Sealer issue
Franz, Fabian
Fabian.Franz at alpegagroup.com
Mon Sep 16 08:50:23 UTC 2024
Hi all!
I am currently investigating in issue in the Shibboleth installation I am having.
I have a script that installs shibboleth into a directory and runs it on top of a WildFly (likely not related) and a JBoss 8.0.0 server.
That works but the sealer has some issue I cannot find the reason for. So this is the end of the long stack trace:
=
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.DataSealer' defined in class path resource [net/shibboleth/idp/conf/sealer.xml]: Cannot resolve reference to bean '#{ 'shibbol
eth.DataSealerKeyStrategy'.trim() }' while setting bean property 'keyStrategy'
at deployment.idp.war//org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:377)
at deployment.idp.war//org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveValueIfNecessary(BeanDefinitionValueResolver.java:135)
at deployment.idp.war//org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.applyPropertyValues(AbstractAutowireCapableBeanFactory.java:1705)
at deployment.idp.war//org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1454)
at deployment.idp.war//org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:599)
at deployment.idp.war//org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:522)
at deployment.idp.war//org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:337)
at deployment.idp.war//org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234)
at deployment.idp.war//org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:335)
at deployment.idp.war//org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:200)
at deployment.idp.war//org.springframework.beans.factory.config.BeanExpressionContext.getObject(BeanExpressionContext.java:60)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at deployment.idp.war//org.springframework.expression.spel.support.ReflectiveMethodExecutor.execute(ReflectiveMethodExecutor.java:142)
at deployment.idp.war//org.springframework.expression.spel.ast.MethodReference.getValueInternal(MethodReference.java:152)
at deployment.idp.war//org.springframework.expression.spel.ast.MethodReference.getValueInternal(MethodReference.java:108)
at deployment.idp.war//org.springframework.expression.spel.ast.Ternary.getValueInternal(Ternary.java:59)
at deployment.idp.war//org.springframework.expression.spel.ast.SpelNodeImpl.getValue(SpelNodeImpl.java:114)
at deployment.idp.war//org.springframework.expression.spel.standard.SpelExpression.getValue(SpelExpression.java:273)
at deployment.idp.war//org.springframework.context.expression.StandardBeanExpressionResolver.evaluate(StandardBeanExpressionResolver.java:183)
... 76 more
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.DataSealerKeyStrategy' defined in class path resource [net/shibboleth/idp/conf/sealer.xml]: Exception loading the default key
at deployment.idp.war//org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1806)
at deployment.idp.war//org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:600)
at deployment.idp.war//org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:522)
at deployment.idp.war//org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:337)
at deployment.idp.war//org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234)
at deployment.idp.war//org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:335)
at deployment.idp.war//org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:200)
at deployment.idp.war//org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:365)
... 97 more
Caused by: net.shibboleth.shared.component.ComponentInitializationException: Exception loading the default key
at deployment.idp.war//net.shibboleth.shared.security.impl.BasicKeystoreKeyStrategy.doInitialize(BasicKeystoreKeyStrategy.java:250)
at deployment.idp.war//net.shibboleth.shared.component.AbstractInitializableComponent.initialize(AbstractInitializableComponent.java:62)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at deployment.idp.war//org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeCustomInitMethod(AbstractAutowireCapableBeanFactory.java:1910)
at deployment.idp.war//org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1863)
at deployment.idp.war//org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1802)
... 104 more
Caused by: java.security.KeyException: java.io.IOException: Keystore was tampered with, or password was incorrect
at deployment.idp.war//net.shibboleth.shared.security.impl.BasicKeystoreKeyStrategy.getKey(BasicKeystoreKeyStrategy.java:337)
at deployment.idp.war//net.shibboleth.shared.security.impl.BasicKeystoreKeyStrategy.updateDefaultKey(BasicKeystoreKeyStrategy.java:388)
at deployment.idp.war//net.shibboleth.shared.security.impl.BasicKeystoreKeyStrategy.doInitialize(BasicKeystoreKeyStrategy.java:246)
... 112 more
Caused by: java.io.IOException: Keystore was tampered with, or password was incorrect
at java.base/com.sun.crypto.provider.JceKeyStore.engineLoad(JceKeyStore.java:882)
