Jetty Keystore Trouble with jetty-base provided in Shibboleth 3

[McKean, Brandon Scott - mckeanbs]

> But our jetty-ssl.xml example doesn't have any of this new material
> in it. So I don't think it should have failed to work unless people
> didn't follow it.
> 
> And of course, the title of this specific thread I'm following is
> itself the point: you CANNOT use our jetty-base, period. That's not
> what it's for, and it's now hidden inside the directory tree.
> 
> We document how to set up Jetty in the wiki and that's the only
> example we provide to follow. jetty-base is for the Windows
> installer, period. If that changes, we'll be clear about it in the
> documentation.
> 
> So that's what broke here, but it didn't break because it was never
> intended to work to begin with.
To be clear, I had tried using the included jetty-base in Shibboleth
initially, but then had transitioned to using what was on the wiki
instead, where I still had the issue. The only solution I had found was
using 9.2 instead.
Also, while it isn't directly related to the Shibboleth project itself,
myself and probably others attended the installfest for learning
Shibboleth, which primarily used the included template: https://spaces.
internet2.edu/pages/viewpage.action?pageId=49841792#LinuxIdentityProvid
erIdPv3%28Centos7%29-5.PrepareJetty
There are likely a number of people that learned on that and had it
presented as:
> The Shibboleth project distributes a jetty-base example that will run
> the IdP fine in most environments. It's used for this class, but it's
> not officially recommended for use in production.
With things like that there, and it being named what it is, I find it
easy to see why people would try working from that; they do it with
most other files/folders in the shib archive. 
I think we'd be best served by removing it from the tar archive
entirely if it's indeed only used for Windows, to avoid the confusion
at all.
Brandon
On Wed, 2015-07-22 at 16:55 +0000, Cantor, Scott wrote:
> On 7/22/15, 12:11 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
> 
> 
> > 
> > If I change the Jetty9 page, I can either document the new property
> > names when it mentions modifying ssl.mod, and break Jetty 9.2, or I
> > can do what I think the right answer is, stop documenting use of
> > properties and just show example XML that confgures things
> > correctly.
> 
> Actually, our page is basically correct. The problem, I guess, is
> that people aren't following it. We include an explicit jetty-ssl.xml
> file example in the page that has to be used and that supports the
> properties we describe being set in ssl.mod.
> 
> There's actually a bug in 9.3, sort of. They have a feature that lets
> them change a property name while deprecating the original:
> 
> 
> class="org.eclipse.jetty.util.ssl.SslContextFactory">
>   <Set name="KeyStorePath">
>     /
> name="jetty.sslContext.keyStorePath"
>       deprecated="jetty.keystore" default="etc/keystore"/>
>   </Set>
>   <Set name="KeyStorePassword">
>     
> deprecated="jetty.keystore.password"/>
>   </Set>
>   
> name="jetty.sslContext.keyStoreType" default="JKS"/>
> 
> As you can see, they deprecated path and password, but ignored type.
> Thus, it breaks. They really shouldn't do that, it's sloppy, and I
> think I'll file a bug.
> 
> 
> But our jetty-ssl.xml example doesn't have any of this new material
> in it. So I don't think it should have failed to work unless people
> didn't follow it.
> 
> And of course, the title of this specific thread I'm following is
> itself the point: you CANNOT use our jetty-base, period. That's not
> what it's for, and it's now hidden inside the directory tree.
> 
> We document how to set up Jetty in the wiki and that's the only
> example we provide to follow. jetty-base is for the Windows
> installer, period. If that changes, we'll be clear about it in the
> documentation.
> 
> So that's what broke here, but it didn't break because it was never
> intended to work to begin with.
> 
> -- Scott
> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150722/d80a57e6/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5673 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20150722/d80a57e6/attachment-0001.bin>