Announce: Database Backed Storage Service

Thu Oct 3 15:02:49 EDT 2013

Paul,

Looks like I found another minor glitch with using your storage service and Oracle. It's with an item you're using that doesn't seem to be supported by the Oracle10gDialect.

Stack trace follows; doubt you need more than the first line to see the issue.

Hopefully, this is an easy one to work around? Installation was a piece of cake, and things were going great until I encountered this.

I also discovered, though you probably already know this, that when using a container-based database connection, aacli.sh obviously dumps out an ugly error before returning the attributes. Seems like another good reason for a parallel $IDP_HOME/conf dir for use with aacli.sh, one with an internal.xml that uses the standard storage service instead of the database-backed one if one chooses to take the container-managed route.

Keith
org.hibernate.MappingException: Dialect does not support identity key generation
	at org.hibernate.dialect.Dialect.getIdentitySelectString(Dialect.java:526) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.dialect.Dialect.getIdentitySelectString(Dialect.java:515) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.persister.entity.AbstractEntityPersister.getIdentitySelectString(AbstractEntityPersister.java:2163) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.id.IdentityGenerator$BasicDelegate.getSelectSQL(IdentityGenerator.java:150) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.id.insert.AbstractSelectingDelegate.performInsert(AbstractSelectingDelegate.java:48) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.persister.entity.AbstractEntityPersister.insert(AbstractEntityPersister.java:2158) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.persister.entity.AbstractEntityPersister.insert(AbstractEntityPersister.java:2638) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.action.EntityIdentityInsertAction.execute(EntityIdentityInsertAction.java:48) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.engine.ActionQueue.execute(ActionQueue.java:250) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.event.def.AbstractSaveEventListener.performSaveOrReplicate(AbstractSaveEventListener.java:298) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.event.def.AbstractSaveEventListener.performSave(AbstractSaveEventListener.java:181) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.event.def.AbstractSaveEventListener.saveWithGeneratedId(AbstractSaveEventListener.java:107) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.event.def.DefaultMergeEventListener.entityIsTransient(DefaultMergeEventListener.java:186) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.event.def.DefaultMergeEventListener.onMerge(DefaultMergeEventListener.java:123) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.event.def.DefaultMergeEventListener.onMerge(DefaultMergeEventListener.java:53) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.impl.SessionImpl.fireMerge(SessionImpl.java:677) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.impl.SessionImpl.merge(SessionImpl.java:661) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.impl.SessionImpl.merge(SessionImpl.java:665) ~[hibernate3.jar:3.2.5.ga]
	at net.clareitysecurity.shibboleth.db.SessionObjectDAOImpl.putSession(SessionObjectDAOImpl.java:119) ~[db-storage-service-1.1.0.jar:na]
	at net.clareitysecurity.shibboleth.storage.DbStorageService.put(DbStorageService.java:374) [db-storage-service-1.1.0.jar:na]
	at edu.internet2.middleware.shibboleth.idp.session.impl.SessionManagerImpl.indexSession(SessionManagerImpl.java:172) [shibboleth-identityprovider-2.4.0.jar:na]
	at edu.internet2.middleware.shibboleth.idp.session.impl.SessionManagerImpl.indexSession(SessionManagerImpl.java:33) [shibboleth-identityprovider-2.4.0.jar:na]
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.completeAuthenticationRequest(SSOProfileHandler.java:332) [shibboleth-identityprovider-2.4.0.jar:na]
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:173) [shibboleth-identityprovider-2.4.0.jar:na]
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90) [shibboleth-identityprovider-2.4.0.jar:na]
	at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83) [shibboleth-common-1.4.0.jar:na]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [servlet-api.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:na]
	at net.clareitysecurity.shibboleth.storage.ClusterFilter.doFilter(ClusterFilter.java:95) [db-storage-service-1.1.0.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:na]
	at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.4.0.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:na]
	at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:87) [shibboleth-identityprovider-2.4.0.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:na]
	at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.4.0.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:na]
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [catalina.jar:na]
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina.jar:na]
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) [catalina.jar:na]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [catalina.jar:na]
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina.jar:na]
	at org.terracotta.modules.tomcat.tomcat_5_5.SessionValve55.invoke(SessionValve55.java:87) [na:na]
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293) [catalina.jar:na]
	at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) [tomcat-coyote.jar:na]
	at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:291) [tomcat-coyote.jar:na]
	at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:769) [tomcat-coyote.jar:na]
	at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:698) [tomcat-coyote.jar:na]
	at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:891) [tomcat-coyote.jar:na]
	at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) [tomcat-coyote.jar:na]
	at java.lang.Thread.run(Thread.java:662) [na:1.6.0_45]
