPolicy
AllowCreate="1"/></samlp:AuthnRequest>]>
2017-11-15 11:21:18,863 DEBUG
[org.apereo.cas.support.saml.web.idp.profile.AbstractSamlProfileHandlerController]
- <Built service callback url []>
2017-11-15 11:21:18,864 DEBUG
[org.apereo.cas.support.saml.web.idp.profile.AbstractSamlProfileHandlerController]
- <Created service url []>
2017-11-15 11:21:18,865 DEBUG
[org.apereo.cas.support.saml.web.idp.profile.AbstractSamlProfileHandlerController]
- <Redirecting SAML authN request to []>
2017-11-15 11:21:18,917 INFO [org.apereo.cas.web.flow.InitialFlowSetupAction] -
<Setting path for cookies for warn cookie generator to: [/cas/] >
2017-11-15 11:21:18,918 DEBUG
[org.apereo.cas.support.saml.authentication.principal.SamlServiceFactory] -
<Request does not specify a [TARGET] or request body is empty>
2017-11-15 11:21:18,919 DEBUG
[org.apereo.cas.web.support.DefaultArgumentExtractor] - <Created
[org.apereo.cas.authentication.principal.SimpleWebApplicationServiceImpl@40cc47da[id=,artifactId=<null>,principal=<null>,loggedOutAlready=false,format=XML]]
based on
[org.apereo.cas.authentication.principal.WebApplicationServiceFactory@1237e0be[]]>
2017-11-15 11:21:18,920 DEBUG
[org.apereo.cas.web.support.AbstractArgumentExtractor] - <Extractor generated
service type
[org.apereo.cas.authentication.principal.SimpleWebApplicationServiceImpl] for:
[]>
2017-11-15 11:21:18,948 DEBUG [org.apereo.cas.web.support.WebUtils] -
<Evaluating request to determine if warning cookie should be generated>
2017-11-15 11:21:18,950 INFO
[org.apereo.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit
trail record BEGIN
=============================================================
WHO: audit:unknown
WHAT: [event=success,timestamp=Wed Nov 15 11:21:18 EST
2017,source=RankedAuthenticationProviderWebflowEventResolver]
ACTION: AUTHENTICATION_EVENT_TRIGGERED
APPLICATION: CAS
WHEN: Wed Nov 15 11:21:18 EST 2017
CLIENT IP ADDRESS: remote ip
SERVER IP ADDRESS: local ip
=============================================================
>
2017-11-15 11:21:18,958 DEBUG
[org.apereo.cas.support.saml.services.SamlIdPEntityIdAuthenticationServiceSelectionStrategy]
- <Located entity id [https://what.example.com/sp] from service authentication
request at []>
2017-11-15 11:21:18,963 DEBUG
[org.apereo.cas.support.saml.services.SamlIdPEntityIdAuthenticationServiceSelectionStrategy]
- <Located entity id []>
2017-11-15 11:21:18,964 INFO
[org.apereo.cas.support.saml.services.idp.metadata.SamlRegisteredServiceServiceProviderMetadataFacade]
- <Adapting SAML metadata for CAS service [Shibtest] issued by
[https://what.example.com/sp]>
2017-11-15 11:21:18,964 INFO
[org.apereo.cas.support.saml.services.idp.metadata.SamlRegisteredServiceServiceProviderMetadataFacade]
- <Locating metadata for entityID [https://what.example.com/sp] with binding
[urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST] by attempting to run through
the metadata chain...>
2017-11-15 11:21:18,965 DEBUG
[org.apereo.cas.support.saml.services.idp.metadata.cache.DefaultSamlRegisteredServiceCachingMetadataResolver]
- <Resolving metadata for [Shibtest] at [/etc/cas/metadata/shib-test.xml].>
2017-11-15 11:21:18,966 DEBUG
[org.apereo.cas.support.saml.services.idp.metadata.cache.DefaultSamlRegisteredServiceCachingMetadataResolver]
- <Loaded and cached SAML metadata
[org.opensaml.saml.metadata.resolver.ChainingMetadataResolver] from
[/etc/cas/metadata/shib-test.xml] for [30] minute(s)>
2017-11-15 11:21:18,966 INFO
[org.apereo.cas.support.saml.services.idp.metadata.SamlRegisteredServiceServiceProviderMetadataFacade]
- <Resolved metadata chain for service [https://what.example.com/sp].
Filtering the chain by entity ID [https://what.example.com/sp] and binding
[urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST]>
2017-11-15 11:21:18,967 DEBUG
[org.apereo.cas.support.saml.services.idp.metadata.SamlRegisteredServiceServiceProviderMetadataFacade]
- <Located EntityDescriptor in metadata for [https://what.example.com/sp]>
2017-11-15 11:21:18,967 DEBUG
[org.apereo.cas.support.saml.services.idp.metadata.SamlRegisteredServiceServiceProviderMetadataFacade]
- <Located SPSSODescriptor in metadata for [https://what.example.com/sp].
