IdP 5 not accessible after upgrade on a Ubuntu server

[Simon Lundström]

When I upgraded late last year I also remember something about logging
but I don’t really remember what it was sadly.

Try to start from “scratch” (i.e. download a clean java, tomcat, unpack
and start to see that it works, then run install.sh and get a basic IDP
working then replace things piece by piece).

At least as a first quick step (but I’m pretty sure you’ve already done
it): just replace logback.xml with the one from upstream.

Check $CATALINA_HOME/lib/ for any logging libs as well.

https://logback.qos.ch/manual/configuration.html#configDebug has helped
me more than once but then again as Scott said if logback isn’t even
picked up for some reason it might be something above?

Good luck and report back!

BR,
- Simon

P.S. While not supported for Shibboleth I guess you can always
override/force the configuration file:
https://logback.qos.ch/manual/configuration.html

> On 21 Jan 2025, at 17:54, Wessel, Keith via users <users at shibboleth.net> wrote:
> 
> Hi, all,
>  I’m rather stumped here and am hoping for some direction of where to look next.
>  I’m helping another campus upgrade from IdP 4 to IdP 5. They’re running on a Ubuntu server that they upgraded from 22.04 to 24.04 to get access to Tomcat 10. They also upgraded from Tomcat 9 to 10 and Java 8 to 17.
>  Tomcat’s starting, and it’s deploying the IdP. This from Catalina.out:
>  [2025-01-17 14:02:25] [info] Deploying deployment descriptor [/etc/tomcat10/Catalina/localhost/idp.xml]
> [2025-01-17 14:02:25] [warning] Deployment of deployment descriptor [/etc/tomcat10/Catalina/localhost/idp.xml] with an external docBase means the directory [/var/lib/tomcat10/webapps/idp] in the appBase will be ignored
> [2025-01-17 14:02:29] [info] At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time.
> [2025-01-17 14:02:31] [info] 2025-01-17 14:02:31.766 [ WARN] : DEPRECATED: Java class 'net.shibboleth.idp.profile.logic.SimpleAttributePredicate': This will be removed in the next major version of this software; replacement is Parent bean 'shibboleth.Conditions.SimpleAttribute'
> [2025-01-17 14:02:37] [info] Deployment of deployment descriptor [/etc/tomcat10/Catalina/localhost/idp.xml] has finished in [12,077] ms
>  But trying to access the IdP (we’re just trying /dip/status) gives us an error page which looks like it’s coming out of the IdP, but I can’t say for sure. It contains:
>  An error occurred: ServletException
>  The IdP isn’t writing any log files even though the IdP log directory is writeable by the Tomcat user. We also turned off SELinux to make sure it wasn’t somehow interfering. And we’re not seeing any obvious errors when we hit /idp/status in any of the Tomcat logs.
>  With no other errors to go on, I’m stuck. Any suggestions?
>  Thanks,
> Keith
>  -- 
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net