13:42:45.048 - INFO [Shibboleth-Audit:1028] [session=25791d823f99930de8b09a04042e1192826227054263f616bb1ffed40bcff7cc] - 20131003T184245Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_cba5f73a601da73f77e725c879c8bce4|https://shib-sp-dev.cites.illinois.edu/shibboleth|urn:mace:shibboleth:2.0:profiles:saml2:sso|urn:mace:incommon:test.uiuc.edu|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_9d0047f5717b81913971815a0e830fce|kwessel|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|uid,eduPersonAffiliation,eduPersonPrincipalName,organizationName,eduPersonScopedAffiliation,givenName,eduPersonNickname,uiucEduSource,eduPersonOrgDN,sAMAccountName,eduPersonEntitlement,mail,sn,transientId,eduPersonTargetedID,uiucEduType,uiucEduUIN,displayName,|_07d9ed4bdf686cc70f7c2dfdce9110aa||
13:42:45.107 - ERROR [net.clareitysecurity.shibboleth.db.SessionObjectDAOImpl:154] [session=25791d823f99930de8b09a04042e1192826227054263f616bb1ffed40bcff7cc] - Exception while saving session information to database.
13:42:45.109 - ERROR [net.clareitysecurity.shibboleth.db.SessionObjectDAOImpl:155] [session=25791d823f99930de8b09a04042e1192826227054263f616bb1ffed40bcff7cc] - 
org.hibernate.MappingException: Dialect does not support identity key generation
	at org.hibernate.dialect.Dialect.getIdentitySelectString(Dialect.java:526) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.dialect.Dialect.getIdentitySelectString(Dialect.java:515) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.persister.entity.AbstractEntityPersister.getIdentitySelectString(AbstractEntityPersister.java:2163) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.id.IdentityGenerator$BasicDelegate.getSelectSQL(IdentityGenerator.java:150) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.id.insert.AbstractSelectingDelegate.performInsert(AbstractSelectingDelegate.java:48) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.persister.entity.AbstractEntityPersister.insert(AbstractEntityPersister.java:2158) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.persister.entity.AbstractEntityPersister.insert(AbstractEntityPersister.java:2638) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.action.EntityIdentityInsertAction.execute(EntityIdentityInsertAction.java:48) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.engine.ActionQueue.execute(ActionQueue.java:250) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.event.def.AbstractSaveEventListener.performSaveOrReplicate(AbstractSaveEventListener.java:298) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.event.def.AbstractSaveEventListener.performSave(AbstractSaveEventListener.java:181) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.event.def.AbstractSaveEventListener.saveWithGeneratedId(AbstractSaveEventListener.java:107) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.event.def.DefaultMergeEventListener.entityIsTransient(DefaultMergeEventListener.java:186) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.event.def.DefaultMergeEventListener.onMerge(DefaultMergeEventListener.java:123) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.event.def.DefaultMergeEventListener.onMerge(DefaultMergeEventListener.java:53) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.impl.SessionImpl.fireMerge(SessionImpl.java:677) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.impl.SessionImpl.merge(SessionImpl.java:661) ~[hibernate3.jar:3.2.5.ga]
	at org.hibernate.impl.SessionImpl.merge(SessionImpl.java:665) ~[hibernate3.jar:3.2.5.ga]
	at net.clareitysecurity.shibboleth.db.SessionObjectDAOImpl.putSession(SessionObjectDAOImpl.java:91) ~[db-storage-service-1.1.0.jar:na]
	at net.clareitysecurity.shibboleth.storage.DbStorageService.put(DbStorageService.java:362) [db-storage-service-1.1.0.jar:na]
	at net.clareitysecurity.shibboleth.storage.ClusterFilter.doFilter(ClusterFilter.java:116) [db-storage-service-1.1.0.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:na]
	at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.4.0.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:na]
	at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:87) [shibboleth-identityprovider-2.4.0.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:na]
	at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.4.0.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:na]
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [catalina.jar:na]
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina.jar:na]
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) [catalina.jar:na]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [catalina.jar:na]
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina.jar:na]
	at org.terracotta.modules.tomcat.tomcat_5_5.SessionValve55.invoke(SessionValve55.java:87) [na:na]
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293) [catalina.jar:na]
	at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) [tomcat-coyote.jar:na]
	at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:291) [tomcat-coyote.jar:na]
	at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:769) [tomcat-coyote.jar:na]
	at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:698) [tomcat-coyote.jar:na]
	at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:891) [tomcat-coyote.jar:na]
	at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) [tomcat-coyote.jar:na]
	at java.lang.Thread.run(Thread.java:662) [na:1.6.0_45]

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Paul Hethmon
Sent: Tuesday, August 27, 2013 9:30 AM
To: Shibboleth Users
Subject: Announce: Database Backed Storage Service

I finally got my database backed storage service packaged up for public release:

https://wiki.shibboleth.net/confluence/display/SHIB2/Database+Backed+Storage+Service

That page hopefully gives all the information needed to get it running. A few key points:

1. It uses Hibernate for the data access layer, but I have only connected it to MySQL.
2. The build script is Ant based which means dependencies will be a pain. I do have a goal to switch it to Maven, but don't hold your breath.
3. There is a binary distribution in the Subversion repository. Java 6.
4. I run a lot of copies of the IdP in my job that are logically distinct. You will see that the storage service requires a constructor argument to let it know which bucket to place the sessions. What you use does not matter. Only sessions with the same key are considered to be in the same logical group.
5. The code will hide ALL database failures. The idea was that a database failure would not prevent a user from logging in. It might require them to re-authenticate, but they will be able to login.

Please let me know what I forgot in the documentation, either on this list or direct is fine.

thanks,

Paul