Jetty 9.3 SSL Keystore Path and SOAP Backchannel Errors

[Cantor, Scott]

On 8/18/15, 11:49 AM, "users on behalf of Domingues, Michael D" <users-bounces at shibboleth.net on behalf of michael-domingues at uiowa.edu> wrote:

>My first issue is that when I attempt to start Jetty, it logs a warning and exits immediately, indicating that a required keystore file is missing. Verbatim error message follows:

I didn't think the warning caused Jetty to exit, but maybe that's wrong.

> 
>In the meantime, this can be worked around by putting a copy of ssl.mod into JETTY_BASE/modules and removing the [files] stanza.

I just edit it in place, that's simpler than making a copy that doesn't really need to be made that might fall out of sync later. As I said I don't think it actually hurts anything, but if I'm wrong then we can note removing it.

> 
>Since net.shibboleth.utilities.jetty9.DelegateToApplicationSslContextFactory extends org.eclipse.jetty.util.ssl.SslContextFactory (where the method setIncludeCipherSuites is defined) this error ought not to occur, unless the object isn’t getting initialized properly, the parent Jetty class has changed, or some earlier exception is occurring and not getting handled.

I'm not getting that error, so I don't know what to tell you other than you can obviously change the example to suit if you have to to get farther. We've always used that method dating back to the 9.2 example, and I use it in production with V2.

Chances are there's a typo that we both must not be seeing, I'll eyeball it again.

> 
>I noticed Scott’s note on a previous version of the Jetty93 wiki page indicating that the back channel configuration was largely untested, so I suppose my question is, is this still the case?

They're entirely untested because I wrote the examples from my running copy, not the other way around, so there are bound to be typos and things. The general approach hasn't been tested with the IdP, I only tested that Jetty was running with the IdP loaded and that the ports were behaving properly.

> If not, is there something that I’m missing, or did the Jetty SSL refactoring have further implications than the ones which have been commented upon in previous threads?

There are/were a ton of changes, but the page is updated with everything I have been able to work out or work around.

-- Scott