IdP 3.3.1 - mac check in GCM failed

[George Stoynev]

Thank you Scott!

Please let me know if I should submit any report or if there is another 
way to help with this.

All the best,

George

On 2017-06-13 12:00 PM, users-request at shibboleth.net wrote:

Message: 3
Date: Tue, 13 Jun 2017 15:19:05 +0000
From: "Cantor, Scott"<cantor.2 at osu.edu>
To: Shib Users<users at shibboleth.net>
Subject: Re: IdP 3.3.1 - mac check in GCM failed
Message-ID:<49C9360C-FDF6-41C1-9F63-269B321BA79B at osu.edu>
Content-Type: text/plain; charset="utf-8"

On 6/13/17, 10:58 AM, "users on behalf of George Stoynev"<users-bounces at shibboleth.net on behalf of george.stoynev at mcgill.ca>  wrote:

> Comparing the logs from version 3.2.1 (since this is the common version
> on all 4 servers) - the error messages are present in RHEL7, Java 8
> servers but not in the RHEL6, Java 7 ones.

Well, I would never mix versions for any length of time, but the algorithm here isn't actually JDK code, it's Bouncy Castle. GCM wasn't in Java 7, so that among other reasons is why I used the BC APIs directly.

Unfortunately for your theory, I use CentOS 7 and Oracle Java 8 myself, no error of this sort. But that certainly points to a problem on those servers.

> Any clue of what else to look at?

None.

Maybe there's a conflicting Bouncy Castle jar somewhere getting pulled in by some extension?

Really no idea. Nobody has reported anything like it and I've been using that code since I went live, have had no problems with it.

-- Scott

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170613/d8a160b0/attachment-0001.html>