Runtime exception upon jetty restart on load

[Francesco Malvezzi]

hello shibboleth-idp users,

since a couple of months I am experiencing a startup issue with jetty.

Upon jetty restart, users face the Runtime error page after authentication.

Log reports:

[...]
2024-03-27 14:48:30,620 - INFO 
[net.shibboleth.idp.authn.impl.LDAPCredentialValidator:163] - Credential 
Validator ldap: Login by '__OMISSIS__' succeeded
2024-03-27 14:48:30,624 - INFO 
[net.shibboleth.idp.authn.impl.FinalizeAuthentication:196] - Profile 
Action FinalizeAuthentication: Principal __OMISSIS__ authenticated
2024-03-27 14:48:30,896 - ERROR 
[net.shibboleth.idp.profile.interceptor:39] - Uncaught runtime exception
org.springframework.binding.expression.EvaluationException: An 
ELException occurred getting the value for expression 
'WarningIterator.hasNext()' on context [class 
org.springframework.webflow.engine.impl.RequestControlContextImpl]
         at 
org.springframework.binding.expression.spel.SpringELExpression.getValue(SpringELExpression.java:104)
Caused by: org.springframework.expression.spel.SpelEvaluationException: 
EL1029E: A problem occurred when trying to execute method 'hasNext' on 
object of type 'java.util.LinkedHashMap$LinkedEntryIterator': 'Problem 
invoking method: public final boolean 
java.util.LinkedHashMap$LinkedHashIterator.hasNext()'
         at 
org.springframework.expression.spel.ast.MethodReference.getValueInternal(MethodReference.java:146)
Caused by: org.springframework.expression.AccessException: Problem 
invoking method: public final boolean 
java.util.LinkedHashMap$LinkedHashIterator.hasNext()
         at 
org.springframework.expression.spel.support.ReflectiveMethodExecutor.execute(ReflectiveMethodExecutor.java:143)
Caused by: java.lang.reflect.InaccessibleObjectException: Unable to make 
public final boolean 
java.util.LinkedHashMap$LinkedHashIterator.hasNext() accessible: module 
java.base does not "opens java.util" to unnamed module @5e742e4
         at 
java.base/java.lang.reflect.AccessibleObject.checkCanSetAccessible(AccessibleObject.java:354)
[...]

context:
idp version is 4.3.1
$ java -version
openjdk version "17.0.10" 2024-01-16 LTS
OpenJDK Runtime Environment Corretto-17.0.10.8.1 (build 17.0.10+8-LTS)
OpenJDK 64-Bit Server VM Corretto-17.0.10.8.1 (build 17.0.10+8-LTS, 
mixed mode, sharing)
jetty is 10.0.18 executed behind apache2 as reverse proxy
VM is Debian GNU/Linux 12 (bookworm)

It has to be a load-related issue because it doesn't show up if I stop 
apache2, restart jetty, wait a bit after the metadata load phase, start 
apache2 again. The issue happens only when, upon restart, there is a 
good pressure from users.

It has to be a mistake of mine in a scripted resource, because user 
authentication works and the error arises either in the 
attributes-collecting phase or upon evaluating an interceptor. There are 
plenty of scripts in these phases.

I am asking to other users how to investigate further this issue,

thank you for your time,

Francesco