After Java upgrade idp-process.log Subject values are gone

[Ward John]

Hi all,

Our environment:
Shibboleth 3.4.8, Java-11.0.23, Tomat 9.0.121 - Authn/External, CAS plugin

I'm working slowly and fastidiously on a project to get an old Shibboleth IdP 3.4.8 to version 4.1.0 and eventually to 5.X.

For that reason I upgraded java from version 8.0 to Java-11.0.23 to prepare for an upgrade to 4.1.0 and got tomcat to run from this version without too many problems, except one.

Our idp-process.log had a rather elaborate output for user auth events that included all the attributes that were associated with their account.

2026-09-10 12:56:50,009 - X.X.X.X - INFO [net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:139] - Profile Action ValidateExternalAuthentication: External authentication succeeded for Subject: [IdPAttributePrincipal{attribute=IdPAttribute{id=displayName, displayNames={}, displayDescriptions={}, encoders=[], values=[StringAttributeValue{value=BOB BOB}]}}, IdPAttributePrincipal{attribute=IdPAttribute{id=eduPersonPrincipalName, displayNames={}, displayDescriptions={}, encoders=[], values=[StringAttributeValue{value=BOB at univ-BOB.de}]}} ... and much more.

After the Java-11.0.23 upgrade this Subject has been reduced to: javax.security.auth.Subject$SecureSet at 50123acb<mailto:javax.security.auth.Subject$SecureSet at 50123acb>

2026-09-10 18:51:34,904 - X.X.X.X - INFO [net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:139] - Profile Action ValidateExternalAuthentication: External authentication succeeded for Subject: javax.security.auth.Subject$SecureSet at 50123acb<mailto:javax.security.auth.Subject$SecureSet at 50123acb>

Authentication still works, it's just that this log line has been butchered into pointlessness and having the Subject release those values is useful to us for troubleshooting purposes above all.

Has Java-11 become more strict in releasing the Subject ? Does anyone know how to fix this ?

Cordialement,

John Ward
04 78 77 30 87
Bureau P.136
Pôle Réseau et Sécurité, Service Opérations
DSI, Université Lyon 2, Bron

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260911/37dfd8d8/attachment.htm>