stumped on a expected [controlFlag] error - IDP Login
Nate Klingenstein
ndk at internet2.edu
Sun Jun 23 21:16:21 EDT 2013
Oleg,
You have an extra ; after bindCredential. Try taking that out.
Thanks,
Nate.
On Jun 24, 2013, at 0:44 , Oleg Chaikovsky wrote:
> Hello –
> IdP 2.4 on RedHat Linux 6.4 and Tomcat 6.0.24. Directory LDAP is AD.
>
> The IdP boots fine and the logs don’t have any noticeable errors until I try to login (using TestShib’s SP).
> I am getting an “expected [controlFlag] error.
>
> I have checked for typos, tried to reduce the login.config file to just what is needed, and I still get the same error.
>
> The line number for the latest iteration is 10 – which points to the bindCredential.
>
> I checked the catalina.out logfile and nothing is posted (when I make changes to the configs for IdP and restart tomcat, only restarts are listed, no errors).
>
> I looked in the archive of the list and there is only one reference – and the OP stated there was a typo.
>
> Any pointers would be much appreciated
>
>
> login.config file -------------------------
> ShibUserPassAuth {
>
> // Example LDAP authentication
> // See: https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass
>
> edu.vt.middleware.ldap.jaas.LdapLoginModule required
> ldapUrl="ldaps://compad1.WWWWW.XXXXX.pri:636"
> baseDn="ou=COMP-USERS,dc=WWWWW,dc=XXXXX,dc=pri"
> bindDN="shib at WWWWW.XXXXX.edu"
> bindCredential="0n3ld3n+i+y";
> ssl="true"
> userFilter="uid={0}";
>
>
>
> // Example Kerberos authentication, requires Sun's JVM
> // See: https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass
> /*
> com.sun.security.auth.module.Krb5LoginModule required
> useKeyTab="true"
> keyTab="/path/to/idp/keytab/file";
> */
>
> };
> ----------------------------------------------------------------------------------------
>
> IDP-PROCESS LOG OUTPUT – HANDLER AND AUTH INITIATION----------------------------------
> 16:40:53.888 - DEBUG [edu.internet2.middleware.shibboleth.common.config.BaseReloadableService:136] - Initializing shibboleth.HandlerManager service with resources: [/opt/shibboleth-idp/conf/handler.xml]
> 16:40:53.889 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:158] - Loading new configuration for service shibboleth.HandlerManager
> 16:40:53.904 - DEBUG [edu.internet2.middleware.shibboleth.idp.config.profile.ProfileHandlerGroupBeanDefinitionParser:50] - 1 error handler definitions found
> 16:40:53.905 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.JSPErrorHandlerBeanDefinitionParser:46] - Parsing configuration for JSP error handler.
> 16:40:53.905 - DEBUG [edu.internet2.middleware.shibboleth.idp.config.profile.ProfileHandlerGroupBeanDefinitionParser:54] - 17 profile handler definitions found
> 16:40:53.906 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: Status
> 16:40:53.907 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAMLMetadata
> 16:40:53.927 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: ShibbolethSSO
> 16:40:53.932 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML1AttributeQuery
> 16:40:53.936 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML1ArtifactResolution
> 16:40:53.939 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2SSO
> 16:40:53.939 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2SSO
> 16:40:53.940 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2SSO
> 16:40:53.940 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2SSO
> 16:40:53.942 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2ECP
> 16:40:53.943 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2SLO
> 16:40:53.944 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2SLO
> 16:40:53.944 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2SLO
> 16:40:53.945 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2SLO
> 16:40:53.945 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2SLO
> 16:40:53.946 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2AttributeQuery
> 16:40:53.947 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:43] - Parsing configuration for profile handler: SAML2ArtifactResolution
> 16:40:53.948 - DEBUG [edu.internet2.middleware.shibboleth.idp.config.profile.ProfileHandlerGroupBeanDefinitionParser:58] - 2 login handler definitions found
> 16:40:53.950 - DEBUG [edu.internet2.middleware.shibboleth.idp.config.profile.authn.AbstractLoginHandlerBeanDefinitionParser:44] - Parsing configuration for UsernamePassword authentication handler.
> 16:40:53.950 - DEBUG [edu.internet2.middleware.shibboleth.idp.config.profile.authn.AbstractLoginHandlerBeanDefinitionParser:51] - Authentication duration: 28800000ms
> 16:40:53.950 - DEBUG [edu.internet2.middleware.shibboleth.idp.config.profile.authn.AbstractLoginHandlerBeanDefinitionParser:60] - Authentication handler declared support for authentication method urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
> 16:40:53.951 - DEBUG [edu.internet2.middleware.shibboleth.idp.config.profile.authn.UsernamePasswordLoginHandlerBeanDefinitionParser:58] - Setting JAAS configuration file to: file:///opt/shibboleth-idp/conf/login.config
> 16:40:53.952 - DEBUG [edu.internet2.middleware.shibboleth.idp.config.profile.authn.AbstractLoginHandlerBeanDefinitionParser:44] - Parsing configuration for PreviousSession authentication handler.
