<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0">
<base href="https://issues.shibboleth.net/jira">
<title>Message Title</title>
</head>
<body class="jira" style="color: #333333; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.429">
<table id="background-table" cellpadding="0" cellspacing="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; background-color: #f5f5f5; border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt" bgcolor="#f5f5f5">
<!-- header here -->
<tbody>
<tr>
<td id="header-pattern-container" style="padding: 0px; border-collapse: collapse; padding: 10px 20px">
<table id="header-pattern" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td id="header-avatar-image-container" valign="top" style="padding: 0px; border-collapse: collapse; vertical-align: top; width: 32px; padding-right: 8px" width="32"> <img id="header-avatar-image" class="image_fix" src="cid:jira-generated-image-avatar-5448fda2-fbbc-4d61-b3dd-5d0948a2f5e2" height="32" width="32" border="0" style="border-radius: 3px; vertical-align: top"> </td>
<td id="header-text-container" valign="middle" style="padding: 0px; border-collapse: collapse; vertical-align: middle; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px"> <a class="user-hover" rel="rdw@iay.org.uk" id="email_rdw@iay.org.uk" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=rdw%40iay.org.uk" style="color:#3b73af;; color: #3b73af; text-decoration: none">Rod Widdowson</a> <strong>commented</strong> on <a href="https://issues.shibboleth.net/jira/browse/IDP-1110" style="color: #3b73af; text-decoration: none"><img src="cid:jira-generated-image-avatar-4c52d143-f838-4106-8512-bc79791ded8d" height="16" width="16" border="0" align="absmiddle" alt="Task"> IDP-1110</a> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="email-content-container" style="padding: 0px; border-collapse: collapse; padding: 0 20px">
<table id="email-content-table" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; border-spacing: 0; border-collapse: separate">
<tbody>
<tr>
<!-- there needs to be content in the cell for it to render in some clients -->
<td class="email-content-rounded-top mobile-expand" style="padding: 0px; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 15px; background-color: #ffffff; border-left: 1px solid #cccccc; border-top: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom: 0; border-top-right-radius: 5px; border-top-left-radius: 5px; height: 10px; line-height: 10px; padding: 0 15px 0 16px; mso-line-height-rule: exactly" height="10" bgcolor="#ffffff"> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff">
<table class="page-title-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td style="vertical-align: top;; padding: 0px; border-collapse: collapse; padding-right: 5px; font-size: 20px; line-height: 30px; mso-line-height-rule: exactly" class="page-title-pattern-header-container"> <span class="page-title-pattern-header" style="font-family: Arial, sans-serif; padding: 0; font-size: 20px; line-height: 30px; mso-text-raise: 2px; mso-line-height-rule: exactly; vertical-align: middle"> <a href="https://issues.shibboleth.net/jira/browse/IDP-1110" style="color: #3b73af; text-decoration: none">Re: Support Jetty 9.4</a> </span> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="text-paragraph-pattern-top" class="email-content-main mobile-expand comment-top-pattern" style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff; border-bottom: none; padding-bottom: 0" bgcolor="#ffffff">
<table class="text-paragraph-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 2px">
<tbody>
<tr>
<td class="text-paragraph-pattern-container mobile-resize-text " style="padding: 0px; border-collapse: collapse; padding: 0 0 10px 0"> <h1 style="margin: 10px 0 0 0; margin-top: 0; font-size: 24px; font-weight: normal; line-height: 1.250; margin: 40px 0 0 0; margin-top: 0"><a name="DailySummary" style="color: #3b73af; text-decoration: none"></a>Daily Summary</h1> <p style="margin: 10px 0 0 0">Because you can only really have so much fun in one day and because repeatedly striking your head against a wall while sandpapering your arms and rubing salt onto the open wound is so much fun I'm calling a halt today.</p> <p style="margin: 10px 0 0 0">To summarise here is what I know about running this in a "windows installed" version. </p> <h2 style="margin: 10px 0 0 0; font-size: 20px; font-weight: normal; line-height: 1.500; margin: 40px 0 0 0"><a name="Whata%22windowsinstall%22versionis" style="color: #3b73af; text-decoration: none"></a>What a "windows install" version is</h2>
<ul>
<li>procrun (1.latest)</li>
<li>a pure jetty (unpacked from the zip)</li>
<li>Shibboleth (as per an install)</li>
<li>And jetty-base (installed from idp-jetty-base)
<ul>
<li><tt>idp.ini</tt> has had the properties names changed as per my previous note</li>
</ul> </li>
</ul> <h2 style="margin: 10px 0 0 0; font-size: 20px; font-weight: normal; line-height: 1.500; margin: 40px 0 0 0"><a name="Discoveries" style="color: #3b73af; text-decoration: none"></a>Discoveries</h2>
<ul>
<li>The (ant) installer needs to copy <tt>logging.ini</tt> over into <tt>start.d</tt></li>
<li>adding <tt>--module=idp-backchannel</tt> to the top of the idp.ini file is sufficient to get the properties in the correct place.
