IdP 5 not accessible after upgrade on a Ubuntu server

[Wessel, Keith]

Thanks, all. Pete was correct. As long as I’ve been working with systemd, I still keep discovering things about it that I didn’t know. I had no idea it did sandboxing of services.

By adding two ReadWritePaths directives to the [service] block of the Tomcat 10 unit override, one for the logs dir and one for the downloaded metadata dir, we got the IdP to start logging. It’s still throwing a servlet exception, but now that we have logs, we should be able to figure out why.

Keith


From: Pete Birkinshaw <pete at digitalidentitylabs.com>
Sent: Tuesday, January 21, 2025 11:16 AM
To: Shib Users <users at shibboleth.net>
Cc: Wessel, Keith <kwessel at illinois.edu>
Subject: Re: IdP 5 not accessible after upgrade on a Ubuntu server


It would be worth checking systemd's sandboxing too - it can also limit access to filesystem directories.

Pete

--
Pete Birkinshaw
Digital Identity Ltd | http://www.digitalidentity.ltd.uk<https://urldefense.com/v3/__http:/www.digitalidentity.ltd.uk/__;!!DZ3fjg!6rXrHzIWSwXdEnz6NXzeEXeQm-oiwpqsE_B-_vFHMKLI3qManOEKBVxcWFER5q-kzJLFEUkBTHZ5nvPSl5hX20m4$>
Registered in England and Wales No. 7121888

From: Wessel, Keith via users <users at shibboleth.net><mailto:users at shibboleth.net>
Reply: Shib Users <users at shibboleth.net><mailto:users at shibboleth.net>
Date: 21 January 2025 at 16:54:58
To: users at shibboleth.net <users at shibboleth.net><mailto:users at shibboleth.net>
Cc: Wessel, Keith <kwessel at illinois.edu><mailto:kwessel at illinois.edu>
Subject:  IdP 5 not accessible after upgrade on a Ubuntu server


Hi, all,

I’m rather stumped here and am hoping for some direction of where to look next.

I’m helping another campus upgrade from IdP 4 to IdP 5. They’re running on a Ubuntu server that they upgraded from 22.04 to 24.04 to get access to Tomcat 10. They also upgraded from Tomcat 9 to 10 and Java 8 to 17.

Tomcat’s starting, and it’s deploying the IdP. This from Catalina.out:

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250122/aeda5c6d/attachment.htm>