Deploy Shib2 IdP in Glassfish 3

[Farrukh Najmi]

Hi Paul,

The mechanism for endorsement in Glassfish is to place jars in the 
~/glassfish3/glassfish/lib/endorsed directory.

FWIW endorsing alone did not work for me. What was the key step was the 
renaming (or removal) of the META-INF/services directory in the 
xercesImpl-2.10.0.jar used by Glassfish. The reason is that Glassfish 
gets into ClassLoader confusion when classes mentioned in 
META-INF/services are loaded by JAXP API instead of the ones that are 
provided by the JDK. Note I did try endrosement alone without the 
META-INF/services directory hack and it gave the error:

javax.xml.stream.FactoryConfigurationError: Provider 
com.ctc.wstx.stax.WstxInputFactory not found

Lastly, I copied the xercesImpl-2.10.0.jar (with rename of 
META-ING/services directory) and xml-apis-2.10.0.jar to 
~/glassfish3/glassfish/domains/domain1/lib rather than the 
~/glassfish3/glassfish/lib/endorsed directory to limit the scope and 
impact of these jars to only my specific SP, IdP and OpenLDAP webapps in 
my Glassfish domain domain1.

BTW, see my recent message that I have successfully deployed IdP in 
Glassfish 3.2.2.2. Thanks for your kind help.


On 06/19/2013 12:00 PM, Paul Hethmon wrote:
> Farrukh,
>
> You must endorse Xerces/Xalan by whatever method Glassfish wants:
>
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPTroubleshootingCommonErrors
>
> Paul
>
> From: Farrukh Najmi <farrukh at wellfleetsoftware.com 
> <mailto:farrukh at wellfleetsoftware.com>>
> Reply-To: Shibboleth Users <users at shibboleth.net 
> <mailto:users at shibboleth.net>>
> Date: Wednesday, June 19, 2013 11:36 AM
> To: Shibboleth Users <users at shibboleth.net <mailto:users at shibboleth.net>>
> Subject: Re: Deploy Shib2 IdP in Glassfish 3
>
> What I have gathered so far is that direct use of xerces classes in 
> opensaml (and possibly IdP) is not a good fit with Glassfish which 
> expects that JAXP implementation provided by the JDK to be used. The 
> kludge / workaround I list above seems to work though I need to test 
> this further. The open question is whether Shib projects can and 
> should consider removing the explicit dependency on xerces and instead 
> rely on standard JAXP API.
>

-- 
Regards,
Farrukh Najmi

Web: http://www.wellfleetsoftware.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130620/714a12e6/attachment-0001.html