Metadata is valid until [null]>
2017-11-15 11:21:18,968 DEBUG
[org.apereo.cas.support.saml.mdui.MetadataUIUtils] - <Locating SP SSO
descriptor for SAML2 protocol...>
2017-11-15 11:21:18,969 DEBUG
[org.apereo.cas.support.saml.mdui.MetadataUIUtils] - <SP SSO descriptor
resolved to be
[org.opensaml.saml.saml2.metadata.impl.SPSSODescriptorImpl@25d51f3c]>
2017-11-15 11:21:18,969 DEBUG
[org.apereo.cas.support.saml.mdui.MetadataUIUtils] - <No extensions in the SP
SSO descriptor are located for [urn:oasis:names:tc:SAML:metadata:ui]>
2017-11-15 11:21:19,014 WARN
[org.apereo.cas.util.cipher.BaseBinaryCipherExecutor] - <Secret key for signing
is not defined. CAS will attempt to auto-generate the signing key>
2017-11-15 11:21:19,016 WARN
[org.apereo.cas.util.cipher.BaseBinaryCipherExecutor] - <Generated signing key
[YGfcPB7S62pu4aHfWfcWcFncuA0MY64d5EDdoPEth37g5Yf0MipHimXpcz73URStE73xQ8dLYUZYZNsWPAVNPA]
of size [512]. The generated key MUST be added to CAS settings.>
2017-11-15 11:21:19,016 WARN
[org.apereo.cas.util.cipher.BaseBinaryCipherExecutor] - <No encryption key is
defined. CAS will attempt to auto-generate keys>
2017-11-15 11:21:19,017 WARN
[org.apereo.cas.util.cipher.BaseBinaryCipherExecutor] - <Generated encryption
key [qHKtogtzlcFlkTAw] of size [16]. The generated key MUST be added to CAS
settings.>
2017-11-15 11:21:19,066 DEBUG
[org.apereo.cas.web.view.CasReloadableMessageBundle] - <No properties file
found for [classpath:custom_messages_en] - neither plain properties nor XML>
2017-11-15 11:21:19,069 DEBUG
[org.apereo.cas.web.view.CasReloadableMessageBundle] - <No properties file
found for [classpath:custom_messages] - neither plain properties nor XML>
2017-11-15 11:21:19,071 DEBUG
[org.apereo.cas.web.view.CasReloadableMessageBundle] - <No properties file
found for [classpath:messages_en] - neither plain properties nor XML>
2017-11-15 11:21:19,075 DEBUG
[org.apereo.cas.web.view.CasReloadableMessageBundle] - <Loading properties
[messages.properties] with encoding 'UTF-8'>
2017-11-15 11:21:29,597 DEBUG
[org.apereo.cas.authentication.adaptive.DefaultAdaptiveAuthenticationPolicy] -
<Located client IP address as [remote ip]>
2017-11-15 11:21:29,598 DEBUG
[org.apereo.cas.authentication.adaptive.DefaultAdaptiveAuthenticationPolicy] -
<User agent [Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like
Gecko) Ubuntu Chromium/62.0.3202.89 Chrome/62.0.3202.89 Safari/537.36] is
authorized to proceed>
2017-11-15 11:21:29,599 DEBUG
[org.apereo.cas.authentication.adaptive.DefaultAdaptiveAuthenticationPolicy] -
<Adaptive authentication policy has authorized client [remote ip] to proceed.>
2017-11-15 11:21:29,606 DEBUG [org.apereo.cas.web.support.WebUtils] -
<Evaluating request to determine if warning cookie should be generated>
2017-11-15 11:21:29,612 DEBUG [org.apereo.cas.web.support.WebUtils] -
<Evaluating request to determine if warning cookie should be generated>
2017-11-15 11:21:29,618 DEBUG
[org.apereo.cas.adaptors.duo.config.DuoSecurityAuthenticationEventExecutionPlanConfiguration]
- <Multiple Duo Security providers are available; Duo authentication handler
is named after [what.example.com]>
2017-11-15 11:21:29,622 DEBUG
[org.apereo.cas.authentication.RegisteredServiceAuthenticationHandlerResolver]
- <No specific authentication handlers are required for this transaction>
2017-11-15 11:21:29,623 DEBUG
[org.apereo.cas.authentication.RegisteredServiceAuthenticationHandlerResolver]
- <Authentication handlers used for this transaction are
[LDAPHttpBasedServiceCredentialsAuthenticationHandlerwhat.example.com]>
2017-11-15 11:21:29,624 DEBUG
[org.apereo.cas.authentication.handler.support.AbstractUsernamePasswordAuthenticationHandler]
- <Transforming credential username via
[org.apereo.cas.configuration.support.Beans$$Lambda$76/1886301021]>
2017-11-15 11:21:29,625 DEBUG
[org.apereo.cas.authentication.handler.support.AbstractUsernamePasswordAuthenticationHandler]
- <Attempting to encode credential password via
[org.springframework.security.crypto.password.NoOpPasswordEncoder] for [mareid]>
2017-11-15 11:21:29,626 DEBUG
[org.apereo.cas.authentication.handler.support.AbstractUsernamePasswordAuthenticationHandler]
- <Attempting authentication internally for transformed credential [mareid]>
2017-11-15 11:21:29,628 DEBUG
[org.apereo.cas.authentication.LdapAuthenticationHandler] - <Attempting LDAP
authentication for [mareid]. Authenticator pre-configured attributes are
[null], additional requested attributes for this authentication request are
[[uid]]>
2017-11-15 11:21:29,726 DEBUG
[org.apereo.cas.authentication.LdapAuthenticationHandler] - <LDAP response:
