Older Shibd version on Debian: mod_shib undefined symbol

[Wessel, Keith]

Thanks, all, for chiming in. 

This was a server that had never run Shibboleth before. We were replacing SiteMinder with Shibboleth. Turns out SiteMinder uses its own (outdated) version of libgssapi that was being loaded using a modification to LD_LIBRARY_PAT in /etc/apache2/envvars. We commented out that addition, and now mod_shib loads without incident.

Keith

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Paul B. Henson via users
Sent: Thursday, January 8, 2026 8:32 PM
To: users at shibboleth.net
Cc: Paul B. Henson <henson at acm.org>
Subject: Re: Older Shibd version on Debian: mod_shib undefined symbol

On 1/8/2026 1:55 PM, Wessel, Keith via users wrote:

> software. We've got a customer that's stuck with Debian, though, and 
> will be updating soon but for now is on Debian 11 which contains SP 
> 3.2.2.

So you're trying to use Debian 11 with the Debian packaged version of
3.2.2? This was working before, but broke after an update? Or has never
worked before, and you are trying to set it up for the first time?

> Has anyone seen this, or does anyone have any suggestions beyond 
> upgrading the server or, better yet, choosing a different (RPM- 
> based) distro?

Heh, RPM-based distributions aren't necessarily all that ;). Although I 
must confess I do generally run the SP under Rocky... If I did need to 
use it under Debian I would probably compile it myself, except perhaps 
for Debian 13 which I think includes the latest version in the package repo.

> Cannot load /usr/lib/apache2/modules/mod_shib.so into server: /usr/
 > lib/x86_64-linux-gnu/libshibsp-lite.so.10: undefined symbol:
 > gss_export_name_composite, version gssapi_krb5_2_MIT

I don't have a Debian 11 system at hand, but downloading and extracting
the bulleye packages, starting with libapache2-mod-
shib_3.2.2+dfsg1-1+deb11u1_amd64.deb, reveals:

$ ldd ./usr/lib/apache2/modules/mod_shib.so
[...]
libshibsp-lite.so.10

the Apache shibboleth module has a dynamic dependency on the shibboleth
library, which is what is transitively giving you the error. That can be 
found in the package libshibsp10_3.2.2+dfsg1-1+deb11u1_amd64, and upon 
extracting that:

$ nm -D ./usr/lib/x86_64-linux-gnu/libshibsp-lite.so.10 | grep 
gss_export_name_composite
                  U gss_export_name_composite at gssapi_krb5_2_MIT

we can see that it does indeed require that symbol at that version.

Looking at its dependencies:

$ ldd ./usr/lib/x86_64-linux-gnu/libshibsp-lite.so.10
[...]
libgssapi_krb5.so.2

It's pretty clear where that symbol would most likely be found, so 
continuing on to the package libgssapi-krb5-2_1.18.3-6+deb11u7_amd64, it 
appears:

$ nm -D ./usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2 | grep 
gss_export_name_composite
0000000000014620 T gss_export_name_composite@@gssapi_krb5_2_MIT

the required symbol with the required version is available in the library.

So a Debian 11 system installed using the latest available packages 
should work fine? If yours is not, that leads me to believe something is 
specifically screwed up on this particular server, as opposed to a 
generic underlying endemic issue other users might see.

Try confirming you have the same versions of packages as listed above 
and then running the above commands on the system in question and see if 
they show anything different.

If you're interested in further assistance diagnosing the issue in situ 
you can contact me directly for my hourly rate :).

-- 
For Consortium Member technical support, see https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!DZ3fjg!-MAHscxi0S4pb3UaAmxJXoWfaA3k0Y84sFyBV2gunUprEKw9vcMRC4UtyhuVHn7BayfhSr3EmLXXFyVuGLB0$ 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net