IdP v5 upgrade - OpenSAML initialization error(?)

[Michael White]

Thanks Scott,

> That's not a good idea, certainly not right away, and you're almost guaranteed to break it doing that. We do not at all advise that in general, quite the opposite.

Ah, OK, not sure why I thought that was required before trying to start the v5 IdP, but the config is all version controlled (plus I have notes on what I changed, and copies of all the updated/replaced v4 config files), so should be able to revert fairly easily (he says with fingers crossed ;-))

> If you're planning to proxy to Azure, I wouldn't waste much time on LDAP

Fair enough, but as I had LDAP working in v4 (although not generally switched on) I thought it would be easy(er) to get LDAP working as a first step . . .

> you could have just swapped in the RemoteUser support much more easily as a stepping stone

Yes, I think I might try that first/next and see if the problems go away if I take LDAP out of the loop . . .

> seems more like a Tomcat problem.

Good to know!

Any Tomcat 10 users out there ever seen anything like this, or have any thoughts? Assuming the issues don't magically vanish if/when I manage to switch to RemoteUser (or Azure) . . . !

Cheers,

Mike


-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu>
Sent: Tuesday, April 16, 2024 1:47 PM
To: Shib Users <users at shibboleth.net>
Cc: Michael White <michael.white at stir.ac.uk>
Subject: Re: IdP v5 upgrade - OpenSAML initialization error(?)

CAUTION: This email originated from outside University of Stirling. Do not follow links or open attachments if you doubt the authenticity of the sender or the content.
________________________________



> After resolving all the Deprecated warnings in v4.3.1 (and switching
> to Java 17), I did the IdP upgrade to v5.1.0 (and switched over to
> tomcat10) and went through all the configuration files with a
> corresponding "idpnew510" version, either replacing or updating the existing (v4) config files.

That's not a good idea, certainly not right away, and you're almost guaranteed to break it doing that. We do not at all advise that in general, quite the opposite.

> - it then seems to get stuck in a loop, repeatedly churning out the
> following until Tomcat is stopped:

I've never seen such an error, but I cannot speak to Tomcat.

If you're planning to proxy to Azure, I wouldn't waste much time on LDAP, and you could have just swapped in the RemoteUser support much more easily as a stepping stone, but I don't think that's anything to do with LDAP, or even the IdP at all, seems more like a Tomcat problem.

-- Scott


________________________________
Scotland’s University for Sporting Excellence
The University of Stirling is a charity registered in Scotland, number SC 011159