recommended JVM version

[Baron Fujimoto]

On Thu, Jul 23, 2015 at 01:01:55PM -0800, IAM David Bantz wrote:
>I've been handed a new server for our v2 IdP;
>the current production environment has been RHEL 5.11, Tomcat 6.0.16,
>Oracle Java 1.60;
>this new production environment is RHEL 6.6, Tomcat 7.0.33 and Open JVM 1.5
>which the Sibb documentation strongly urges me to replace with Oracle's
>"standard" JVM.  However the Shibb documentation does not specify a
>version. I see lots of messages on this list  indicting use of 7, while
>only a few using current 8 and those indicating problems, indicating a
>scripting problem resolved by reverting to Java 7 and part of the Shibb
>installation instructions for memory superceded.
>
>So should I deploy the current Oracle Java 8 (which Oracle describes as
>major and "revolutionary" upgrade), or stick with the older tried-and-true
>still-available Java 7 for a refreshed IdP 2.4.4 using a lot of scripted
>attributes from my Java 6 environment?

We're currently running RHEL 6.6, Tomcat 8.0.24, and Java 1.8.0_51 with
IdPv2. In not too distant memory, we were also running Java 1,6 and
Tomcat 6. Java 1.6 was EOL 2013-02, and we were also faced with the
upgrade decisions. Oracle's announced end of public updates for Java 1.7
was 2015-04, so barring advice to the contrary, we decided it was prudent
go with Java 1.8.

We ran into a number of small compatibility issues we had to overcome
in the upgrade process that we mostly managed to resolve, I think. But
we aren't using a lot of scripted attibutes either, so YMMV.

The one issue we have encountered is occasional crashes that kill
tomcat with err:

com.sun.crypto.provider.GCTR.doFinal([BII[BI)I (130 bytes)

Google-fu turned up the following bug which seems to match:

<https://bugs.openjdk.java.net/browse/JDK-8068574>

Am trying to work around this by disabling GCM ciphers in the tomcat
connector. Still too early to determine if this is successful though.
If anyone else has encountered anything similar, I'd love to hear
about it.

Upgrading to IdPv3 and probably Jetty is on the horizon for us.

-baron
-- 
Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum