Migrating to Relying-Party V3

[Roger Dills]

Hello,

I've got a great 3.x IDP running that was upgraded in-place from V2->V3.

I want to transition to my V2 relying-party file to V3. 

But in testing (keeping it simple), using the "dist" version of the V3 relying-part file is causing unknown errors.

Steps taken so far:

*Updated the services.properties file to not use the legacy relying-party method but rather the "shibboleth.RelyingPartyResolverResources"
*Updated the idp.properties file with the names of the existing signing key and cert files (idp.key, idp.crt)
*Updated the credentials.xml file with the encryption credential commented out. 

Restarting the IDP I get errors with the relying-party-system.xml resolving its beans.

The long winded error messages:

2017-04-25 09:58:32,545 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:181] - Service 'shibboleth.RelyingPartyResolverService': Initial load failed
net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver#0' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot resolve reference to bean 'shibboleth.DefaultSecurityConfiguration' while setting bean property 'defaultSecurityConfiguration'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.DefaultSecurityConfiguration' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot create inner bean 'shibboleth.BasicDecryptionConfiguration$child#263d1f2a' of type [org.opensaml.xmlsec.impl.BasicDecryptionConfiguration] while setting bean property 'decryptionConfiguration'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.BasicDecryptionConfiguration$child#263d1f2a' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot resolve reference to bean 'defaultKeyEncryptionCredentialResolver' while setting bean property 'KEKKeyInfoCredentialResolver'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'defaultKeyEncryptionCredentialResolver' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot create inner bean 'org.opensaml.xmlsec.keyinfo.impl.LocalKeyInfoCredentialResolver#5cdd240' of type [org.opensaml.xmlsec.keyinfo.impl.LocalKeyInfoCredentialResolver] while setting constructor argument with key [0]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.opensaml.xmlsec.keyinfo.impl.LocalKeyInfoCredentialResolver#5cdd240' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot create inner bean 'org.opensaml.xmlsec.keyinfo.impl.CollectionKeyInfoCredentialResolver#447a1df5' of type [org.opensaml.xmlsec.keyinfo.impl.CollectionKeyInfoCredentialResolver] while setting constructor argument; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.opensaml.xmlsec.keyinfo.impl.CollectionKeyInfoCredentialResolver#447a1df5' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot resolve reference to bean 'shibboleth.DefaultEncryptionCredentials' while setting constructor argument; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'shibboleth.DefaultEncryptionCredentials' is defined
	at net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:334)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver#0' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot resolve reference to bean 'shibboleth.DefaultSecurityConfiguration' while setting bean property 'defaultSecurityConfiguration'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.DefaultSecurityConfiguration' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot create inner bean 'shibboleth.BasicDecryptionConfiguration$child#263d1f2a' of type [org.opensaml.xmlsec.impl.BasicDecryptionConfiguration] while setting bean property 'decryptionConfiguration'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.BasicDecryptionConfiguration$child#263d1f2a' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot resolve reference to bean 'defaultKeyEncryptionCredentialResolver' while setting bean property 'KEKKeyInfoCredentialResolver'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'defaultKeyEncryptionCredentialResolver' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot create inner bean 'org.opensaml.xmlsec.keyinfo.impl.LocalKeyInfoCredentialResolver#5cdd240' of type [org.opensaml.xmlsec.keyinfo.impl.LocalKeyInfoCredentialResolver] while setting constructor argument with key [0]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.opensaml.xmlsec.keyinfo.impl.LocalKeyInfoCredentialResolver#5cdd240' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot create inner bean 'org.opensaml.xmlsec.keyinfo.impl.CollectionKeyInfoCredentialResolver#447a1df5' of type [org.opensaml.xmlsec.keyinfo.impl.CollectionKeyInfoCredentialResolver] while setting constructor argument; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.opensaml.xmlsec.keyinfo.impl.CollectionKeyInfoCredentialResolver#447a1df5' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot resolve reference to bean 'shibboleth.DefaultEncryptionCredentials' while setting constructor argument; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'shibboleth.DefaultEncryptionCredentials' is defined
