<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 06/19/2013 11:36 AM, Farrukh Najmi
wrote:<br>
</div>
...<br>
<blockquote cite="mid:51C1D010.3090402@wellfleetsoftware.com"
type="cite"> <span
style="font-size:15px;font-family:Arial;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;"
id="docs-internal-guid-67ebb44e-58b6-dadc-540f-e075edbbe516"></span>
<ul>
<li>I found a workaround in the following resource:<br>
<br>
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://metro.1045641.n5.nabble.com/Xerces-Xalan-not-playing-nice-with-Glassfish-Metro-td1061800.html">http://metro.1045641.n5.nabble.com/Xerces-Xalan-not-playing-nice-with-Glassfish-Metro-td1061800.html</a><br>
<br>
The workaround was to edit the
/home/najmi/glassfish3/glassfish/domains/domain1/lib/xercesImpl-2.10.0.jar
file to rename the folder /META-INF/service to
/META-ING/servicessaved<br>
<br>
I did the rename using Archive Manager in Ubuntu Linux so I
did not have to extract and repackage the jar, though any
other means including extracting the jar renaming in
filesystem and recreating the jar is fine.<br>
<br>
Above makes sure that the classes of this jar are not used as
plugins by JAXP layer and do not confuse the ClassLoader.<br>
<br>
</li>
<li>I then redeployed the idp using the asadmin command:<br>
<br>
<span
style="font-size:15px;font-family:Arial;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;"
id="docs-internal-guid-67ebb44e-58ba-6586-acf4-b9c665add907">~/glassfish3/bin/asadmin
deploy --force=true --contextroot idp --precompilejsp=false
--verify=false --upload=false
/home/najmi/shibboleth/shibboleth-identityprovider-2.4.0/installation/war/idp.war<br>
<br>
<br>
This time deployment went fine (no errors). <br>
</span></li>
</ul>
<span
style="font-size:15px;font-family:Arial;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;"
id="docs-internal-guid-67ebb44e-58b6-dadc-540f-e075edbbe516"><br
class="kix-line-break">
</span></blockquote>
....<br>
<blockquote cite="mid:51C1D010.3090402@wellfleetsoftware.com"
type="cite"><span
style="font-size:15px;font-family:Arial;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;"
id="docs-internal-guid-67ebb44e-58b6-dadc-540f-e075edbbe516"> </span><br>
I will plug away at this some more and keep this thread updated.
Please let me know if you see me going in the weeds. Thanks very
much for your help.<br>
</blockquote>
<br>
With help from Scott and Paul Hethmon, I have managed to get my Shib
2.4.0 IdP deployed in Glassfish 3.2.2.2 and successfully tested SAML
2 SSO.<br>
My SP has SAML support using spring-security-saml2. Both my SP and
IdP are deployed in the same Glassfish domain.<br>
<br>
One of the issues I ran into was the "PKIX validation of signature
failed" error on my SP side. I fixed this using help from following
spring-security-saml thread:<br>
<br>
<a class="moz-txt-link-freetext" href="http://forum.springsource.org/archive/index.php/t-120198.html">http://forum.springsource.org/archive/index.php/t-120198.html</a><br>
<br>
I then got the same "PKIX validation of signature failed" error on
the IdP side. This was because the IdP was using cached SP metadata
with old KeyInfo for the SP. I edited the SP's metadata file
manually (was under metadata directory of my installation directory
for IdP) and restarted the Glassfish domain. EVery looked good with
SSO after that!<br>
<br>
Scott, would you like me to contribute a wiki page named
IdPGTlassfish3Prepare on Glassfish Deployment of Idp and link it
from the page:<br>
<br>
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPInstall">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPInstall</a><br>
<br>
?<br>
<br>
If so, please tell me how I can get edit access. Thank you for all
the terrific help. Shibboleth rock!<br>
<pre class="moz-signature" cols="72">--
Regards,
Farrukh Najmi
Web: <a class="moz-txt-link-freetext" href="http://www.wellfleetsoftware.com">http://www.wellfleetsoftware.com</a>
</pre>
</body>
</html>