Problem with IdP startup

[Hancock Jr, Denis C.]

Actually, this WAS our production IdP, but since a backup IdP running a recent version has taken over, we now have an opportunity to update it to the latest code.

I noticed the unfamiliar port, but we did nothing to the tomcat configuration.  I wonder why stopping and attempting to restart would cause it to start on a new port?  If port 8009 were somehow blocked, would tomcat attempt to start on another port?

I went to the tomcat conf directory, and the server.xml file did, indeed, showed the 9799 port for ajp13.  This gives me some useful clues for further troubleshooting.

At this point, I am more interested in finding out why this happened.

--
Denis C. Hancock, Jr.
System Administrator (Expert)
Division of IT, Research Support Computing
The Univerity of Missouri, Columbia


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, February 22, 2012 12:09 PM
To: Shib Users
Subject: RE: Problem with IdP startup

> A problem with starting IdP version 2.0.0 has emerged.

Please refer to the list of security advisories if you're still running something that old.

> Following a
> modification to release the Common Name (cn) attribute, the IdP failed to
> start up completely.

Neither AJP nor any non-Java web server are part of the IdP or influence it's startup.

> The catalina.out log seems to indicate a successful start with many INFO
> entries along with a few WARN entries, mostly relating to deprecated syntax.
> These involve ch.qos.logback.*.  The final lines indicate that Coyote is starting
> on port 8080 and ajp13 is listening on port 9799.  JK is running and the server
> startup took 46200 ms.  Seems OK to my eyes....

AJP doesn't run on that port unless you put it there.

> After attempting to connect to the IdP, the apache ssl log notes that an AJP
> connection was refused on port 8009.  the next line says that
> ap_proxy_connect_backend has disabled the worker for the backend.

And that is the normal port, so I don't know why you changed it in Tomcat, but you certainly can't change it in one spot only.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net