	at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:359)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.DefaultSecurityConfiguration' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot create inner bean 'shibboleth.BasicDecryptionConfiguration$child#263d1f2a' of type [org.opensaml.xmlsec.impl.BasicDecryptionConfiguration] while setting bean property 'decryptionConfiguration'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.BasicDecryptionConfiguration$child#263d1f2a' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot resolve reference to bean 'defaultKeyEncryptionCredentialResolver' while setting bean property 'KEKKeyInfoCredentialResolver'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'defaultKeyEncryptionCredentialResolver' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot create inner bean 'org.opensaml.xmlsec.keyinfo.impl.LocalKeyInfoCredentialResolver#5cdd240' of type [org.opensaml.xmlsec.keyinfo.impl.LocalKeyInfoCredentialResolver] while setting constructor argument with key [0]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.opensaml.xmlsec.keyinfo.impl.LocalKeyInfoCredentialResolver#5cdd240' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot create inner bean 'org.opensaml.xmlsec.keyinfo.impl.CollectionKeyInfoCredentialResolver#447a1df5' of type [org.opensaml.xmlsec.keyinfo.impl.CollectionKeyInfoCredentialResolver] while setting constructor argument; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.opensaml.xmlsec.keyinfo.impl.CollectionKeyInfoCredentialResolver#447a1df5' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot resolve reference to bean 'shibboleth.DefaultEncryptionCredentials' while setting constructor argument; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'shibboleth.DefaultEncryptionCredentials' is defined
	at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBean(BeanDefinitionValueResolver.java:313)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.BasicDecryptionConfiguration$child#263d1f2a' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot resolve reference to bean 'defaultKeyEncryptionCredentialResolver' while setting bean property 'KEKKeyInfoCredentialResolver'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'defaultKeyEncryptionCredentialResolver' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot create inner bean 'org.opensaml.xmlsec.keyinfo.impl.LocalKeyInfoCredentialResolver#5cdd240' of type [org.opensaml.xmlsec.keyinfo.impl.LocalKeyInfoCredentialResolver] while setting constructor argument with key [0]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.opensaml.xmlsec.keyinfo.impl.LocalKeyInfoCredentialResolver#5cdd240' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot create inner bean 'org.opensaml.xmlsec.keyinfo.impl.CollectionKeyInfoCredentialResolver#447a1df5' of type [org.opensaml.xmlsec.keyinfo.impl.CollectionKeyInfoCredentialResolver] while setting constructor argument; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.opensaml.xmlsec.keyinfo.impl.CollectionKeyInfoCredentialResolver#447a1df5' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot resolve reference to bean 'shibboleth.DefaultEncryptionCredentials' while setting constructor argument; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'shibboleth.DefaultEncryptionCredentials' is defined
	at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:359)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'defaultKeyEncryptionCredentialResolver' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot create inner bean 'org.opensaml.xmlsec.keyinfo.impl.LocalKeyInfoCredentialResolver#5cdd240' of type [org.opensaml.xmlsec.keyinfo.impl.LocalKeyInfoCredentialResolver] while setting constructor argument with key [0]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.opensaml.xmlsec.keyinfo.impl.LocalKeyInfoCredentialResolver#5cdd240' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot create inner bean 'org.opensaml.xmlsec.keyinfo.impl.CollectionKeyInfoCredentialResolver#447a1df5' of type [org.opensaml.xmlsec.keyinfo.impl.CollectionKeyInfoCredentialResolver] while setting constructor argument; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.opensaml.xmlsec.keyinfo.impl.CollectionKeyInfoCredentialResolver#447a1df5' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot resolve reference to bean 'shibboleth.DefaultEncryptionCredentials' while setting constructor argument; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'shibboleth.DefaultEncryptionCredentials' is defined
	at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBean(BeanDefinitionValueResolver.java:313)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.opensaml.xmlsec.keyinfo.impl.LocalKeyInfoCredentialResolver#5cdd240' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot create inner bean 'org.opensaml.xmlsec.keyinfo.impl.CollectionKeyInfoCredentialResolver#447a1df5' of type [org.opensaml.xmlsec.keyinfo.impl.CollectionKeyInfoCredentialResolver] while setting constructor argument; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.opensaml.xmlsec.keyinfo.impl.CollectionKeyInfoCredentialResolver#447a1df5' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot resolve reference to bean 'shibboleth.DefaultEncryptionCredentials' while setting constructor argument; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'shibboleth.DefaultEncryptionCredentials' is defined
	at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBean(BeanDefinitionValueResolver.java:313)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.opensaml.xmlsec.keyinfo.impl.CollectionKeyInfoCredentialResolver#447a1df5' defined in file [/opt/shibboleth-idp/system/conf/relying-party-system.xml]: Cannot resolve reference to bean 'shibboleth.DefaultEncryptionCredentials' while setting constructor argument; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'shibboleth.DefaultEncryptionCredentials' is defined
	at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:359)
Caused by: org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'shibboleth.DefaultEncryptionCredentials' is defined
	at org.springframework.beans.factory.support.DefaultListableBeanFactory.getBeanDefinition(DefaultListableBeanFactory.java:687)
2017-04-25 09:58:48,521 - ERROR [net.shibboleth.idp.relyingparty.impl.ReloadingRelyingPartyConfigurationResolver:107] - RelyingPartyResolver 'shibboleth.RelyingPartyConfigurationResolver': error looking up Relying Party: Invalid configuration.


Where is this error coming from?



Changing back to the original V2 relying-party and flipping back to the legacyV2 service setting, returns everything back to normal without error.

Thanks for your help!

-Roger