SubjectDataConnector questions and NPE

[Nate Klingenstein]

It turns out that I can't do what I intended, at least with OpenJDK 11.0.8+10.  If I leave this Subject DataConnector uncommented:

<DataConnector id="passThroughAttributes" xsi:type="Subject" relyingParties="https://samltest.id/saml/idp" exportAttributes="mail" />

then Tomcat fails to initialize with:

11-Oct-2020 16:36:27.804 INFO [main] org.apache.catalina.startup.HostConfig.deployDescriptor Deploying deployment descriptor [/opt/apache-tomcat-9.0.38/conf/Catalina/localhost/idp.xml]                                                                                                                        11-Oct-2020 16:36:27.850 WARNING [main] org.apache.catalina.startup.HostConfig.deployDescriptor Deployment of deployment descriptor [/opt/apache-tomcat-9.0.38/conf/Catalina/localhost/idp.xml] with an external docBase means the directory [/opt/apache-tomcat-9.0.38/webapps/idp] in the appBase will be ignored
#                                                                                                                                                       # A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x00007f8ffb1ab852, pid=14471, tid=14473
#
# JRE version: OpenJDK Runtime Environment (11.0.8+10) (build 11.0.8+10-post-Ubuntu-0ubuntu118.04.1)
# Java VM: OpenJDK 64-Bit Server VM (11.0.8+10-post-Ubuntu-0ubuntu118.04.1, mixed mode, sharing, tiered, compressed oops, serial gc, linux-amd64)
# Problematic frame:
# J 1469 c2 org.apache.tomcat.util.IntrospectionUtils.setProperty(Ljava/lang/Object;Ljava/lang/String;Ljava/lang/String;ZLjava/lang/StringBuilder;)Z (939 bytes) @ 0x00007f8ffb1ab852 [0x00007f8ffb1aaf60+0x00000000000008f2]
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/share/apport/apport %p %s %c %d %P %E" (or dumping to /opt/shibboleth-idp/conf/core.14471)
#
# An error report file with more information is saved as:
# /opt/shibboleth-idp/conf/hs_err_pid14471.log
Could not load hsdis-amd64.so; library not loadable; PrintAssembly is disabled
#
# If you would like to submit a bug report, please visit:
#   https://bugs.launchpad.net/ubuntu/+source/openjdk-lts
#
NOTE: Picked up JDK_JAVA_OPTIONS:  --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED

The full log is quite long, and I won't include it here.  If I comment out the Subject DataConnector, it starts and works.

I can send the full dump to anyone who is actually interested in it, but this approach doesn't seem like it'll fly and I'll have to map each attribute individually.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id

 
 
-----Original message-----
> From: Nate Klingenstein
> Sent: Sunday, October 11 2020, 1:39 am
> To: Shib Users
> Subject: RE: SubjectDataConnector questions and NPE
> 
> > Is this IDP-1623?
> 
> Almost surely a variant on it.  Thanks a lot for the reference and to Matthew for catching it first.
> 
> I'll likely do the uid resolution and canonicalization a la the recipe in the Wiki separately from the gathering of attributes from the upstream IdP.
> 
> Thanks for taking the time to answer,
> Nate.
> -- 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>