[[org.ldaptive.auth.AuthenticationResponse@1703825864::authenticationResultCode=AUTHENTICATION_HANDLER_SUCCESS,
resolvedDn=uid=mareid,ou=people,dc=example,dc=com,
ldapEntry=[dn=uid=mareid,ou=People,dc=example,dc=com[[uid[mareid]]],
responseControls=null, messageId=-1], accountState=null, result=true,
resultCode=SUCCESS, message=null, controls=null]]>
2017-11-15 11:21:29,728 DEBUG
[org.apereo.cas.authentication.LdapAuthenticationHandler] - <Applying password
policy to
[[org.ldaptive.auth.AuthenticationResponse@1703825864::authenticationResultCode=AUTHENTICATION_HANDLER_SUCCESS,
resolvedDn=uid=mareid,ou=people,dc=example,dc=com,
ldapEntry=[dn=uid=mareid,ou=People,dc=example,dc=com[[uid[mareid]]],
responseControls=null, messageId=-1], accountState=null, result=true,
resultCode=SUCCESS, message=null, controls=null]]>
2017-11-15 11:21:29,729 DEBUG
[org.apereo.cas.authentication.support.DefaultAccountStateHandler] - <Account
state not defined. Returning empty list of messages.>
2017-11-15 11:21:29,730 DEBUG
[org.apereo.cas.authentication.LdapAuthenticationHandler] - <LDAP response
returned a result. Creating the final LDAP principal>
2017-11-15 11:21:29,731 DEBUG
[org.apereo.cas.authentication.LdapAuthenticationHandler] - <Creating LDAP
principal for [mareid] based on [uid=mareid,ou=People,dc=example,dc=com] and
attributes [[uid]]>
2017-11-15 11:21:29,732 DEBUG
[org.apereo.cas.authentication.LdapAuthenticationHandler] - <Retrieved
principal id attribute [mareid]>
2017-11-15 11:21:29,733 DEBUG
[org.apereo.cas.authentication.LdapAuthenticationHandler] - <Created LDAP
principal for id [mareid] and [0] attributes>
2017-11-15 11:21:29,733 DEBUG
[org.apereo.cas.authentication.AbstractAuthenticationManager] - <Authentication
handler [LDAP] successfully authenticated [mareid]>
2017-11-15 11:21:29,754 DEBUG
[org.apereo.cas.config.CasPersonDirectoryConfiguration] - <Configured LDAP
attribute source for [ldaps://ldap.example.com] and baseDn
[ou=people,dc=example,dc=com]>
2017-11-15 11:21:29,759 DEBUG [org.apereo.cas.configuration.support.Beans] -
<Creating LDAP connection factory for [ldaps://ldap.example.com]>
2017-11-15 11:21:29,760 DEBUG [org.apereo.cas.configuration.support.Beans] -
<Creating LDAP connection configuration for [ldaps://ldap.example.com]>
2017-11-15 11:21:29,762 DEBUG [org.apereo.cas.configuration.support.Beans] -
<Transformed LDAP urls from [ldaps://ldap.example.com] to
[ldaps://ldap.example.com]>
2017-11-15 11:21:29,763 DEBUG [org.apereo.cas.configuration.support.Beans] -
<Creating LDAP SSL configuration via trust certificates
[file:/etc/cas/pki/ldap.example.com.pem]>
2017-11-15 11:21:29,764 DEBUG [org.apereo.cas.configuration.support.Beans] -
<Creating LDAP bind connection initializer via [uid=bind,,dc=example,dc=com]>
2017-11-15 11:21:29,766 DEBUG [org.apereo.cas.configuration.support.Beans] -
<Creating LDAP connection pool configuration for [ldaps://ldap.example.com]>
2017-11-15 11:21:29,767 DEBUG [org.apereo.cas.configuration.support.Beans] -
<Created [BIND] passivator for [ldaps://ldap.example.com]>
2017-11-15 11:21:29,768 DEBUG [org.apereo.cas.configuration.support.Beans] -
<Initializing ldap connection pool for [ldaps://ldap.example.com] and bindDn
[uid=bind,,dc=example,dc=com]>
2017-11-15 11:21:32,956 DEBUG
[org.apereo.cas.config.CasPersonDirectoryConfiguration] - <LDAP attributes are
fetched from [ldaps://ldap.example.com] via filter [uid={user}]>
2017-11-15 11:21:32,957 DEBUG
[org.apereo.cas.config.CasPersonDirectoryConfiguration] - <Configured result
attribute mapping for [ldaps://ldap.example.com] to be [{udcid=udcid, uid=uid,
mail=mail, affiliation=groupMembership, displayName=displayName,
eduPersonPrincipalName=eduPersonPrincipalName, sn=sn, cn=commonName,
memberOf=memberOf}]>
2017-11-15 11:21:32,957 DEBUG
[org.apereo.cas.config.CasPersonDirectoryConfiguration] - <Initializing LDAP
attribute source for [ldaps://ldap.example.com]>
2017-11-15 11:21:32,965 DEBUG
[org.apereo.cas.config.CasPersonDirectoryConfiguration] - <Final list of
attribute repositories is
[[org.apereo.services.persondir.support.ldap.LdaptivePersonAttributeDao@68bd90ed]]>
2017-11-15 11:21:32,967 DEBUG
[org.apereo.cas.config.CasCoreAuthenticationPrincipalConfiguration] -
<Attribute repository sources are defined and available for the principal
resolution chain. The principal resolver will use a combination of attributes
collected from attribute repository sources and whatever may be collected
during the authentication phase where results are eventually merged.>
2017-11-15 11:21:32,967 DEBUG
[org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver] -
<Invoking principal resolver
