Ex: Re: idp 5.11 with Jetty 12, duo fail

[Paul B. Henson]

On Mon, Mar 25, 2024 at 08:02:37PM +0000, Cantor, Scott wrote:

> So...I wouldn't bet a lot of money on it, but I'd probably bet a few
> bucks, that you're experiencing a local corruption issue with the war
> of some kind that's probably something to do with duplicated jars.

I regrouped and set up a vanilla jetty 12 using almost exactly the
config from your repo, and was still getting the error 8-/.

As I mentioned in passing earlier, on my jetty 12 testbed there are
indeed two copies of the jars in the tmp directory (but not in the war):

# find | grep duo
./webapp/WEB-INF/lib/idp-plugin-duo-nimbus-client-impl-2.0.0.jar
./webapp/WEB-INF/lib/idp-plugin-duo-impl-2.0.0.jar
./webapp/WEB-INF/lib/idp-plugin-duo-api-2.0.0.jar
./webinf/WEB-INF/lib/idp-plugin-duo-nimbus-client-impl-2.0.0.jar
./webinf/WEB-INF/lib/idp-plugin-duo-impl-2.0.0.jar
./webinf/WEB-INF/lib/idp-plugin-duo-api-2.0.0.jar


If I update idp.xml and set copyWebInf=false, there's only one copy:

# find | grep duo
./webapp/WEB-INF/lib/idp-plugin-duo-nimbus-client-impl-2.0.0.jar
./webapp/WEB-INF/lib/idp-plugin-duo-impl-2.0.0.jar
./webapp/WEB-INF/lib/idp-plugin-duo-api-2.0.0.jar


Everything seems to work find in the latter case. However, looking at my
jetty 9 system, it only has the webinf directory, not the webapp
directory:

# find | grep duo
./webinf/WEB-INF/lib/idp-plugin-duo-api-1.4.1.jar
./webinf/WEB-INF/lib/idp-plugin-duo-impl-1.4.1.jar
./webinf/WEB-INF/lib/idp-plugin-duo-nimbus-client-impl-1.4.1.jar


If I update the jetty 9 idp.xml and set extractWAR=true, I end up with
the same layout as my jetty 12 box:

# find | grep duo
./webapp/WEB-INF/lib/idp-plugin-duo-api-1.4.1.jar
./webapp/WEB-INF/lib/idp-plugin-duo-impl-1.4.1.jar
./webapp/WEB-INF/lib/idp-plugin-duo-nimbus-client-impl-1.4.1.jar
./webinf/WEB-INF/lib/idp-plugin-duo-api-1.4.1.jar
./webinf/WEB-INF/lib/idp-plugin-duo-impl-1.4.1.jar
./webinf/WEB-INF/lib/idp-plugin-duo-nimbus-client-impl-1.4.1.jar

Under jetty 9 though, there are no errors, this works fine.

Which leaves me confused. Why is jetty 12 with extractWAR=false acting
like jetty 11 with extractWAR=true? Why does the temporary jetty 9
directory with jars in both webapp and webinfo work fine, but the jetty
12 ones barfs? How come you didn't get this error with about the same
config? Does your jetty tmp directory not have both a webapp and webinf
directory with separate copies of the jars?


On a side note, with ee10 I get warnings that don't show up with ee9:

2024-03-25 19:19:53,029 - WARN [org.apache.tomcat.util.descriptor.DigesterFactory:131] - The XML schema [XMLSchema.dtd] could not be found. This is very likely to break XML validation if XML validation is enabled.
2024-03-25 19:19:53,030 - WARN [org.apache.tomcat.util.descriptor.DigesterFactory:131] - The XML schema [datatypes.dtd] could not be found. This is very likely to break XML validation if XML validation is enabled.    

It looks like this is a known issue that should've been fixed a while
ago?

	https://github.com/jetty/jetty.project/issues/8446

I dunno, but I think I'll stick with ee9 for now given that's what jetty
11 does and it's trivial to swap between them.

-- 
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768