stumped on a expected [controlFlag] error - IDP Login
Oleg Chaikovsky
oleg.chaikovsky at aegisidentity.com
Sun Jun 23 20:44:09 EDT 2013
Hello -
IdP 2.4 on RedHat Linux 6.4 and Tomcat 6.0.24. Directory LDAP is AD.
The IdP boots fine and the logs don't have any noticeable errors until I try to login (using TestShib's SP).
I am getting an "expected [controlFlag] error.
I have checked for typos, tried to reduce the login.config file to just what is needed, and I still get the same error.
The line number for the latest iteration is 10 - which points to the bindCredential.
I checked the catalina.out logfile and nothing is posted (when I make changes to the configs for IdP and restart tomcat, only restarts are listed, no errors).
I looked in the archive of the list and there is only one reference - and the OP stated there was a typo.
Any pointers would be much appreciated
login.config file -------------------------
ShibUserPassAuth {
// Example LDAP authentication
// See: https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass
edu.vt.middleware.ldap.jaas.LdapLoginModule required
ldapUrl="ldaps://compad1.WWWWW.XXXXX.pri:636"
baseDn="ou=COMP-USERS,dc=WWWWW,dc=XXXXX,dc=pri"
bindDN="shib at WWWWW.XXXXX.edu"
bindCredential="0n3ld3n+i+y";
ssl="true"
userFilter="uid={0}";
// Example Kerberos authentication, requires Sun's JVM
// See: https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass
/*
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab="true"
keyTab="/path/to/idp/keytab/file";
*/
};
----------------------------------------------------------------------------------------
IDP-PROCESS LOG OUTPUT - HANDLER AND AUTH INITIATION----------------------------------
16:40:53.888 - DEBUG [edu.internet2.middleware.shibboleth.common.config.BaseReloadableService:136] - Initializing shibboleth.HandlerManager service with resources: [/opt/shibboleth-idp/conf/handler.xml]
16:40:53.889 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:158] - Loading new configuration for service shibboleth.HandlerManager
16:40:53.904 - DEBUG [edu.internet2.middleware.shibboleth.idp.config.profile.ProfileHandlerGroupBeanDefinitionParser:50] - 1 error handler definitions found
16:40:53.905 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.JSPErrorHandlerBeanDefinitionParser:46] - Parsing configuration for JSP error handler.
16:40:53.905 - DEBUG [edu.internet2.middleware.shibboleth.idp.config.profile.ProfileHandlerGroupBeanDefinitionParser:54] - 17 profile handler definitions found
16:40:53.906 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: Status
16:40:53.907 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAMLMetadata
16:40:53.927 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: ShibbolethSSO
16:40:53.932 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML1AttributeQuery
16:40:53.936 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML1ArtifactResolution
16:40:53.939 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2SSO
16:40:53.939 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2SSO
16:40:53.940 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2SSO
16:40:53.940 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2SSO
16:40:53.942 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2ECP
16:40:53.943 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2SLO
16:40:53.944 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2SLO
16:40:53.944 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2SLO
16:40:53.945 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2SLO
16:40:53.945 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2SLO
16:40:53.946 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2AttributeQuery
16:40:53.947 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2ArtifactResolution
16:40:53.948 - DEBUG [edu.internet2.middleware.shibboleth.idp.config.profile.ProfileHandlerGroupBeanDefinitionParser:58] - 2 login handler definitions found
16:40:53.950 - DEBUG [edu.internet2.middleware.shibboleth.idp.config.profile.authn.AbstractLoginHandlerBeanDefinitionParser:44] - Parsing configuration for UsernamePassword authentication handler.
16:40:53.950 - DEBUG [edu.internet2.middleware.shibboleth.idp.config.profile.authn.AbstractLoginHandlerBeanDefinitionParser:51] - Authentication duration: 28800000ms
16:40:53.950 - DEBUG [edu.internet2.middleware.shibboleth.idp.config.profile.authn.AbstractLoginHandlerBeanDefinitionParser:60] - Authentication handler declared support for authentication method urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
16:40:53.951 - DEBUG [edu.internet2.middleware.shibboleth.idp.config.profile.authn.UsernamePasswordLoginHandlerBeanDefinitionParser:58] - Setting JAAS configuration file to: file:///opt/shibboleth-idp/conf/login.config</opt/shibboleth-idp/conf/login.config>
16:40:53.952 - DEBUG [edu.internet2.middleware.shibboleth.idp.config.profile.authn.AbstractLoginHandlerBeanDefinitionParser:44] - Parsing configuration for PreviousSession authentication handler.
