Bug: cas 6.3 webflow with Duo

74 views

Skip to first unread message

Ray Bon

unread,

Apr 28, 2021, 6:36:03 PM4/28/21

to cas-...@apereo.org

Setup:

Given a fresh 6.3 install, I configured Duo MFA integration and have a service definition that requires it.

The Duo configuration is limited to the 4 required fields, all others are defaults.

Process (success):

A user that is _not_ registered in Duo, does not experience an error.

A user that _is_ registered in Duo, and logs in to the Duo MFA service, works as expected.

Process (fail):

However, if the Duo registered user logs in to a service that does _not_ required Duo MFA and later tries to access the Duo MFA requiring service, Cas throws a 500.

Data:

Prior to the error, Cas successfully contacts Duo and gets an 'Account is Active' message. The web flow then fails with a null pointer exception. (Log below.)

If anyone has any suggestions or work arounds, please post.

TIA

Ray

2021-04-28 14:46:16,597 DEBUG [aper.cas.adap.duo.auth.BasicDuoSecurityAuthenticationService] - <Received Duo ping response [{"response": "pong", "stat": "OK"}]> [ajp-nio-127.0.0.1-8010-exec-10]

2021-04-28 14:46:16,598 DEBUG [.aper.cas.adap.duo.auth.BaseDuoSecurityAuthenticationService] - <Contacting Duo to inquire about username [rbon]> [ajp-nio-127.0.0.1-8010-exec-10]

2021-04-28 14:46:16,989 DEBUG [.aper.cas.adap.duo.auth.BaseDuoSecurityAuthenticationService] - <Received Duo admin response [{"response": {"devices": [{"capabilities": ["auto", "push", "mobile_otp"], "device": "

D...K", "display_name": "iOS (XXX-XXX-XXXX)", "name": "", "number": "XXX-XXX-XXXX", "type": "phone"}], "result": "auth", "status_msg": "Account is active"}, "stat": "OK"}]> [ajp-nio-127.0.0.1-8010

-exec-10]

2021-04-28 14:46:16,990 DEBUG [.aper.cas.adap.duo.auth.BaseDuoSecurityAuthenticationService] - <Fetched and cached duo user account [DuoSecurityUserAccount(status=AUTH, enrollPortalUrl=null, username=rbon, messa

ge=Account is active)]> [ajp-nio-127.0.0.1-8010-exec-10]

2021-04-28 14:46:16,993 ERROR [ org.spri.boot.web.serv.supp.ErrorPageFilter] - <Forwarding to error page from request [/login] due to exception [Exception thrown executing org.apereo.cas.web.flow

.actions.CheckWebAuthenticationRequestAction@72f3ab7b in state 'determineDuoRequest' of flow 'mfa-duo' -- action execution attributes were 'map['resolvedAuthenticationEvents' -> list[mfa-duo]]']> [ajp-nio-127.0.

0.1-8010-exec-10]

org.springframework.webflow.execution.ActionExecutionException: Exception thrown executing org.apereo.cas.web.flow.actions.CheckWebAuthenticationRequestAction@72f3ab7b in state 'determineDuoRequest' of flow 'mfa-duo' -- action execution attributes were 'map['resolvedAuthenticationEvents' -> list[mfa-duo]]'

at org.springframework.webflow.execution.ActionExecutor.execute(ActionExecutor.java:62)

at org.springframework.webflow.action.EvaluateAction.doExecute(EvaluateAction.java:77)

at org.springframework.webflow.action.AbstractAction.execute(AbstractAction.java:188)

at org.springframework.webflow.execution.AnnotatedAction.execute(AnnotatedAction.java:145)

at org.springframework.webflow.execution.ActionExecutor.execute(ActionExecutor.java:51)

at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:101)

at org.springframework.webflow.engine.State.enter(State.java:194)

at org.springframework.webflow.engine.Transition.execute(Transition.java:228)

at org.springframework.webflow.engine.impl.FlowExecutionImpl.execute(FlowExecutionImpl.java:395)

at org.springframework.webflow.engine.impl.RequestControlContextImpl.execute(RequestControlContextImpl.java:214)

at org.springframework.webflow.engine.TransitionableState.handleEvent(TransitionableState.java:116)

at org.springframework.webflow.engine.Flow.handleEvent(Flow.java:547)

at org.springframework.webflow.engine.impl.FlowExecutionImpl.handleEvent(FlowExecutionImpl.java:390)

at org.springframework.webflow.engine.impl.RequestControlContextImpl.handleEvent(RequestControlContextImpl.java:210)

at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:105)