JDK17 - IdP errors

[Mark Boyce]

Hi Dave,

You have to install either the Nashorn or Rhino plugins... "$ ./plugin.sh -I net.shibboleth.idp.plugin.nashorn" or "$ ./plugin.sh -I net.shibboleth.idp.plugin.rhino" (plugin.sh is in the bin folder)

Thanks,
m.

Mark L. Boyce
Senior Identity Management Analyst
University of California, Office of the President
Office: 510.987.9681
Cell: 209.851.0196

From: users <users-bounces at shibboleth.net> On Behalf Of Dave Perry via users
Sent: Monday, May 13, 2024 4:47 PM
To: Etan Weintraub via users <users at shibboleth.net>
Cc: Dave Perry <d.perry1 at yorksj.ac.uk>
Subject: JDK17 - IdP errors


CAUTION: EXTERNAL EMAIL
Hi all

I have updated the JDK on my Dev IdP to be JDK17 (Amazon Corretto). I get the following errors in idp-process.log, one at startup and the others during a SAML authentication attempt:

2024-05-13 22:26:37,780 -  - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:182] - Service 'shibboleth.AttributeResolverService': Initial load failed
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'eduPersonAffiliation': Cannot create inner bean '(inner bean)#1a212395' of type [net.shibboleth.ext.spring.factory.EvaluableScriptFactoryBean] while setting bean property 'script'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#1a212395': Invocation of init method failed; nested exception is net.shibboleth.utilities.java.support.logic.ConstraintViolationException: No scripting engine associated with scripting language javascript
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#1a212395': Invocation of init method failed; nested exception is net.shibboleth.utilities.java.support.logic.ConstraintViolationException: No scripting engine associated with scripting language javascript
2024-05-13 22:29:06,860 - 10.4.105.22 - ERROR [net.shibboleth.idp.profile.impl.ResolveAttributes:300] - Profile Action ResolveAttributes: Error resolving attributes: Invalid Attribute resolver configuration
2024-05-13 22:29:06,877 - 10.4.105.22 - ERROR [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] - Profile Action SelectSubjectCanonicalizationFlow: No potential flows left to choose from, canonicalization will fail

>From an end user POV, the login attempt seems to go through - until 'Error occured' is sent in the SAML back to the SP (according to the logs).

Currently in Prod/Test we run Corretto JDK v11 with no issues (IdP v4.3.1).

Any ideas what v17 is unhappy about?


Thanks
Dave

_________________________________________________

Dave Perry
Application Analyst  |  Innovation & Technology Services

York St John University

Lord Mayor's Walk, York, YO31 7EX
T: +44(0)1904 876 0000
d.perry1 at yorksj.ac.uk<mailto:d.perry1 at yorksj.ac.uk>  |  www.yorksj.ac.uk<http://www.yorksj.ac.uk>

[cid:image001.png at 01DAA557.EF2D1D60]

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240513/b37528b0/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 12155 bytes
Desc: image001.png
URL: <http://shibboleth.net/pipermail/users/attachments/20240513/b37528b0/attachment.png>