Some problems getting Hello World working after got past the log in

Thu Mar 27 06:03:26 UTC 2025

Re. 1) (The loading speed) - Thanks for the information.

Re. 3) (the error and plugins) - Yes I did read that exact page but I
missed the links.  I read a LOT of stuff/pages ("drinking from a water
hose" :)! ) , and I do remember seeing mention of Javascript and Nashorn
earlier, but I kind of forgot about that :(.

FYI, I was now able to install the Nashorn plugin and the login is working
now with no error.  FYI, on my system, I have Tomcat deployed under a
"/apps" directory (it is kind of our standard) and I originally put the
Shibolleth stuff under "/apps" when I ran the "install.sh" but I quickly
decided that it was not going to be good like that, so I had deleted the
"/apps/shibboleth" and re-ran the "install.sh" and took the defaults, so
Shibboleth is now in "/opt/shibboleth-idp" and Tomcat is in
"/apps/apache-tomcat".  So after I installed Nashorn, I noted that that
built a new "idp.war" so I had to copy the new "idp.war" over to
"/apps/apache-tomcat/webapps".  I'll have to re-evaluate later.

Re. 2) I will review what you said in a bit because I think I still have
some questions.

Thanks for your help - your responses got me past the main place where I
was stuck (the uncaught exception)!

You had mentioned that I hadn't described what I was trying to do....
Actually, earlier on, I started writing about the background of what I was
doing, but decided it was "too much"...  Basically, we have been working
for a long time (as you all may have guessed), with IAM stuff and with
several COTS products, and I've been kind of tasked to take a current
re-look at open-source, especially for the federation area, and that is why
I've been working with Shibboleth most recently.  Basically, I am trying to
see how far we can reproduce the functionality that we have implemented
with those COTs products.

Thanks again!

Jim

On Wed, Mar 26, 2025 at 9:53 PM Steven Premeau via users <
users at shibboleth.net> wrote:

>
> Jim -
>
> Question 1:  It is taking a long time for the log in page/form to appear.
>> What might be the problem?
>
>
> If this is the first request to the application, this is likely normal.
> Java server applications are "lazy loaded".
>
> Question 2:  How can the policy specify more than 1 username?  Can I use a
>> wildcard and/or regex?
>
>
> Larger groups of users are typically managed via attributes.
>
> An example of how to configure multiple STATIC usernames can be found at:
>
> https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199509553/SubjectNamePredicate
>
> Question 3: Can someone explain what I need to do to get past the above?
>
>
> You have not indicated whether you have read the documentation wiki page
> on HelloWorld:
>
> https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510241/HelloWorldConfiguration
>
> "... use of this module relies on the use of Javascript, so you will have
> to select and install one of our scripting plugins for that purpose due to
> Java’s removal of Javascript support."
>
> Although there are a fair number of helpful individuals, it is difficult
> for this list to provide step-by-step assistance.
>
> (Looking at your past messages) It does not seem that you have mentioned
> what organization you are with and what your larger goal(s) are for your
> Shibboleth IDP installation.  If you are able to provide more context, it
> may be possible to point you to additional (and more relevant) resources.
>
> As a last resort, there are some commercial (paid) resources that could
> provide training or implementation assistance.  One place to look would be
> the "Commercial Support" options listed 1/2 down the page at
> https://www.shibboleth.net/support/
>
> Steve.
>
>
> On Wed, Mar 26, 2025 at 7:28 PM o haya via users <users at shibboleth.net>
> wrote:
>
>> Hi,
>>
>> So I am trying to get the Hello World test of the IdP working.
>>
>> Per my previous email thread I am now able to get the log in page, and,
>> also, from the logging, I am able to get past the authentication
>> (user=test1).
>>
>>
>> Question 1:  It is taking a long time for the log in page/form to
>> appear.  What might be the problem?
>>
>>
>> However, after the authentication, it got a denied, so I checked the log
>> and it mentioned it couldn't find a policy for AccessByAdminUser.
>>
>> So I checked the access-control.xml and the AccessByAdminUser section was
>> commented out.
>>
>> So I uncommented it and change the user to 'test1':
>>
>>         <entry key="AccessByAdminUser">
>>             <bean parent="shibboleth.PredicateAccessControl">
>>                 <constructor-arg>
>>                     <bean parent="shibboleth.Conditions.SubjectName"
>> c:collection="#{'test1'}" />
>>                 </constructor-arg>
>>             </bean>
>>         </entry>
>>
>> Question 2:  How can the policy specify more than 1 username?  Can I used
>> a wildcard and/or regex?
>>
>>
>>
>> After I changed the access-control.xml, I am still getting a denied, and
>> when I look at the log I get a response page:
>>
>> Web Login Service - Uncaught Exception
>>
>> A software error was encountered that prevents normal operation:
>>
>> *org.springframework.binding.expression.EvaluationException: An
>> ELException occurred getting the value for expression 'ScriptedAction' on
>> context [class
>> org.springframework.webflow.engine.impl.RequestControlContextImpl]*
>>
>>
>> Question 3: Can someone explain what I need to do to get past the above?
>>
>> Thanks,
>> Jim
>>
>>
>>
>>
>>
>>
>>
>> <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
>> Virus-free.www.avast.com
>> <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
>> <#m_-587882999081130249_m_2498833267142409339_m_589462555171446816_DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>
>> --
>> For Consortium Member technical support, see
>> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250327/86c04efa/attachment.htm>