No such file or directory Error (ShibIdP 2.3.6 on Server 2008 R2)

[Austin Lin]

Hi,

I am getting the same error (No such file or directory) when trying to authenticate via LDAP to TestShib, I have included the log entry for the error as well as the relevant sections of login.config, handler.xml, and attribute-resolver.xml. Any help would be greatly appreciated. Shib (shibboleth-identityprovider-2.3.6.msi) is running on Windows Server 2008 R2 (64 bit).

Thanks,

Austin Lin
Lake Forest High School Technology


15:15:31.797 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:197] - User authentication for the-user-name failed
java.lang.SecurityException: Configuration Error:
        No such file or directory
        at com.sun.security.auth.login.ConfigFile.<init>(Unknown Source) ~[na:1.7.0_04]
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[na:1.7.0_04]
        at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source) ~[na:1.7.0_04]
        at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source) ~[na:1.7.0_04]
        at java.lang.reflect.Constructor.newInstance(Unknown Source) ~[na:1.7.0_04]
        at java.lang.Class.newInstance0(Unknown Source) ~[na:1.7.0_04]
        at java.lang.Class.newInstance(Unknown Source) ~[na:1.7.0_04]
        at javax.security.auth.login.Configuration$3.run(Unknown Source) ~[na:1.7.0_04]
        at javax.security.auth.login.Configuration$3.run(Unknown Source) ~[na:1.7.0_04]
        at java.security.AccessController.doPrivileged(Native Method) ~[na:1.7.0_04]
        at javax.security.auth.login.Configuration.getConfiguration(Unknown Source) ~[na:1.7.0_04]
        at javax.security.auth.login.LoginContext$1.run(Unknown Source) ~[na:1.7.0_04]
        at javax.security.auth.login.LoginContext$1.run(Unknown Source) ~[na:1.7.0_04]
        at java.security.AccessController.doPrivileged(Native Method) ~[na:1.7.0_04]
        at javax.security.auth.login.LoginContext.init(Unknown Source) ~[na:1.7.0_04]
        at javax.security.auth.login.LoginContext.<init>(Unknown Source) ~[na:1.7.0_04]
        at edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet.authenticateUser(UsernamePasswordLoginServlet.java:174) [shibboleth-identityprovider-2.3.6.jar:na]
        at edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet.service(UsernamePasswordLoginServlet.java:123) [shibboleth-identityprovider-2.3.6.jar:na]
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [servlet-api.jar:na]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina.jar:6.0.32]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.32]
        at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.3.6.jar:na]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.32]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.32]
        at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:81) [shibboleth-identityprovider-2.3.6.jar:na]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.32]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.32]
        at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.3.5.jar:na]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.32]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.32]
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233) [catalina.jar:6.0.32]
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina.jar:6.0.32]
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina.jar:6.0.32]
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [catalina.jar:6.0.32]
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina.jar:6.0.32]
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298) [catalina.jar:6.0.32]
        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859) [tomcat-coyote.jar:6.0.32]
        at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588) [tomcat-coyote.jar:6.0.32]
        at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489) [tomcat-coyote.jar:6.0.32]
        at java.lang.Thread.run(Unknown Source) [na:1.7.0_04]
Caused by: java.io.IOException: Configuration Error:
        No such file or directory
        at com.sun.security.auth.login.ConfigFile.init(Unknown Source) ~[na:1.7.0_04]
        at com.sun.security.auth.login.ConfigFile.init(Unknown Source) ~[na:1.7.0_04]
        ... 40 common frames omitted


login.config (for MS Active Directory):

ShibUserPassAuth {

// Example LDAP authentication
// See: https://spaces.internet2.edu/display/SHIB2/IdPAuthUserPass

   edu.vt.middleware.ldap.jaas.LdapLoginModule required
      host="hdc1.lfschools.net"
      port="389"
      base="OU=Users,OU=D115,DC=lfschools,DC=net"
      serviceCredential="strong-password"
      userRoleAttribute="sAMAccountName"
      // serviceUser="the-service-account at lfschools.net"
      serviceUser="CN=Service Account,CN=Users,DC=lfschools,DC=net"
      subtreeSearch="true"
      userField="sAMAccountName";

// Example Kerberos authentication, requires Sun's JVM
// See: https://spaces.internet2.edu/display/SHIB2/IdPAuthUserPass
/*
   com.sun.security.auth.module.Krb5LoginModule required
      useKeyTab="true"
      keyTab="/path/to/idp/keytab/file";
*/

};

handler.xml (login handlers):

 <ph:LoginHandler xsi:type="ph:UsernamePassword" 
                  jaasConfigurationLocation="file://C:\Internet2\Shib2Idp/conf/login.config">
        <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod>
        <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</ph:AuthenticationMethod>
    </ph:LoginHandler>

    <ph:LoginHandler xsi:type="ph:PreviousSession">
        <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession</ph:AuthenticationMethod>
    </ph:LoginHandler>

attribute-resolver.xml (ldap data connector):

<resolver:DataConnector id="myLDAP" xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc" 
        useStartTLS="false"
        ldapURL="ldap://hdc1.lfschools.net:389" baseDN="OU=Users,OU=D115,DC=lfschools,DC=net" principal="the-service-account at lfschools.net"
        principalCredential="strong-password">
        <FilterTemplate>
            <![CDATA[
                (sAMAccountName=$requestContext.principalName)
            ]]>
        </FilterTemplate>

        <!-- We rely on the uniqueness of the objectSid.  But it is binary so we *must* make it so -->
        <LDAPProperty name="java.naming.ldap.attributes.binary" value="objectSid"/>
        <!-- If we are following from the GC we need thus on -->
        <LDAPProperty name="java.naming.referral" value="follow"/>

    </resolver:DataConnector>