[org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver@1d712f0d[chain=[org.apereo.cas.authentication.principal.resolvers.PersonDirectoryPrincipalResolver@81f03ea[returnNullIfNoAttributes=false,principalAttributeName=<null>],
org.apereo.cas.authentication.principal.resolvers.EchoingPrincipalResolver@4f6f17d[]]]]>
2017-11-15 11:21:32,968 DEBUG
[org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver] -
<Invoking principal resolver
[org.apereo.cas.authentication.principal.resolvers.PersonDirectoryPrincipalResolver@81f03ea[returnNullIfNoAttributes=false,principalAttributeName=<null>]]>
2017-11-15 11:21:32,968 DEBUG
[org.apereo.cas.authentication.principal.resolvers.PersonDirectoryPrincipalResolver]
- <Attempting to resolve a principal...>
2017-11-15 11:21:32,968 DEBUG
[org.apereo.cas.authentication.principal.resolvers.PersonDirectoryPrincipalResolver]
- <Creating principal for [mareid]>
2017-11-15 11:21:32,969 DEBUG
[org.apereo.cas.config.CasPersonDirectoryConfiguration] - <Configured merging
strategy for attribute sources is [REPLACE]>
2017-11-15 11:21:32,969 DEBUG
[org.apereo.cas.config.CasPersonDirectoryConfiguration] - <Configured attribute
repository sources to merge together:
[[org.apereo.services.persondir.support.ldap.LdaptivePersonAttributeDao@68bd90ed]]>
2017-11-15 11:21:32,970 DEBUG
[org.apereo.cas.config.CasPersonDirectoryConfiguration] - <Configured cache
expiration policy for merging attribute sources to be [30] minute(s)>
2017-11-15 11:21:34,002 DEBUG
[org.apereo.cas.authentication.principal.resolvers.PersonDirectoryPrincipalResolver]
- <Retrieved [8] attribute(s) from the repository>
2017-11-15 11:21:34,003 DEBUG
[org.apereo.cas.authentication.principal.resolvers.PersonDirectoryPrincipalResolver]
- <Found attribute [udcid]>
2017-11-15 11:21:34,004 DEBUG
[org.apereo.cas.authentication.principal.resolvers.PersonDirectoryPrincipalResolver]
- <Found attribute [uid]>
2017-11-15 11:21:34,005 DEBUG
[org.apereo.cas.authentication.principal.resolvers.PersonDirectoryPrincipalResolver]
- <Found attribute [mail]>
2017-11-15 11:21:34,006 DEBUG
[org.apereo.cas.authentication.principal.resolvers.PersonDirectoryPrincipalResolver]
- <Found attribute [displayName]>
2017-11-15 11:21:34,007 DEBUG
[org.apereo.cas.authentication.principal.resolvers.PersonDirectoryPrincipalResolver]
- <Found attribute [eduPersonPrincipalName]>
2017-11-15 11:21:34,008 DEBUG
[org.apereo.cas.authentication.principal.resolvers.PersonDirectoryPrincipalResolver]
- <Found attribute [sn]>
2017-11-15 11:21:34,009 DEBUG
[org.apereo.cas.authentication.principal.resolvers.PersonDirectoryPrincipalResolver]
- <Found attribute [commonName]>
2017-11-15 11:21:34,010 DEBUG
[org.apereo.cas.authentication.principal.resolvers.PersonDirectoryPrincipalResolver]
- <Found attribute [memberOf]>
2017-11-15 11:21:34,011 DEBUG
[org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver] -
<Invoking principal resolver
[org.apereo.cas.authentication.principal.resolvers.EchoingPrincipalResolver@4f6f17d[]]>
2017-11-15 11:21:34,012 DEBUG
[org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver] -
<Resolved principal [mareid]>
2017-11-15 11:21:34,013 DEBUG
[org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver] -
<Adding attributes [{}}] for the final principal>
2017-11-15 11:21:34,013 DEBUG
[org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver] -
<Resolved principal [mareid]>
2017-11-15 11:21:34,014 DEBUG
[org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver] -
<Final principal constructed by the chain of resolvers is [mareid]>
2017-11-15 11:21:34,015 DEBUG
[org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver] -
<Invoking principal resolver
[org.apereo.cas.authentication.principal.resolvers.EchoingPrincipalResolver@639b5475[]]>
2017-11-15 11:21:34,016 DEBUG
[org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver] -
<Resolved principal [mareid]>
2017-11-15 11:21:34,017 DEBUG
[org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver] -
<Adding attributes [{}] for the final principal>
2017-11-15 11:21:34,018 DEBUG
[org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver] -
<Resolved principal [mareid]>
2017-11-15 11:21:34,018 DEBUG
[org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver] -
<Final principal constructed by the chain of resolvers is [mareid]>
2017-11-15 11:21:34,019 DEBUG
[org.apereo.cas.authentication.AbstractAuthenticationManager] -
<[org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver@d990d0[chain=[org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver@1d712f0d[chain=[org.apereo.cas.authentication.principal.resolvers.PersonDirectoryPrincipalResolver@81f03ea[returnNullIfNoAttributes=false,principalAttributeName=<null>],