16:40:53.952 - DEBUG [edu.internet2.middleware.shibboleth.idp.config.profile.authn.AbstractLoginHandlerBeanDefinitionParser:51] - Authentication duration: 1800000ms
16:40:53.952 - DEBUG [edu.internet2.middleware.shibboleth.idp.config.profile.authn.AbstractLoginHandlerBeanDefinitionParser:60] - Authentication handler declared support for authentication method urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession
IDP-PROCESS LOG OUTPUT --------------
16:42:59.864 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:150] - Redirecting to login page /login.jsp
16:43:05.192 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:170] - Attempting to authenticate user shib at WWWWW.XXXXX.edu
16:43:05.194 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:197] - User authentication for shib at WWWWW.XXXXX.edu failed
java.lang.SecurityException: Configuration Error:
Line 10: expected [controlFlag]
at com.sun.security.auth.login.ConfigFile.<init>(ConfigFile.java:110) ~[na:1.6.0_24]
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[na:1.6.0_24]
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57) ~[na:1.6.0_24]
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[na:1.6.0_24]
at java.lang.reflect.Constructor.newInstance(Constructor.java:532) ~[na:1.6.0_24]
at java.lang.Class.newInstance0(Class.java:374) ~[na:1.6.0_24]
at java.lang.Class.newInstance(Class.java:327) ~[na:1.6.0_24]
at javax.security.auth.login.Configuration$3.run(Configuration.java:264) ~[na:1.6.0_24]
at javax.security.auth.login.Configuration$3.run(Configuration.java:260) ~[na:1.6.0_24]
at java.security.AccessController.doPrivileged(Native Method) ~[na:1.6.0_24]
at javax.security.auth.login.Configuration.getConfiguration(Configuration.java:259) ~[na:1.6.0_24]
at javax.security.auth.login.LoginContext$1.run(LoginContext.java:254) ~[na:1.6.0_24]
at javax.security.auth.login.LoginContext$1.run(LoginContext.java:252) ~[na:1.6.0_24]
at java.security.AccessController.doPrivileged(Native Method) ~[na:1.6.0_24]
at javax.security.auth.login.LoginContext.init(LoginContext.java:251) ~[na:1.6.0_24]
at javax.security.auth.login.LoginContext.<init>(LoginContext.java:418) ~[na:1.6.0_24]
at edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet.authenticateUser(UsernamePasswordLoginServlet.java:174) [shibboleth-identityprovider-2.4.0.jar:na]
at edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet.service(UsernamePasswordLoginServlet.java:123) [shibboleth-identityprovider-2.4.0.jar:na]
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [tomcat6-servlet-2.5-api-6.0.24.jar:na]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina-6.0.24.jar:na]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.4.0.jar:na]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:87) [shibboleth-identityprovider-2.4.0.jar:na]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.4.0.jar:na]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [catalina-6.0.24.jar:na]
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina-6.0.24.jar:na]
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina-6.0.24.jar:na]
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [catalina-6.0.24.jar:na]
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina-6.0.24.jar:na]
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298) [catalina-6.0.24.jar:na]
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:857) [tomcat-coyote-6.0.24.jar:na]
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588) [tomcat-coyote-6.0.24.jar:na]
at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489) [tomcat-coyote-6.0.24.jar:na]
at java.lang.Thread.run(Thread.java:679) [na:1.6.0_24]
Caused by: java.io.IOException: Configuration Error:
Line 10: expected [controlFlag]
at com.sun.security.auth.login.ConfigFile.match(ConfigFile.java:567) ~[na:1.6.0_24]
at com.sun.security.auth.login.ConfigFile.parseLoginEntry(ConfigFile.java:414) ~[na:1.6.0_24]
at com.sun.security.auth.login.ConfigFile.readConfig(ConfigFile.java:383) ~[na:1.6.0_24]
at com.sun.security.auth.login.ConfigFile.init(ConfigFile.java:283) ~[na:1.6.0_24]
at com.sun.security.auth.login.ConfigFile.init(ConfigFile.java:219) ~[na:1.6.0_24]
at com.sun.security.auth.login.ConfigFile.<init>(ConfigFile.java:108) ~[na:1.6.0_24]
... 39 common frames omitted
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130624/deeedce6/attachment-0001.html
More information about the users
mailing list