Alex, If you have the crypto values set correctly, do you still need the custom configuration?
You can turn off crypto to see if that was the source of the problem (without the custom class) - default is true: cas.interrupt.cookie.crypto.enabled=true Is force execution set to true? - default is false: cas.interrupt.core.force-execution=false Does the behaviour happen with every service, or only some services that might not participate in SSO (this may be impacted by the trigger mode)? Does this happen with users that are changing IP address? pin-to-session is true by default: cas.interrupt.cookie.pin-to-session=true Ray ________________________________ From: Ray Bon <[email protected]> Sent: April 30, 2026 13:13 To: Alex Kauchak <[email protected]> Subject: Re: [cas-user] Issue with redirecting after interrupt Alex, If you have the crypto values set correctly, do you still need the custom configuration? You can turn off crypto to see if that was the source of the problem (without the custom class) - default is true: cas.interrupt.cookie.crypto.enabled=true Is force execution set to true? - default is false: cas.interrupt.core.force-execution=false Does the behaviour happen with every service, or only some services that might not participate in SSO (this may be impacted by the trigger mode)? Does this happen with users that are changing IP address? pin-to-session is true by default: cas.interrupt.cookie.pin-to-session=true Ray ________________________________ From: Alex Kauchak <[email protected]> Sent: April 30, 2026 12:27 To: CAS Community <[email protected]> Cc: Ray Bon <[email protected]> Subject: Re: [cas-user] Issue with redirecting after interrupt You don't often get email from [email protected]. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> I just need to handle interrupts being fired properly. It's still sending them, even with SSO established, because of not defining the keys I mentioned above. Now that I've done that, it seems there's an issue in the flow state going from the interrupt back to another part of the flow(success). On Thursday, April 30, 2026 at 2:59:06 PM UTC-4 Ray Bon wrote: Alex, This is a spring web flow problem. You set a state of 'restore' but it is not in the list of possible options (printed in error message). What is it that you are trying to do, that you need a custom class? Ray P.S. You can add @Slf4j to your class and use LOGGER instead of System.out.println When starting with a new class, I use LOGGER.error to make sure the log messages will print and are easy to find. ________________________________ From: 'Alex Kauchak' via CAS Community <[email protected]> Sent: April 30, 2026 08:08 To: CAS Community <[email protected]> Subject: [cas-user] Issue with redirecting after interrupt Hello, I am experiencing issues redirecting back properly from a CAS interrupt after adding cas.interrupt.cookie.crypto signing and encryption keys. I've enabled CAS duo and interrupt logs, without any real success in getting more info out of them. Here's the error I am seeing: Invalid/Unknown Webflow Configuration You are seeing this error because the authentication flow cannot locate or validate the sequence of requested events and transitions and does not know how to route the flow to the next step. Current flow identifier is login and the current state identifier is duoUniversalPromptPrepareValidate. The error message is: No transition was matched on the event(s) signaled by the [1] action(s) that executed in this action state 'duoUniversalPromptPrepareValidate' of flow 'login'; transitions must be defined to handle action result outcomes -- possible flow configuration error? Note: the eventIds signaled were: 'array<String>['restore']', while the supported set of transitional criteria for this action state is 'array<TransitionCriteria>[skip, error, mfa-duo, success]' Please examine the CAS server logs to find the root cause and additional details. I am currently working with a config java file to try to apply changes that fix this, with no success. I have applied this file via including an import statement in it for