org.apereo.cas.authentication.principal.resolvers.EchoingPrincipalResolver@4f6f17d[]]],
org.apereo.cas.authentication.principal.resolvers.EchoingPrincipalResolver@639b5475[]]]]
resolved [mareid] from [mareid]>
2017-11-15 11:21:34,020 DEBUG
[org.apereo.cas.authentication.AbstractAuthenticationManager] - <Final
principal resolved for this authentication event is [mareid]>
2017-11-15 11:21:34,022 DEBUG
[org.apereo.cas.authentication.policy.AnyAuthenticationPolicy] -
<Authentication policy is satisfied having found at least one authentication
transactions>
2017-11-15 11:21:34,023 INFO
[org.apereo.cas.authentication.AbstractAuthenticationManager] - <Authenticated
principal [mareid] with attributes [{}] via credentials [[mareid]].>
2017-11-15 11:21:34,023 DEBUG
[org.apereo.cas.authentication.AbstractAuthenticationManager] - <Invoking
authentication metadata populators for authentication transaction>
2017-11-15 11:21:34,026 DEBUG
[org.apereo.cas.authentication.DefaultAuthenticationEventExecutionPlan] -
<Sorted and registered metadata populators for this transaction are
[[org.apereo.cas.authentication.metadata.AuthenticationContextAttributeMetaDataPopulator@7ad529c7[order=-2147483648,authenticationContextAttribute=authnContextClass,authenticationHandler=org.apereo.cas.adaptors.duo.authn.DuoAuthenticationHandler@4cb593b4,provider=DefaultVariegatedMultifactorAuthenticationProvider],
org.apereo.cas.authentication.metadata.SuccessfulHandlerMetaDataPopulator@2acbc859[order=-2147483648],
org.apereo.cas.authentication.metadata.RememberMeAuthenticationMetaDataPopulator@2c6aed22[order=-2147483648],
org.apereo.cas.support.saml.authentication.SamlAuthenticationMetaDataPopulator@1a87b51[order=-2147483648,authenticationMethods={org.apereo.cas.adaptors.x509.authentication.principal.X509CertificateCredentials=urn:oasis:names:tc:SAML:1.0:am:X509-PKI,
org.apereo.cas.adaptors.trusted.authentication.principal.PrincipalBearingCredentials=urn:oasis:names:tc:SAML:1.0:am:unspecified,
org.apereo.cas.authentication.UsernamePasswordCredential=urn:oasis:names:tc:SAML:1.0:am:password,
org.apereo.cas.authentication.HttpBasedServiceCredential=urn:ietf:rfc:2246}]]]>
2017-11-15 11:21:34,027 INFO
[org.apereo.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit
trail record BEGIN
=============================================================
WHO: mareid
WHAT: Supplied credentials: [mareid]
ACTION: AUTHENTICATION_SUCCESS
APPLICATION: CAS
WHEN: Wed Nov 15 11:21:34 EST 2017
CLIENT IP ADDRESS: remote ip
SERVER IP ADDRESS: local ip
=============================================================
>
2017-11-15 11:21:34,033 DEBUG
[org.apereo.cas.authentication.DefaultAuthenticationTransactionManager] -
<Successful authentication; Collecting authentication result
[org.apereo.cas.authentication.DefaultAuthentication@544f109c]>
2017-11-15 11:21:34,052 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Locating principal attributes for [mareid]>
2017-11-15 11:21:34,053 DEBUG
[org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository]
- <[DefaultPrincipalAttributesRepository] will return the collection of
attributes directly associated with the principal object which are [{}]>
2017-11-15 11:21:34,054 DEBUG
[org.apereo.cas.authentication.principal.cache.AbstractPrincipalAttributesRepository]
- <Found [8] cached attributes for principal [mareid] that are [{}]>
2017-11-15 11:21:34,054 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Found principal attributes [{}] for [mareid]>
2017-11-15 11:21:34,055 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Calling attribute policy [ReturnAllowedAttributeReleasePolicy] to process
attributes for [mareid]>
2017-11-15 11:21:34,055 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Attribute policy [ReturnAllowedAttributeReleasePolicy] allows release of [{}]
for [mareid]>
2017-11-15 11:21:34,056 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Attempting to merge policy attributes and default attributes>
2017-11-15 11:21:34,056 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Checking default attribute policy attributes>
2017-11-15 11:21:34,057 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Located application context. Retrieving default attributes for release, if any>
2017-11-15 11:21:34,057 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Default attributes for release are: [[]]>
2017-11-15 11:21:34,058 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Default attributes found to be released are [{}]>
2017-11-15 11:21:34,058 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Adding default attributes first to the released set of attributes>
