idp 2.4.0 tomcat 8 startup problems

[Baron Fujimoto]

On Thu, Feb 05, 2015 at 03:04:16AM +0000, Cantor, Scott wrote:
>On 2/5/15, 2:47 AM, "Baron Fujimoto" <baron at hawaii.edu> wrote:
>
>
>>
>>The Xerces reference reminded me of the endorsed library directory, so
>>after copying the jar files from the shib install directory to a
>>${tomcat_base}/lib/endorsed directory, I tried again and that seems to
>>have done the trick.

Urg, the actual wrong solution I used was ${tomcat_base}/lib/, but...

>
>That's not the right solution. We documented that in the last security 
>advisory explaining how to migrate to the proper settings and secure 
>Tomcat.
>
>>FWIW, I wasn't able to find good references to setting up the endorsed
>>library directory in the Shib IdP docs.
>
>Because it is no longer correct to do it and doing so makes your system 
>vulnerable. There should be no references whatsoever to it so if any are 
>left, I missed them.

Ok, thanks for the pointer. Used the solution described in
<http://shibboleth.net/community/advisories/secadv_20141103.txt>
and that also resolves the problem. It wouldn't have occurred to me
to find the solution there without your tip though.

Aloha,
-baron
-- 
Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum