jetty-9.3.8 and ECP
Vonblohn, Kyle
kvonbloh at bloomu.edu
Thu Jun 16 08:15:21 EDT 2016
Hi everyone,
We are currently utilizing ECP for use with the Office365 SP. It works fine in our v2 production environment with apache and tomcat, and I have successfully configured it to work in v3 running on tomcat with an apache front-end. However, I would prefer to switch to Jetty when we upgrade our production environment to v3. Aside from being much faster, I prefer the way its encapsulated, so to speak, in its configuration. However, I have run into an issue, hence this email. When I try to get ECP working on Jetty, the webapp won't start. I understand that this is not in use much, and have found little help via google. I have used the ShibInstallFest documentation at https://spaces.internet2.edu/pages/viewpage.action?pageId=49841792 for configuring the IDP on RHEL 7 with Jetty 9.3 and this works fine until I try to implement ECP. I used the wiki at https://wiki.shibboleth.net/confluence/display/IDP30/ECPConfiguration for configuring ECP with Jetty. However, after making these configuration changes the container fails to start. Specifically, adding
<Get name="securityHandler">
<Set name="realmName">Web Login Service</Set>
</Get>
To ${jetty-base}/webapps/idp.xml, and
<security-constraint>
<web-resource-collection>
<url-pattern>/Authn/RemoteUser</url-pattern>
<url-pattern>/profile/SAML2/SOAP/ECP</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>**</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>ShibUserPassAuth</realm-name>
</login-config>
To ${jetty-base}/webapps/idp.d/override-web.xml seem to be the culprits. If I comment out just these two code snippets, everything non-ECP works fine.
On the failed start, the jetty log shows the following error:
08:04:49.429 - WARN [org.eclipse.jetty.security.SecurityHandler:806] - ServletContext at o.e.j.w.WebAppContext@6f96c77{/idp,[file:///opt/shibboleth-idp/jetty-base/tmp/jetty-0.0.0.0-8443-idp.war-_idp-any-8439698236024555605.dir/webinf/, jar:file:///opt/shibboleth-idp/war/idp.war!/],STARTING}{/opt/shibboleth-idp/war/idp.war} has uncovered http methods for path: /profile/SAML2/SOAP/ECP
08:04:49.429 - WARN [org.eclipse.jetty.security.SecurityHandler:806] - ServletContext at o.e.j.w.WebAppContext@6f96c77{/idp,[file:///opt/shibboleth-idp/jetty-base/tmp/jetty-0.0.0.0-8443-idp.war-_idp-any-8439698236024555605.dir/webinf/, jar:file:///opt/shibboleth-idp/war/idp.war!/],STARTING}{/opt/shibboleth-idp/war/idp.war} has uncovered http methods for path: /Authn/RemoteUser
08:04:49.432 - WARN [org.eclipse.jetty.webapp.WebAppContext:526] - Failed startup of context o.e.j.w.WebAppContext at 6f96c77{/idp,[file:///opt/shibboleth-idp/jetty-base/tmp/jetty-0.0.0.0-8443-idp.war-_idp-any-8439698236024555605.dir/webinf/, jar:file:///opt/shibboleth-idp/war/idp.war!/],UNAVAILABLE}{/opt/shibboleth-idp/war/idp.war}
java.lang.IllegalStateException: No LoginService for org.eclipse.jetty.security.authentication.BasicAuthenticator at 2002fc1d in org.eclipse.jetty.security.ConstraintSecurityHandler at 69453e37
at org.eclipse.jetty.security.authentication.LoginAuthenticator.setConfiguration(LoginAuthenticator.java:76)
at org.eclipse.jetty.security.SecurityHandler.doStart(SecurityHandler.java:354)
at org.eclipse.jetty.security.ConstraintSecurityHandler.doStart(ConstraintSecurityHandler.java:448)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:132)
at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:106)
at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:61)
at org.eclipse.jetty.server.handler.ScopedHandler.doStart(ScopedHandler.java:120)
at org.eclipse.jetty.server.session.SessionHandler.doStart(SessionHandler.java:116)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:132)
at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:106)
at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:61)
at org.eclipse.jetty.server.handler.ScopedHandler.doStart(ScopedHandler.java:120)
at org.eclipse.jetty.server.handler.ContextHandler.startContext(ContextHandler.java:803)
at org.eclipse.jetty.servlet.ServletContextHandler.startContext(ServletContextHandler.java:344)
at org.eclipse.jetty.webapp.WebAppContext.startWebapp(WebAppContext.java:1379)
at org.eclipse.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1341)
at org.eclipse.jetty.server.handler.ContextHandler.doStart(ContextHandler.java:772)
at org.eclipse.jetty.servlet.ServletContextHandler.doStart(ServletContextHandler.java:261)
at org.eclipse.jetty.webapp.WebAppContext.doStart(WebAppContext.java:517)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at org.eclipse.jetty.deploy.bindings.StandardStarter.processBinding(StandardStarter.java:41)
at org.eclipse.jetty.deploy.AppLifeCycle.runBindings(AppLifeCycle.java:188)
at org.eclipse.jetty.deploy.DeploymentManager.requestAppGoal(DeploymentManager.java:499)
at org.eclipse.jetty.deploy.DeploymentManager.addApp(DeploymentManager.java:147)
at org.eclipse.jetty.deploy.providers.ScanningAppProvider.fileAdded(ScanningAppProvider.java:180)
at org.eclipse.jetty.deploy.providers.WebAppProvider.fileAdded(WebAppProvider.java:458)
at org.eclipse.jetty.deploy.providers.ScanningAppProvider$1.fileAdded(ScanningAppProvider.java:64)
at org.eclipse.jetty.util.Scanner.reportAddition(Scanner.java:610)
at org.eclipse.jetty.util.Scanner.reportDifferences(Scanner.java:529)
at org.eclipse.jetty.util.Scanner.scan(Scanner.java:392)
at org.eclipse.jetty.util.Scanner.doStart(Scanner.java:313)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at org.eclipse.jetty.deploy.providers.ScanningAppProvider.doStart(ScanningAppProvider.java:150)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at org.eclipse.jetty.deploy.DeploymentManager.startAppProvider(DeploymentManager.java:561)
at org.eclipse.jetty.deploy.DeploymentManager.doStart(DeploymentManager.java:236)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:132)
at org.eclipse.jetty.server.Server.start(Server.java:405)
at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:114)
at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:61)
at org.eclipse.jetty.server.Server.doStart(Server.java:372)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at org.eclipse.jetty.xml.XmlConfiguration$1.run(XmlConfiguration.java:1510)
at java.security.AccessController.doPrivileged(Native Method)
at org.eclipse.jetty.xml.XmlConfiguration.main(XmlConfiguration.java:1435)
I've been working on this for a few days now, but I've hit a wall. I'm sure it's a configuration issue I'm just not recognizing, being new to Shibboleth. Any help or guidance would be greatly appreciated.
FWIW, I am attending the training in Rochester next week.
Thanks,
Kyle
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160616/b5c9953e/attachment-0001.html>
More information about the users
mailing list