2017-11-15 11:21:34,059 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Adding policy attributes to the released set of attributes>
2017-11-15 11:21:34,060 DEBUG
[org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy] -
<Final collection of attributes allowed are: [{}]>
2017-11-15 11:21:34,061 DEBUG
[org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy] - <Skipping
access strategy policy, since no attributes rules are defined>
2017-11-15 11:21:34,066 DEBUG [org.apereo.cas.web.support.WebUtils] -
<Evaluating request to determine if warning cookie should be generated>
2017-11-15 11:21:34,067 DEBUG
[org.apereo.cas.support.saml.services.SamlIdPEntityIdAuthenticationServiceSelectionStrategy]
- <Located entity id []>
2017-11-15 11:21:34,071 DEBUG [org.apereo.cas.web.support.WebUtils] -
<Evaluating request to determine if warning cookie should be generated>
2017-11-15 11:21:34,073 DEBUG
[org.apereo.cas.support.saml.services.SamlIdPEntityIdAuthenticationServiceSelectionStrategy]
- <Located entity id []>
2017-11-15 11:21:34,077 DEBUG [org.apereo.cas.web.support.WebUtils] -
<Evaluating request to determine if warning cookie should be generated>
2017-11-15 11:21:34,078 DEBUG
[org.apereo.cas.support.saml.services.SamlIdPEntityIdAuthenticationServiceSelectionStrategy]
- <Located entity id []>
2017-11-15 11:21:34,082 DEBUG [org.apereo.cas.web.support.WebUtils] -
<Evaluating request to determine if warning cookie should be generated>
2017-11-15 11:21:34,083 DEBUG
[org.apereo.cas.support.saml.services.SamlIdPEntityIdAuthenticationServiceSelectionStrategy]
- <Located entity id []>
2017-11-15 11:21:34,085 DEBUG [org.apereo.cas.web.support.WebUtils] -
<Evaluating request to determine if warning cookie should be generated>
2017-11-15 11:21:34,088 DEBUG
[org.apereo.cas.support.saml.services.SamlIdPEntityIdAuthenticationServiceSelectionStrategy]
- <Located entity id []>
2017-11-15 11:21:34,089 DEBUG
[org.apereo.cas.support.saml.services.SamlIdPEntityIdAuthenticationServiceSelectionStrategy]
- <Located entity id []>
2017-11-15 11:21:34,092 DEBUG [org.apereo.cas.web.support.WebUtils] -
<Evaluating request to determine if warning cookie should be generated>
2017-11-15 11:21:34,093 DEBUG
[org.apereo.cas.support.saml.services.SamlIdPEntityIdAuthenticationServiceSelectionStrategy]
- <Located entity id []>
2017-11-15 11:21:34,096 DEBUG [org.apereo.cas.web.support.WebUtils] -
<Evaluating request to determine if warning cookie should be generated>
2017-11-15 11:21:34,097 DEBUG
[org.apereo.cas.support.saml.services.SamlIdPEntityIdAuthenticationServiceSelectionStrategy]
- <Located entity id []>
2017-11-15 11:21:34,119 DEBUG [org.apereo.cas.web.support.WebUtils] -
<Evaluating request to determine if warning cookie should be generated>
2017-11-15 11:21:34,120 DEBUG
[org.apereo.cas.support.saml.services.SamlIdPEntityIdAuthenticationServiceSelectionStrategy]
- <Located entity id []>
2017-11-15 11:21:34,123 DEBUG [org.apereo.cas.web.support.WebUtils] -
<Evaluating request to determine if warning cookie should be generated>
2017-11-15 11:21:34,125 DEBUG
[org.apereo.cas.support.saml.services.SamlIdPEntityIdAuthenticationServiceSelectionStrategy]
- <Located entity id []>
2017-11-15 11:21:34,137 DEBUG [org.apereo.cas.web.support.WebUtils] -
<Evaluating request to determine if warning cookie should be generated>
2017-11-15 11:21:34,139 DEBUG
[org.apereo.cas.support.saml.services.SamlIdPEntityIdAuthenticationServiceSelectionStrategy]
- <Located entity id []>
2017-11-15 11:21:34,141 DEBUG
[org.apereo.cas.services.AbstractMultifactorAuthenticationProvider] -
<Multifactor failure mode for [https://what.example.com/sp] is defined as
[CLOSED]>
2017-11-15 11:21:34,142 DEBUG
[org.apereo.cas.adaptors.duo.authn.BaseDuoAuthenticationService] - <Contacting
Duo @ [https://apihost.duosecurity.com/rest/v1/ping]>
2017-11-15 11:21:34,711 DEBUG [org.apereo.cas.util.http.SimpleHttpClient] -
<Response code received from server matched [200].>
2017-11-15 11:21:34,713 DEBUG
[org.apereo.cas.adaptors.duo.authn.BaseDuoAuthenticationService] - <Received
Duo ping response [{"response": "pong", "stat": "OK"}]>
2017-11-15 11:21:34,716 INFO
[org.apereo.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit
trail record BEGIN
=============================================================
WHO: mareid
WHAT: [event=duo-what.example.com,timestamp=Wed Nov 15 11:21:34 EST
2017,source=RegisteredServiceMultifactorAuthenticationPolicyEventResolver]
ACTION: AUTHENTICATION_EVENT_TRIGGERED
APPLICATION: CAS
WHEN: Wed Nov 15 11:21:34 EST 2017
CLIENT IP ADDRESS: remote ip
SERVER IP ADDRESS: local ip
=============================================================
>
2017-11-15 11:21:34,720 DEBUG [org.apereo.cas.web.support.WebUtils] -
<Evaluating request to determine if warning cookie should be generated>
2017-11-15 11:21:34,721 DEBUG
[org.apereo.cas.support.saml.services.SamlIdPEntityIdAuthenticationServiceSelectionStrategy]
- <Located entity id []>
2017-11-15 11:21:34,723 DEBUG
[org.apereo.cas.services.AbstractMultifactorAuthenticationProvider] - <Provided
event id [duo-what.example.com] is not applicable to this provider identified
by [shib-test]>
2017-11-15 11:21:34,724 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Locating matching attribute [null] with value [null] amongst the attribute
collection [{}]>
2017-11-15 11:21:34,725 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Failed to match since attribute name is undefined>
2017-11-15 11:21:34,726 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Locating matching attribute [null] with value [null] amongst the attribute
collection
[{samlAuthenticationStatementAuthMethod=urn:oasis:names:tc:SAML:1.0:am:password,
authenticationMethod=LDAP, successfulAuthenticationHandlers=[LDAP]}]>
2017-11-15 11:21:34,727 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Failed to match since attribute name is undefined>
2017-11-15 11:21:34,728 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Locating matching attribute [authenticationMethod] with value [null] amongst
the attribute collection
[{samlAuthenticationStatementAuthMethod=urn:oasis:names:tc:SAML:1.0:am:password,
authenticationMethod=LDAP, successfulAuthenticationHandlers=[LDAP]}]>
2017-11-15 11:21:34,729 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Attempting to match [authenticationMethod] against
[samlAuthenticationStatementAuthMethod]>
2017-11-15 11:21:34,730 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Attempting to match [authenticationMethod] against [authenticationMethod]>
2017-11-15 11:21:34,731 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Attempting to match [authenticationMethod] against
[successfulAuthenticationHandlers]>
2017-11-15 11:21:34,732 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Found [1] attributes relevant for multifactor authentication bypass>
2017-11-15 11:21:34,732 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] - <No
attribute value to match is provided; Match result is set to [false]>
2017-11-15 11:21:34,733 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Locating matching attribute [successfulAuthenticationHandlers] with value
[null] amongst the attribute collection
[{samlAuthenticationStatementAuthMethod=urn:oasis:names:tc:SAML:1.0:am:password,
authenticationMethod=LDAP, successfulAuthenticationHandlers=[LDAP]}]>
2017-11-15 11:21:34,734 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Attempting to match [successfulAuthenticationHandlers] against
[samlAuthenticationStatementAuthMethod]>
2017-11-15 11:21:34,734 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Attempting to match [successfulAuthenticationHandlers] against
[authenticationMethod]>
2017-11-15 11:21:34,735 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Attempting to match [successfulAuthenticationHandlers] against
[successfulAuthenticationHandlers]>
2017-11-15 11:21:34,736 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Found [1] attributes relevant for multifactor authentication bypass>
2017-11-15 11:21:34,736 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] - <No
attribute value to match is provided; Match result is set to [false]>
2017-11-15 11:21:34,737 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Bypass rules for service [mareid] indicate the request may be ignored>
2017-11-15 11:21:34,739 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Updated authentication session to remember bypass for [duo-what.example.com]
via [bypassMultifactorAuthentication]>
2017-11-15 11:21:34,741 DEBUG
[org.apereo.cas.adaptors.duo.authn.BaseDuoAuthenticationService] - <Contacting
Duo to inquire about username [mareid]>
2017-11-15 11:21:35,300 DEBUG
[org.apereo.cas.adaptors.duo.authn.BaseDuoAuthenticationService] - <Received
Duo admin response [{"code": 40301, "message": "Access forbidden",
"message_detail": "Wrong integration type for this API.", "stat": "FAIL"}]>
2017-11-15 11:21:35,301 DEBUG
[org.apereo.cas.adaptors.duo.authn.DefaultDuoMultifactorAuthenticationProvider]
- <Found duo user account status [AUTH] for [mareid]>
2017-11-15 11:21:35,302 DEBUG
[org.apereo.cas.services.AbstractMultifactorAuthenticationProvider] -
<[DefaultDuoMultifactorAuthenticationProvider] voted to support this
authentication request>
2017-11-15 11:21:35,303 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Locating matching attribute [null] with value [null] amongst the attribute