at java.base/java.security.KeyStore.load(KeyStore.java:1473)
at deployment.idp.war//net.shibboleth.shared.security.impl.BasicKeystoreKeyStrategy.getKey(BasicKeystoreKeyStrategy.java:322)
... 114 more
Caused by: java.security.UnrecoverableKeyException: Password verification failed
... 117 more
07:24:40,899 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("deploy") failed - address: ([("deployment" => "idp.war")]) - failure description: {"WFLYCTL0080: Failed services" => {"o
rg.wildfly.undertow.deployment.default-server.default-host./se-idp" => "java.lang.RuntimeException: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.AuthenticationFlow$child#0' defined i
n class path resource [net/shibboleth/idp/conf/authn-system.xml]: Cannot resolve reference to bean 'shibboleth.PrincipalServiceManager' while setting bean property 'principalServiceManager'
Caused by: java.lang.RuntimeException: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.AuthenticationFlow$child#0' defined in class path resource [net/shibboleth/idp/conf/authn-syst
em.xml]: Cannot resolve reference to bean 'shibboleth.PrincipalServiceManager' while setting bean property 'principalServiceManager'
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.AuthenticationFlow$child#0' defined in class path resource [net/shibboleth/idp/conf/authn-system.xml]: Cannot resolve refe
rence to bean 'shibboleth.PrincipalServiceManager' while setting bean property 'principalServiceManager'
Caused by: org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'shibboleth.PrincipalServiceManager' defined in class path resource [net/shibboleth/idp/conf/authn-system.xml]: Unsatisfied d
ependency expressed through constructor parameter 0: Error creating bean with name 'net.shibboleth.idp.authn.principal.GenericPrincipalService#5' defined in class path resource [net/shibboleth/idp/conf/authn-system.xml]: Cannot create i
nner bean 'net.shibboleth.idp.authn.principal.SealedPrincipalSerializer#7e618ee7' of type [net.shibboleth.idp.authn.principal.SealedPrincipalSerializer] while setting constructor argument
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'net.shibboleth.idp.authn.principal.GenericPrincipalService#5' defined in class path resource [net/shibboleth/idp/conf/authn-system.xm
l]: Cannot create inner bean 'net.shibboleth.idp.authn.principal.SealedPrincipalSerializer#7e618ee7' of type [net.shibboleth.idp.authn.principal.SealedPrincipalSerializer] while setting constructor argument
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'net.shibboleth.idp.authn.principal.SealedPrincipalSerializer#7e618ee7' defined in class path resource [net/shibboleth/idp/conf/authn-
system.xml]: Expression parsing failed
Caused by: org.springframework.beans.factory.BeanExpressionException: Expression parsing failed
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.DataSealer' defined in class path resource [net/shibboleth/idp/conf/sealer.xml]: Cannot resolve reference to bean '#{ 'shi
bboleth.DataSealerKeyStrategy'.trim() }' while setting bean property 'keyStrategy'
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.DataSealerKeyStrategy' defined in class path resource [net/shibboleth/idp/conf/sealer.xml]: Exception loading the default
key
Caused by: net.shibboleth.shared.component.ComponentInitializationException: Exception loading the default key
Caused by: java.security.KeyException: java.io.IOException: Keystore was tampered with, or password was incorrect
Caused by: java.io.IOException: Keystore was tampered with, or password was incorrect
Caused by: java.security.UnrecoverableKeyException: Password verification failed"}}
=
Shibboleth tries to open the sealer file with the configured password, but the generated store (created during the install script of shibboleth) seems to fail as the password of the store seems to be not correct.
I use this properties for the installation:
idp.target.dir=/opt/idp
idp.entityID=redacted
idp.host.name=redacted
idp.scope=redacted
idp.keysize=4096
idp.keystore.password=redacted
idp.sealer.password=redacted
idp.conf.credentials.filemode=600
I tried to open the keytore in KSE (Keystore Explorer; https://keystore-explorer.org/) and it seems to run into the same issue.
Version:
/usr/lib/jvm/java-17-openjdk/bin/java --version
openjdk 17.0.12 2024-07-16 LTS
OpenJDK Runtime Environment (Red_Hat-17.0.12.0.7-2.0.1) (build 17.0.12+7-LTS)
OpenJDK 64-Bit Server VM (Red_Hat-17.0.12.0.7-2.0.1) (build 17.0.12+7-LTS, mixed mode, sharing)
IDP Version:
5.1.3
Any idea, what causes that the password is not properly set on the keystore. I can confirm with the debugger, that the password from the config is passed down, which is the one that was created in the installation properties. Is there some workaround to manually created that keystore?
Kind Regards
Fabian Franz BSc.
Alpega TMS Austria SaaS GmbH.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240916/5f97e593/attachment.htm>
More information about the users
mailing list