algorithm URI was invalid: http://www.w3.org/2001/04/xmlenc#aes128-cbc

[Brent Putman]

Ah! Ok, that would explain everything perfectly.  Since you weren't
seeing the particular log line I mentioned earlier, the error then had
to be from the Java crypto KeyGenerator unable to generate an instance
for algorithm "AES" (in order words, not Apache Santuario).

Typo-ing java.ext.dirs would mean that those jars don't get loaded, and
(assuming Oracle's Java ) one of those just happens to be the jar for
the Security provider "SunJCE", which supports the symmetric ciphers and
keys, HMAC, etc.  That includes support for the AES block cipher.  

The reason other crypto ops like signing with asymmetric keys and
algorithms as well message digests (e.g. SHA-1, RSA, etc) were working
is that for historical reasons the provider jars for those aren't
treated like "extensions" but are rather part of the core platform and
are located within jars directly within /lib (probably rt.jar IIRC).

So that was a weird one! :-)

--Brent


On 9/27/13 3:52 PM, Joy Veronneau wrote:
> I had:
>
> JAVA_OPTS="-noverify -Djava.ext.dirs=$JAVA_HOME/*jre/*lib/ext -server  "
>
> but should have had:
>
> JAVA_OPTS="-noverify -Djava.ext.dirs=$JAVA_HOME/lib/ext -server  "
>
> Joy
>
> On Sep 27, 2013, at 3:35 PM, "Cantor, Scott" <cantor.2 at osu.edu
> <mailto:cantor.2 at osu.edu>>
>  wrote:
>
>> On 9/27/13 3:24 PM, "Joy Veronneau" <jv11 at cornell.edu
>> <mailto:jv11 at cornell.edu>> wrote:
>>>
>>> It's fixed. There was one java path in the tomcat config that was wrong.
>>> DOH! I swear I looked at that about 20 times. Just didn't click.
>>
>> Could you please indicate which one it was for the archives?
>>
>> -- Scott
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>> <mailto:users-unsubscribe at shibboleth.net>
>>
>
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130927/813d64a6/attachment.html