collection [{}]>
2017-11-15 11:21:35,304 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Failed to match since attribute name is undefined>
2017-11-15 11:21:35,304 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Locating matching attribute [null] with value [null] amongst the attribute
collection
[{samlAuthenticationStatementAuthMethod=urn:oasis:names:tc:SAML:1.0:am:password,
bypassMultifactorAuthentication=false, authenticationMethod=LDAP,
successfulAuthenticationHandlers=[LDAP]}]>
2017-11-15 11:21:35,305 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Failed to match since attribute name is undefined>
2017-11-15 11:21:35,306 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Locating matching attribute [authenticationMethod] with value [null] amongst
the attribute collection
[{samlAuthenticationStatementAuthMethod=urn:oasis:names:tc:SAML:1.0:am:password,
bypassMultifactorAuthentication=false, authenticationMethod=LDAP,
successfulAuthenticationHandlers=[LDAP]}]>
2017-11-15 11:21:35,306 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Attempting to match [authenticationMethod] against
[samlAuthenticationStatementAuthMethod]>
2017-11-15 11:21:35,307 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Attempting to match [authenticationMethod] against
[bypassMultifactorAuthentication]>
2017-11-15 11:21:35,308 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Attempting to match [authenticationMethod] against [authenticationMethod]>
2017-11-15 11:21:35,308 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Attempting to match [authenticationMethod] against
[successfulAuthenticationHandlers]>
2017-11-15 11:21:35,309 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Found [1] attributes relevant for multifactor authentication bypass>
2017-11-15 11:21:35,316 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] - <No
attribute value to match is provided; Match result is set to [false]>
2017-11-15 11:21:35,317 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Locating matching attribute [successfulAuthenticationHandlers] with value
[null] amongst the attribute collection
[{samlAuthenticationStatementAuthMethod=urn:oasis:names:tc:SAML:1.0:am:password,
bypassMultifactorAuthentication=false, authenticationMethod=LDAP,
successfulAuthenticationHandlers=[LDAP]}]>
2017-11-15 11:21:35,320 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Attempting to match [successfulAuthenticationHandlers] against
[samlAuthenticationStatementAuthMethod]>
2017-11-15 11:21:35,321 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Attempting to match [successfulAuthenticationHandlers] against
[bypassMultifactorAuthentication]>
2017-11-15 11:21:35,321 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Attempting to match [successfulAuthenticationHandlers] against
[authenticationMethod]>
2017-11-15 11:21:35,322 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Attempting to match [successfulAuthenticationHandlers] against
[successfulAuthenticationHandlers]>
2017-11-15 11:21:35,323 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Found [1] attributes relevant for multifactor authentication bypass>
2017-11-15 11:21:35,324 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] - <No
attribute value to match is provided; Match result is set to [false]>
2017-11-15 11:21:35,324 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Bypass rules for service [mareid] indicate the request may be ignored>
2017-11-15 11:21:35,325 DEBUG
[org.apereo.cas.services.DefaultMultifactorAuthenticationProviderBypass] -
<Updated authentication session to remember bypass for [duo-what.example.com]
via [bypassMultifactorAuthentication]>
2017-11-15 11:21:35,335 DEBUG
[org.apereo.cas.adaptors.duo.authn.BaseDuoAuthenticationService] - <Contacting
Duo to inquire about username [mareid]>
2017-11-15 11:21:35,522 DEBUG
[org.apereo.cas.adaptors.duo.authn.BaseDuoAuthenticationService] - <Received
Duo admin response [{"code": 40301, "message": "Access forbidden",
"message_detail": "Wrong integration type for this API.", "stat": "FAIL"}]>
2017-11-15 11:21:35,524 DEBUG
[org.apereo.cas.adaptors.duo.authn.DefaultDuoMultifactorAuthenticationProvider]
- <Found duo user account status [AUTH] for [mareid]>
2017-11-15 11:21:35,524 DEBUG
[org.apereo.cas.services.AbstractMultifactorAuthenticationProvider] -
<[DefaultDuoMultifactorAuthenticationProvider] voted to support this
authentication request>
2017-11-15 11:21:35,526 DEBUG
[org.apereo.cas.support.saml.authentication.principal.SamlServiceFactory] -
<Request does not specify a [TARGET] or request body is empty>
