kerberos problem

[xingcy]

Hi, 
  I have finished the connectiong idp2.3.3 and ldap on linux and everything is working just fine with ldap authentication using sp,now I want to trying to setup kerberos authentication. They are installed in the same computer.
  But the idp_process.log lists the error: 
   09:13:46.538 - ERROR [edu.internet2.middleware.shibboleth.common.config.BaseSer
vice:188] - Configuration was not loaded for shibboleth.AttributeResolver servi
ce, error creating components.  The root cause of this error was: org.xml.sax.S
AXParseException: cvc-identity-constraint.4.3: Key 'DataConnectorAttributeDefin
itionDependencyRef' with value 'HTTP' not found for identity constraint of elem
ent 'AttributeResolver'.

   My configure file are listed below:

   attribute-resolver.xml

    <!-- Example LDAP Connector -->

    <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
        ldapURL="ldap://ldap.ihep.ac.cn"
        baseDN="ou=people,dc=ihep,dc=ac,dc=cn"
        principal="cn=root,dc=ihep,dc=ac,dc=cn"
        principalCredential="123456"
        lowercaseAttributeNames="true">
        <resolver:Dependency ref="HTTP" />
        <resolver:Dependency ref="ihep.ac.cn" />

        <dc:FilterTemplate>
            <![CDATA[
                (uid=$requestContext.principalName)(&(samaccountname=${krb_principalname.get(0)})(msSFU30NisDomain=${krb_domain.get(0)})))(objectclass=user))

            ]]>
        </dc:FilterTemplate>

    </resolver:DataConnector>

handler.xml
 <!-- Kerberos Idp -->
    <ph:LoginHandler xsi:type="krb:KERBEROS"
                  kerberosCfg="/etc/krb5.conf"
                  customUnauthorized="/usr/local/java-idp-kerberos-login-handler/examples/unauthorized.html"
    >
        <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos</ph:AuthenticationMethod>
        <krb:Realm domain="IHEP.AC.CN">
            <krb:principal>HTTP/kerberos.ihep.ac.cn at IHEP.AC.CN</krb:principal>
            <krb:keytab>/etc/http.keytab</krb:keytab>
        </krb:Realm>
    </ph:LoginHandler>

login.xml
ShibUserPassAuth {

// Example LDAP authentication
    edu.vt.middleware.ldap.jaas.LdapLoginModule required
      ldapUrl="ldap://ldap.ihep.ac.cn"
      baseDn="ou=people,dc=ihep,dc=ac,dc=cn"
      ssl="false";

  com.sun.security.auth.module.Krb5LoginModule required
      useKeyTab="true"
      keyTab="/etc/http.keytab";
};

I have added HTTP principal in kdc.
#kadmin.local 
kadmin.local:  addprinc HTTP/kerberos.ihep.ac.cn
WARNING: no policy specified for HTTP/kerberos.ihep.ac.cn at IHEP.AC.CN; defaulting to no policy
Enter password for principal "HTTP/kerberos.ihep.ac.cn at IHEP.AC.CN": 
Re-enter password for principal "HTTP/kerberos.ihep.ac.cn at IHEP.AC.CN": 
Principal "HTTP/kerberos.ihep.ac.cn at IHEP.AC.CN" created.
kadmin.local:  

# kadmin.local
Authenticating as principal HTTP/admin at IHEP.AC.CN with password.
kadmin.local:  ktadd -k /etc/http.keytab HTTP/kerberos.ihep.ac.cn
Entry for principal HTTP/kerberos.ihep.ac.cn with kvno 2, encryption type AES-256 CTS mode with 96-bit SHA-1 HMAC added to keytab WRFILE:/etc/http.keytab.
Entry for principal HTTP/kerberos.ihep.ac.cn with kvno 2, encryption type AES-128 CTS mode with 96-bit SHA-1 HMAC added to keytab WRFILE:/etc/http.keytab.
Entry for principal HTTP/kerberos.ihep.ac.cn with kvno 2, encryption type Triple DES cbc mode with HMAC/sha1 added to keytab WRFILE:/etc/http.keytab.
Entry for principal HTTP/kerberos.ihep.ac.cn with kvno 2, encryption type ArcFour with HMAC/md5 added to keytab WRFILE:/etc/http.keytab.
Entry for principal HTTP/kerberos.ihep.ac.cn with kvno 2, encryption type DES with HMAC/sha1 added to keytab WRFILE:/etc/http.keytab.
Entry for principal HTTP/kerberos.ihep.ac.cn with kvno 2, encryption type DES cbc mode with RSA-MD5 added to keytab WRFILE:/etc/http.keytab.
kadmin.local: 

Anyone has experience on idp connection kerberos, Please give me some advise about it.
thank you very much!

Best Regards.
xingcy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120509/2f74799c/attachment-0001.html