Centos IdP tomcat6 no go: shibboleth.MetadataTrustEngine error?

[Jeff Earickson]

Hi,

I went to the Baltimore Shibboleth class, missed a month of work due
to family issues, now trying to get going on my Centos IdP install,
following the Baltimore class notes.  I had the basic
tomcat6/shibboleth install working (Task 6: Test basic operation)
where "curl -k https://localhost/idp/status" would give me the IdP
status.

Then I did "yum install mod_ssl" which also added httpd/Apache.  The
reason for this was to get a real SSL certificate installed.  Now I
cannot get tomcat6 to give me output for:

curl -k https://localhost/idp/status
https://<MySpecialName>/idp/profile/Status

It says (in html output): "HTTP Status 404, The requested resource ()
is not available."  This is true even if httpd is not running, tomcat6
is running, and I get the netstat output for ports 443 and 8443 like
the class.

I find the following message in /opt/shibboleth-idp/logs/idp-process.log:

ERROR [edu.internet2.middleware.shibboleth.common.config.BaseService:188]
- Configuration was not loaded for
shibboleth.RelyingPartyConfigurationManager service, error creating
components.  The root cause of this error was:
org.springframework.beans.factory.NoSuchBeanDefinitionException: No
bean named 'shibboleth.MetadataTrustEngine' is defined

In /var/log/tomcat6/localhost*.log I find:

SEVERE: Exception sending context initialized event to listener
instance of class
org.springframework.web.context.ContextLoaderListener
org.springframework.beans.factory.BeanCreationException: Error
creating bean with name 'shibboleth.RelyingPartyConfigurationManager':
Invocation of init method failed; nested exception is
edu.internet2.middleware.shibboleth.common.service.ServiceException:
Configuration was not loaded for
shibboleth.RelyingPartyConfigurationManager service, error creating
components.

Questions:

1) So how did I frig this up?  What is wrong?
2) How do I get a real SSL cert from Incommon installed into Tomcat IdP?
3) Should I be running Apache on this system, with the real cert in
/etc/pki/tls/certs?

Jeff Earickson
Colby College