need help with Shibboleth IDP 3.0 installation

[Hong Ye]

Brent,

You are right. That piece of configuration was inherited from my old Java environment. I should have verified it before I used it.

Thanks a lot.

Hong

On Jan 12, 2015, at 4:40 PM, Brent Putman <putmanb at georgetown.edu<mailto:putmanb at georgetown.edu>> wrote:


On 1/12/15 2:55 PM, Hong Ye wrote:

Tomcat is running under Java 8
-bash-4.1$ ps -ef | grep java
root     25992     1  1 14:37 pts/0    00:00:14 /app/shibboleth/environment/jdk/bin/java -Djava.util.logging.config.file=/app/shibboleth/environment/tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -noverify -Djava.ext.dirs=/app/shibboleth/environment/jdk/lib/ext -server -verbose:gc -Xloggc:/app/log/shibboleth/tomcat/gc.log -Xms2G -Xmx2G -XX:PermSize=1024M -XX:MaxPermSize=1024M -Djava.awt.headless=true -XX:+DisableExplicitGC -XX:+UseParallelOldGC -Didp.home=/app/shibboleth/shibboleth-idp -Djava.endorsed.dirs=/app/shibboleth/environment/tomcat/endorsed -classpath /app/shibboleth/environment/tomcat/bin/bootstrap.jar:/app/shibboleth/environment/tomcat/bin/tomcat-juli.jar -Dcatalina.base=/app/shibboleth/environment/tomcat -Dcatalina.home=/app/shibboleth/environment/tomcat -Djava.io.tmpdir=/app/shibboleth/environment/tomcat/temp org.apache.catalina.startup.Bootstrap start


Actually, I think I see the problem.  Didn't spot it before.  The above indicates that the JVM is being launched with:

-Djava.ext.dirs=/app/shibboleth/environment/jdk/lib/ext

That's not where those provider jars are (I presume, you can confirm).  They should actually be in something like (as you already investigated):

/app/shibboleth/environment/jdk/jre/lib/ext

Note the "jre" in there.  At least in my JDK, there isn't a jdk/lib/ext.

I don't know why it's being launched like that - is that something related to what you did, how you set up Tomcat, etc?  Or perhaps that's a default Tomcat 8 thing?

In any case, I'm 99.9% sure that's the problem, assuming you confirm the non-existence or emptiness of jdk/lib/ext.

The AlgorithmRegistry DEBUG log should show under the current configuration, NONE of the algorithms are supported.  You've literally got no Security providers loaded.

Now that we've found that, I think we had someone else awhile back who managed to do the same thing with IdP v2 under some container, maybe Tomcat.  Don't remember how though.

--Brent



--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150112/a0dbec7a/attachment.html