IDP 2.4.5 and Oracle (container managed connection)

[Marco Naimoli]

>
> * Marco Naimoli <marco.naimoli at unipd.it> [2016-07-14 10:04]:
>> Hallo, my software versions are:
>> Shibboleth IDP: 2.4.5
>> Apache Tomcat: 6.0.45
>> Java 8
>
> You are aware of IDPv2 going End-Of-Life in 2 weeks?
>

Yes, and I'm migrating all IDPs to 3.x version. But I need to configure 
this new attribute now, and I don't have a production ready IDP 3.x to use.

>> In the last page I read:
>> "Application Managed data connectors which use Oracle JDBC Thin driver seem
>> to be losing connections after an idle period."
>
> Not sure about that but back then when I needed to connet to an Oracle
> RDBMS with "DataGuard" high-availability I needed to use Container
> Managed Connections for the (client-side triggered) failure to work.
>
> Here's the Tomcat Resource from the context deployment fragment in
> Catalina/localhost/idp.xml:
>
>    <Resource name="jdbc/somedb" description="SERVICE=DB connections Example"
>      type="javax.sql.DataSource" driverClassName="oracle.jdbc.OracleDriver"
>      url="jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=db-1.example.edu)(PORT=1521))(ADDRESS=(PROTOCOL=TCP)(HOST=db-2.example.edu)(PORT=1521))(LOAD_BALANCE=off)(FAILOVER=on))(CONNECT_DATA=(SERVICE_NAME=DB)))"
>      validationQuery="SELECT 1 FROM dual"
>      username="someuser" password="somepass"
>      maxActive="10" maxIdle="5" maxWait="-1"
>      removeAbandoned="true" FastConnectionFailoverEnabled="TRUE" />
>
> And this was what I needed in the attribute-resolver.xml:
>
>    <resolver:DataConnector id="db_services" xsi:type="dc:RelationalDatabase" readOnlyConnection="true">
>      <dc:ContainerManagedConnection resourceName="java:comp/env/jdbc/somedb" />
>      <dc:QueryTemplate> ... </dc:QueryTemplate>
>    </resolver:DataConnector>
>
> That was all, other than adding the JDBC driver to the container's lib
> directory (/usr/share/tomcat6/lib/ for Tomcat 6 on an old Debian).
>

Thank you for the configuration, I'll try it

>> 08:57:47.900 - WARN [edu.internet2.middleware.shibboleth.common.config.service.ServletContextAttributeExporter:74]
>> - This service may only be used when services are loaded within a web
>> application context.
>
> Is that from using the aacli.sh? That won't work with container
> managed database connections.
>

Yes, from aacli.sh: I didn't know it can't be used with container 
managed connections

Thank you very much Peter

Marco