> 16:40:53.952 - DEBUG [edu.internet2.middleware.shibboleth.idp.config.profile.authn.AbstractLoginHandlerBeanDefinitionParser:51] - Authentication duration: 1800000ms
> 16:40:53.952 - DEBUG [edu.internet2.middleware.shibboleth.idp.config.profile.authn.AbstractLoginHandlerBeanDefinitionParser:60] - Authentication handler declared support for authentication method urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession
>
> IDP-PROCESS LOG OUTPUT --------------
> 16:42:59.864 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:150] - Redirecting to login page /login.jsp
> 16:43:05.192 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:170] - Attempting to authenticate user shib at WWWWW.XXXXX.edu
> 16:43:05.194 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:197] - User authentication for shib at WWWWW.XXXXX.edu failed
> java.lang.SecurityException: Configuration Error:
> Line 10: expected [controlFlag]
> at com.sun.security.auth.login.ConfigFile.<init>(ConfigFile.java:110) ~[na:1.6.0_24]
> at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[na:1.6.0_24]
> at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57) ~[na:1.6.0_24]
> at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[na:1.6.0_24]
> at java.lang.reflect.Constructor.newInstance(Constructor.java:532) ~[na:1.6.0_24]
> at java.lang.Class.newInstance0(Class.java:374) ~[na:1.6.0_24]
> at java.lang.Class.newInstance(Class.java:327) ~[na:1.6.0_24]
> at javax.security.auth.login.Configuration$3.run(Configuration.java:264) ~[na:1.6.0_24]
> at javax.security.auth.login.Configuration$3.run(Configuration.java:260) ~[na:1.6.0_24]
> at java.security.AccessController.doPrivileged(Native Method) ~[na:1.6.0_24]
> at javax.security.auth.login.Configuration.getConfiguration(Configuration.java:259) ~[na:1.6.0_24]
> at javax.security.auth.login.LoginContext$1.run(LoginContext.java:254) ~[na:1.6.0_24]
> at javax.security.auth.login.LoginContext$1.run(LoginContext.java:252) ~[na:1.6.0_24]
> at java.security.AccessController.doPrivileged(Native Method) ~[na:1.6.0_24]
> at javax.security.auth.login.LoginContext.init(LoginContext.java:251) ~[na:1.6.0_24]
> at javax.security.auth.login.LoginContext.<init>(LoginContext.java:418) ~[na:1.6.0_24]
> at edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet.authenticateUser(UsernamePasswordLoginServlet.java:174) [shibboleth-identityprovider-2.4.0.jar:na]
> at edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet.service(UsernamePasswordLoginServlet.java:123) [shibboleth-identityprovider-2.4.0.jar:na]
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [tomcat6-servlet-2.5-api-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.4.0.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:87) [shibboleth-identityprovider-2.4.0.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.4.0.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina-6.0.24.jar:na]
> at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [catalina-6.0.24.jar:na]
> at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina-6.0.24.jar:na]
> at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298) [catalina-6.0.24.jar:na]
> at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:857) [tomcat-coyote-6.0.24.jar:na]
> at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588) [tomcat-coyote-6.0.24.jar:na]
> at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489) [tomcat-coyote-6.0.24.jar:na]
> at java.lang.Thread.run(Thread.java:679) [na:1.6.0_24]
> Caused by: java.io.IOException: Configuration Error:
> Line 10: expected [controlFlag]
> at com.sun.security.auth.login.ConfigFile.match(ConfigFile.java:567) ~[na:1.6.0_24]
> at com.sun.security.auth.login.ConfigFile.parseLoginEntry(ConfigFile.java:414) ~[na:1.6.0_24]
> at com.sun.security.auth.login.ConfigFile.readConfig(ConfigFile.java:383) ~[na:1.6.0_24]
> at com.sun.security.auth.login.ConfigFile.init(ConfigFile.java:283) ~[na:1.6.0_24]
> at com.sun.security.auth.login.ConfigFile.init(ConfigFile.java:219) ~[na:1.6.0_24]
> at com.sun.security.auth.login.ConfigFile.<init>(ConfigFile.java:108) ~[na:1.6.0_24]
> ... 39 common frames omitted
>
>
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
More information about the users
mailing list