src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports. package org.apereo.cas.config; import lombok.val; import org.apereo.cas.configuration.CasConfigurationProperties; import org.apereo.cas.web.flow.CasWebflowConfigurer; import org.apereo.cas.web.flow.CasWebflowExecutionPlanConfigurer; import org.apereo.cas.web.flow.configurer.AbstractCasWebflowConfigurer; import org.springframework.boot.autoconfigure.AutoConfiguration; import org.springframework.boot.autoconfigure.AutoConfigureAfter; import org.springframework.boot.context.properties.EnableConfigurationProperties; import org.springframework.context.ConfigurableApplicationContext; import org.springframework.context.annotation.Bean; import org.springframework.core.Ordered; import org.springframework.core.annotation.Order; import org.springframework.webflow.definition.registry.FlowDefinitionRegistry; import org.springframework.webflow.engine.ActionState; import org.springframework.webflow.engine.builder.support.FlowBuilderServices; @AutoConfiguration @EnableConfigurationProperties(CasConfigurationProperties.class) /* * Force this to run AFTER the Duo module so we don't get * overwritten by the default Duo configuration. */ @AutoConfigureAfter(name = "org.apereo.cas.adaptors.duo.web.flow.config.DuoSecurityComponentSerializationConfiguration") public class CasOverlayOverrideConfiguration { static { System.out.println("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"); System.out.println("!!! JVM HAS LOADED CasOverlayOverrideConfiguration !!!"); System.out.println("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"); } @Bean public CasWebflowConfigurer customDuoWebflowConfigurer( ConfigurableApplicationContext applicationContext, CasConfigurationProperties casProperties, FlowDefinitionRegistry loginFlowDefinitionRegistry, FlowBuilderServices flowBuilderServices) { return new InnerDuoWebflowConfigurer(flowBuilderServices, loginFlowDefinitionRegistry, applicationContext, casProperties); } @Bean public CasWebflowExecutionPlanConfigurer customDuoWebflowExecutionPlanConfigurer( CasWebflowConfigurer customDuoWebflowConfigurer) { return plan -> plan.registerWebflowConfigurer(customDuoWebflowConfigurer); } @Order(Ordered.LOWEST_PRECEDENCE) private static class InnerDuoWebflowConfigurer extends AbstractCasWebflowConfigurer { public InnerDuoWebflowConfigurer(FlowBuilderServices flowBuilderServices, FlowDefinitionRegistry loginFlowDefinitionRegistry, ConfigurableApplicationContext applicationContext, CasConfigurationProperties casProperties) { super(flowBuilderServices, loginFlowDefinitionRegistry, applicationContext, casProperties); } @Override protected void doInitialize() { val stateId = "duoUniversalPromptPrepareValidate"; // 1. Check the Main Login Flow val loginFlow = getLoginFlow(); if (loginFlow != null) { if (containsFlowState(loginFlow, stateId)) { System.out.println("!!! CAS 7.3: Found " + stateId + " in LOGIN flow. Injecting 'restore' transition."); val state = (ActionState) loginFlow.getState(stateId); createTransitionForState(state, "restore", "viewDuoUniversalPrompt"); } else { System.out.println("--- CAS 7.3: State " + stateId + " NOT found in LOGIN flow."); } } // 2. Check the MFA-DUO Flow (Usually where the state lives in 7.3) val duoFlow = getFlow("mfa-duo"); if (duoFlow != null) { if (containsFlowState(duoFlow, stateId)) { System.out.println("!!! CAS 7.3: Found " + stateId + " in MFA-DUO flow. Injecting 'restore' transition."); val state = (ActionState) duoFlow.getState(stateId); createTransitionForState(state, "restore", "viewDuoUniversalPrompt"); } else { System.out.println("--- CAS 7.3: State " + stateId + " NOT found in MFA-DUO flow."); } } } } } -- - Website: https://apereo.github.io/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/090f58d3-9ebe-463c-862d-789c8b1c1dban%40apereo.org<https://groups.google.com/a/apereo.org/d/msgid/cas-user/090f58d3-9ebe-463c-862d-789c8b1c1dban%40apereo.org?utm_medium=email&utm_source=footer>. -- - Website: https://apereo.github.io/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/YQBP288MB0081F2652DEF750385C99F1BCE352%40YQBP288MB0081.CANP288.PROD.OUTLOOK.COM.
