ELException - Upgrade-Problem IdP 3.2.1 -> 3.3.1 - property bindingDescriptor-ref

[Martin Lunze]

Hi community,

i have a problem upgrading my IdP to 3.3.1 and hope somebody of you had 
an idea how to fix it.

Some facts about my environment:

> SLES 12 SP1
> IdP 3.2.1 (new install - no upgrade from 2.x or so)
> Apache 2.4.16
> Tomcat 8.0.43
> Java 1.8.0 (IBM Version 8)

All works great since months without any problem.
But after upgrading my test-IdP to 3.3.1 i get the following 
error-messages in my logs after a SP redirects an user to the IdP to 
authenticate:

> 2017-06-12 10:53:28,830 - 141.30.69.36 - ERROR 
> [net.shibboleth.idp.saml.profile:-2] - Uncaught runtime exception
> org.springframework.binding.expression.EvaluationException: An 
> ELException occurred getting the value for expression 'DecodeMessage' 
> on context [class 
> org.springframework.webflow.engine.impl.RequestControlContextImpl]
>         at 
> org.springframework.binding.expression.spel.SpringELExpression.getValue(SpringELExpression.java:92)
> Caused by: 
> org.springframework.expression.spel.SpelEvaluationException: 
> EL1021E:(pos 0): A problem occurred whilst attempting to access the 
> property 'DecodeMessage': 'Error creating bean with name 
> 'DecodeMessage' defined in file 
> [/opt/shibboleth-idp/system/flows/saml/saml2/sso-redirect-beans.xml]: 
> Cannot create inner bean 
> 'org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder#80ccac12' 
> of type 
> [org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder] 
> while setting constructor argument; nested exception is 
> org.springframework.beans.factory.BeanCreationException: Error 
> creating bean with name 
> 'org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder#80ccac12' 
> defined in file 
> [/opt/shibboleth-idp/system/flows/saml/saml2/sso-redirect-beans.xml]: 
> Error setting property values; nested exception is 
> org.springframework.beans.NotWritablePropertyException: Invalid 
> property 'bindingDescriptor' of bean class 
> [org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder]: 
> Bean property 'bindingDescriptor' is not writable or has an invalid 
> setter method. Does the parameter type of the setter match the return 
> type of the getter?'
>         at 
> org.springframework.expression.spel.ast.PropertyOrFieldReference.readProperty(PropertyOrFieldReference.java:216)

Unsolicited SSO is working!

I found another topic about Rare-ELException where Scott mentioned its Java.

> http://shibboleth.1660669.n2.nabble.com/Rare-ELException-td7632781.html

So i tested different Java-Version, but nothing resolved the Problem:

> OpenJDK 8
> Oracle JRE 8u131
> Oracle JDK 8u131

Then i compared the "system/flows/saml/saml2/sso-redirect-beans.xml" of 
IdP Version 3.2.1 and 3.3.1.
The only real difference i see is the additional property-reference for 
the "bindingDescriptor".

>     <bean id="DecodeMessage" 
> class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
>         <constructor-arg>
>             <bean 
> class="org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder" 
> scope="prototype"
>                 p:parserPool-ref="shibboleth.ParserPool"
> p:httpServletRequest-ref="shibboleth.HttpServletRequest"
> p:bindingDescriptor-ref="shibboleth.Binding.SAML2Redirect" />
>         </constructor-arg>
>     </bean>

If i comment this property out, the IdP seems to be working.
But i am absolutly unsure if i can do this for a production-system or 
what this property is used for.

If you need more informations about my system, please let me know.
I will be glad about any help.

With nice regards

-- 
Martin Lunze
IT-Systemadministrator

Technische Universität Dresden
Zentrum für Informationsdienste und Hochleistungsrechnen (ZIH)
Prozessmanagement und Controlling (PMC)
01062 Dresden

Tel.: +49 (351) 463-35881
E-Mail: martin.lunze at tu-dresden.de


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5677 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20170620/1bb51948/attachment.p7s>