Deploy Shib2 IdP in Glassfish 3

[Farrukh Najmi]

On 06/19/2013 11:36 AM, Farrukh Najmi wrote:
...
>
>   * I found a workaround in the following resource:
>
>     http://metro.1045641.n5.nabble.com/Xerces-Xalan-not-playing-nice-with-Glassfish-Metro-td1061800.html
>
>     The workaround was to edit the
>     /home/najmi/glassfish3/glassfish/domains/domain1/lib/xercesImpl-2.10.0.jar
>     file to rename the folder /META-INF/service to /META-ING/servicessaved
>
>     I did the rename using Archive Manager in Ubuntu Linux so I did
>     not have to extract and repackage the jar, though any other means
>     including extracting the jar renaming in filesystem and recreating
>     the jar is fine.
>
>     Above makes sure that the classes of this jar are not used as
>     plugins by JAXP layer and do not confuse the ClassLoader.
>
>   * I then redeployed the idp using the asadmin command:
>
>     ~/glassfish3/bin/asadmin deploy --force=true --contextroot idp
>     --precompilejsp=false --verify=false --upload=false
>     /home/najmi/shibboleth/shibboleth-identityprovider-2.4.0/installation/war/idp.war
>
>
>     This time deployment went fine (no errors).
>
>
....
>
> I will plug away at this some more and keep this thread updated. 
> Please let me know if you see me going in the weeds. Thanks very much 
> for your help.

With help from Scott and Paul Hethmon, I have managed to get my Shib 
2.4.0 IdP deployed in Glassfish 3.2.2.2 and successfully tested SAML 2 SSO.
My SP has SAML support using spring-security-saml2. Both my SP and IdP 
are deployed in the same Glassfish domain.

One of the issues I ran into was the "PKIX validation of signature 
failed" error on my SP side. I fixed this using help from following 
spring-security-saml thread:

http://forum.springsource.org/archive/index.php/t-120198.html

I then got the same "PKIX validation of signature failed" error on the 
IdP side. This was because the IdP was using cached SP metadata with old 
KeyInfo for the SP. I edited the SP's metadata file manually (was under 
metadata directory of my installation directory for IdP) and restarted 
the Glassfish domain. EVery looked good with SSO after that!

Scott, would you like me to contribute a wiki page named 
IdPGTlassfish3Prepare on Glassfish Deployment of Idp and link it from 
the page:

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPInstall

?

If so, please tell me how I can get edit access. Thank you for all the 
terrific help. Shibboleth rock!

-- 
Regards,
Farrukh Najmi

Web: http://www.wellfleetsoftware.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130620/2858e715/attachment.html