<ul>
<li>This is because <tt>idp-backchannel.mod</tt> depends on <tt>idp.mod</tt></li>
<li>Worth discovering whether we can put it at the end of idp.ini as well...</li>
</ul> </li>
<li>For the purposes of today's work I took the properties out of idp.xml and hard wired the values.
<ul>
<li>We know we need to revisit this</li>
</ul> </li>
<li>At this stage things start to go pear shaped.</li>
<li><tt>jetty-ssl-context.xml</tt> now prepends <tt>$(jetty-base)</tt> to the certificate paths.
<ul>
<li>idp-backchannel.xml doesn't which is well cool</li>
<li>because in windows installs these paths default to being absolute. So we end up with paths like
<div class="code panel" style="border-width: 1px;; border: 1px solid #cccccc; background: #f5f5f5; font-size: 12px; line-height: 1.333; font-family: monospace; border: 1px solid #cccccc; -moz-border-radius: 3px 3px 3px 3px; border-radius: 3px 3px 3px 3px; margin: 9px 0">
<div class="codeContent panelContent" style="padding: 9px 12px">
<pre class="code-java" style="margin: 10px 0 0 0; margin-top: 0; max-height: 30em; overflow: auto; white-space: pre-wrap; word-wrap: normal">C:/Program Files (x86)/Shibboleth/IdP/jetty-base/C:/Program Files (x86)/Shibboleth/IdP/etc/browserfacing.p12</pre>
</div>
</div> <p style="margin: 10px 0 0 0"> and tat is never going to end well.</p></li>
</ul> </li>
<li>So the Windows installer has to take owership of <tt>jetty-ssl-context.xml</tt> to change that. Fair enugh.</li>
<li>But with that fixed Jetty will then hang indefinitely unless you specify a <tt>jetty.sslcontext.trustStorePassword</tt></li>
<li>With that bridge crossed we enter a maze of little tunnels all different, which end up with various errors like this
<div class="code panel" style="border-width: 1px;; border: 1px solid #cccccc; background: #f5f5f5; font-size: 12px; line-height: 1.333; font-family: monospace; border: 1px solid #cccccc; -moz-border-radius: 3px 3px 3px 3px; border-radius: 3px 3px 3px 3px; margin: 9px 0">
<div class="codeContent panelContent" style="padding: 9px 12px">
<pre class="code-java" style="margin: 10px 0 0 0; margin-top: 0; max-height: 30em; overflow: auto; white-space: pre-wrap; word-wrap: normal">Exception in thread <span class="code-quote" style="color: #009100">"main"</span> java.security.PrivilegedActionException: java.security.UnrecoverableKeyException:</pre>
</div>
</div>
<ul>
<li>Firstly it whines becase it cannot find the default trust store (it is defaulted to "etc\truststore" which ends up somewhere weird).</li>
<li>Specifying the same store as the keystore (as per The Fine Manual) barfs with an invalid format <tt>Get Key failed: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.</tt></li>
<li>And ISTR that we also got whines about the Keymanager</li>
</ul> </li>
<li>Given that windows has to own <tt>jetty-ssl-context.xml</tt> I looked back at the 9.3 base and removed the setting of
<ul>
<li><tt>KeyManagerPassword</tt></li>
<li><tt>TrustStorePath</tt></li>
<li><tt>TrustStorePassword</tt></li>
<li><tt>TrustStoreProvider</tt></li>
<li>and while I was at it changed the default for <tt>RenegotiationAllowed</tt> to false.</li>
</ul> </li>
<li>This makes that exception go away.</li>
<li>But I'd like to understand why this works outside the windows environment.</li>
</ul> <h2 style="margin: 10px 0 0 0; font-size: 20px; font-weight: normal; line-height: 1.500; margin: 40px 0 0 0"><a name="Theshowstopper" style="color: #3b73af; text-decoration: none"></a>The showstopper</h2> <p style="margin: 10px 0 0 0">We are still left with a killer failure which prevents the IdP from deploying. Something is eating <tt>idp.home</tt></p> <p style="margin: 10px 0 0 0">Procrun is configured to start java with this defines</p>
<div class="code panel" style="border-width: 1px;; border: 1px solid #cccccc; background: #f5f5f5; font-size: 12px; line-height: 1.333; font-family: monospace; border: 1px solid #cccccc; -moz-border-radius: 3px 3px 3px 3px; border-radius: 3px 3px 3px 3px; margin: 9px 0">
<div class="codeContent panelContent" style="padding: 9px 12px">
<pre class="code-java" style="margin: 10px 0 0 0; margin-top: 0; max-height: 30em; overflow: auto; white-space: pre-wrap; word-wrap: normal">
-Didp.home=C:/Program Files (x86)/Shibboleth/IdP
-Djava.io.tmpdir=C:/Program Files (x86)/Shibboleth/IdP/jetty-base/otmp
-XX:+UseG1GC
</pre>
</div>
</div> <p style="margin: 10px 0 0 0">And yet when we fall into <tt>net.shibboleth.idp.spring.IdPPropertiesApplicationContextInitializer</tt> <tt>idp.home</tt> is <b><em>not</em></b> set. So it goes looking for <tt>idp.properties</tt> in a well known location and dies.</p> <p style="margin: 10px 0 0 0">Of course the IdP isn't deployed so there's no logging but I have established that at this point <tt>java.io.tmpdir</tt> is set (the <tt>otmp</tt> above is the give away.</p> <p style="margin: 10px 0 0 0">So my next task is to work out why we are destroying that variable and what I can do about it.</p> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff">
<table id="actions-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px">
<tbody>
<tr>
<td id="actions-pattern-container" valign="middle" style="padding: 0px; border-collapse: collapse; padding: 10px 0 10px 24px; vertical-align: middle; padding-left: 0">
<table align="left" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td class="actions-pattern-action-icon-container" style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 0; vertical-align: middle"> <a href="https://issues.shibboleth.net/jira/browse/IDP-1110#add-comment" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none"> <img class="actions-pattern-action-icon-image" src="cid:jira-generated-image-static-comment-icon-04cdc41a-40c4-4bb1-93ca-4380fd60a992" alt="Add Comment" title="Add Comment" height="16" width="16" border="0" style="vertical-align: middle"> </a> </td>
<td class="actions-pattern-action-text-container" style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 4px; padding-left: 5px"> <a href="https://issues.shibboleth.net/jira/browse/IDP-1110#add-comment" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none">Add Comment</a> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table> </td>
</tr>
<!-- there needs to be content in the cell for it to render in some clients -->
<tr>
<td class="email-content-rounded-bottom mobile-expand" style="padding: 0px; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 5px; line-height: 5px; background-color: #ffffff; border-top: 0; border-left: 1px solid #cccccc; border-bottom: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom-right-radius: 5px; border-bottom-left-radius: 5px; mso-line-height-rule: exactly" height="5" bgcolor="#ffffff"> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="footer-pattern" style="padding: 0px; border-collapse: collapse; padding: 12px 20px">
<table id="footer-pattern-container" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td id="footer-pattern-text" class="mobile-resize-text" width="100%" style="padding: 0px; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px"> This message was sent by Atlassian JIRA <span id="footer-build-information">(v7.4.2#74004-<span title="586975da6d5c632f4f0de24a42c40182e6b9ead0" data-commit-id="586975da6d5c632f4f0de24a42c40182e6b9ead0}">sha1:586975d</span>)</span> </td>
<td id="footer-pattern-logo-desktop-container" valign="top" style="padding: 0px; border-collapse: collapse; padding-left: 20px; vertical-align: top">
<table style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td id="footer-pattern-logo-desktop-padding" style="padding: 0px; border-collapse: collapse; padding-top: 3px"> <img id="footer-pattern-logo-desktop" src="cid:jira-generated-image-static-footer-desktop-logo-de397c22-66c2-4170-897b-11862873b9cd" alt="Atlassian logo" title="Atlassian logo" width="169" height="36" class="image_fix"> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table>
</body>
</html>