Error on Quick Install MSI for IDP.

[Chad La Joie]

The error means that the attribute resolver has a data connector
attempting to connect to an LDAP server via TLS and that your LDAP
server is using a certificate that can not be verified.  So, my guess
would be that the LDAP server is using a cert that is not signed by a
CA that is trusted.  The documentation for the LDAP data connector
tells you how to import the cert data for your server.

On Wed, May 30, 2012 at 11:10 AM, Kanuch, Andy <Andy.Kanuch at sdstate.edu> wrote:
> Good Morning,
>
>
>
> I’m new to the mailing list, and aside from a brief two-day training course,
> new to Shibboleth as well! I’m having an error I cannot resolve. I’ve
> checked the logs, and cross referenced what  they say with the Common Errors
> list, and also the Mail Archives, but I haven’t found anything quite like
> what I’m seeing. (Not much luck with google, either.)
>
>
>
>
>
> When I test the installation (deployed from the QuickInstall MSI), I am able
> to pull up the tomcat page, (https://localhost), but I am unable to pull up
> the IDP page (https://localhost/idp/status).
>
>
>
>
>
> Some environment  specific details: Our IDP is running in 64 bit Windows
> Server 2008, with JRE 7, and our LDAP server is an Active Directory Domain
> controller set to run as a Global Catalog server.
>
>
>
> My Tomcat log reveals the following errors:
>
>
>
> SEVERE: Exception sending context initialized event to listener instance of
> class org.springframework.web.context.ContextLoaderListener
>
> org.springframework.beans.factory.BeanCreationException: Error creating bean
> with name 'shibboleth.AttributeResolver': Invocation of init method failed;
> nested exception is
> edu.internet2.middleware.shibboleth.common.service.ServiceException:
> Configuration was not loaded for shibboleth.AttributeResolver service, error
> creating components.
>
>                 at
> org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1338)…
>
> (Continues on to list many more lines, and then…)
>
>
>
> Caused by:
> edu.internet2.middleware.shibboleth.common.service.ServiceException:
> Configuration was not loaded for shibboleth.AttributeResolver service, error
> creating components.
>
>                 at
> edu.internet2.middleware.shibboleth.common.config.BaseService.loadContext(BaseService.java:192)
>
> (Continues on to list many more lines, and then…)
>
>
>
> Caused by:
> edu.internet2.middleware.shibboleth.common.attribute.resolver.AttributeResolutionException:
> Unable to retrieve LDAP connection
>
>                 at
> edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapPoolEmptyStrategy.initialize(LdapPoolEmptyStrategy.java:67)
>
>
>
> My IDP Process log reveals the following errors:
>
>
>
> ERROR [edu.vt.middleware.ldap.handler.TlsConnectionHandler:228] - Could not
> negotiate TLS connection
>
> javax.net.ssl.SSLHandshakeException:
> sun.security.validator.ValidatorException: PKIX path building failed:
> sun.security.provider.certpath.SunCertPathBuilderException: unable to find
> valid certification path to requested target
>
>                 at sun.security.ssl.Alerts.getSSLException(Unknown Source)
> ~[na:1.7.0_04]
>
> (Continues on to list many more lines, and then…)
>
> Caused by: sun.security.validator.ValidatorException: PKIX path building
> failed: sun.security.provider.certpath.SunCertPathBuilderException: unable
> to find valid certification path to requested target
>
>
>
>
>
>
>
> What I’ve done so far:
>
>
>
> 1.       Moved the server to the same VLAN as the LDAP server.
>
> 2.       Tested with domain admin level credentials for connection.
>
> 3.       Used LDP.exe to verify I can successfully connect and authenticate
> to the LDAP server from the IDP.
>
>
>
> I haven’t installed a commercially signed certificate yet because according
> to the quick install instructions I shouldn’t need to in order to see the
> status page. But I would guess that my problem has to do with either java,
> or tomcat having the appropriate certificate.  But I know very little about
> Java.
>
>
>
> Any suggestions?
>
>
>
>
>
> Thank you for your time!
>
>
>
> Andy
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered