need help with Shibboleth IDP 3.0 installation

[Brent Putman]

On 1/12/15 2:55 PM, Hong Ye wrote:
>
> Tomcat is running under Java 8
> -bash-4.1$ ps -ef | grep java
> root     25992     1  1 14:37 pts/0    00:00:14
> /app/shibboleth/environment/jdk/bin/java
> -Djava.util.logging.config.file=/app/shibboleth/environment/tomcat/conf/logging.properties
> -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager
> -noverify -Djava.ext.dirs=/app/shibboleth/environment/jdk/lib/ext
> -server -verbose:gc -Xloggc:/app/log/shibboleth/tomcat/gc.log -Xms2G
> -Xmx2G -XX:PermSize=1024M -XX:MaxPermSize=1024M
> -Djava.awt.headless=true -XX:+DisableExplicitGC -XX:+UseParallelOldGC
> -Didp.home=/app/shibboleth/shibboleth-idp
> -Djava.endorsed.dirs=/app/shibboleth/environment/tomcat/endorsed
> -classpath
> /app/shibboleth/environment/tomcat/bin/bootstrap.jar:/app/shibboleth/environment/tomcat/bin/tomcat-juli.jar
> -Dcatalina.base=/app/shibboleth/environment/tomcat
> -Dcatalina.home=/app/shibboleth/environment/tomcat
> -Djava.io.tmpdir=/app/shibboleth/environment/tomcat/temp
> org.apache.catalina.startup.Bootstrap start
>

Actually, I think I see the problem.  Didn't spot it before.  The above
indicates that the JVM is being launched with:

-Djava.ext.dirs=/app/shibboleth/environment/jdk/lib/ext

That's not where those provider jars are (I presume, you can confirm). 
They should actually be in something like (as you already investigated):

/app/shibboleth/environment/jdk/jre/lib/ext

Note the "jre" in there.  At least in my JDK, there isn't a jdk/lib/ext. 

I don't know why it's being launched like that - is that something
related to what you did, how you set up Tomcat, etc?  Or perhaps that's
a default Tomcat 8 thing?

In any case, I'm 99.9% sure that's the problem, assuming you confirm the
non-existence or emptiness of jdk/lib/ext.

The AlgorithmRegistry DEBUG log should show under the current
configuration, NONE of the algorithms are supported.  You've literally
got no Security providers loaded.

Now that we've found that, I think we had someone else awhile back who
managed to do the same thing with IdP v2 under some container, maybe
Tomcat.  Don't remember how though.

--Brent



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150112/c454822b/attachment.html