<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Ah! Ok, that would explain everything perfectly. Since you weren't
seeing the particular log line I mentioned earlier, the error then
had to be from the Java crypto KeyGenerator unable to generate an
instance for algorithm "AES" (in order words, not Apache Santuario).<br>
<br>
Typo-ing java.ext.dirs would mean that those jars don't get loaded,
and (assuming Oracle's Java ) one of those just happens to be the
jar for the Security provider "SunJCE", which supports the symmetric
ciphers and keys, HMAC, etc. That includes support for the AES
block cipher. <br>
<br>
The reason other crypto ops like signing with asymmetric keys and
algorithms as well message digests (e.g. SHA-1, RSA, etc) were
working is that for historical reasons the provider jars for those
aren't treated like "extensions" but are rather part of the core
platform and are located within jars directly within /lib (probably
rt.jar IIRC).<br>
<br>
So that was a weird one! :-)<br>
<br>
--Brent<br>
<br>
<br>
<div class="moz-cite-prefix">On 9/27/13 3:52 PM, Joy Veronneau
wrote:<br>
</div>
<blockquote
cite="mid:8A112F6C-7864-4421-8574-FB88B801C02E@cornell.edu"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<div>I had:</div>
<div><br>
</div>
<div>JAVA_OPTS="-noverify -Djava.ext.dirs=$JAVA_HOME/<b>jre/</b>lib/ext
-server "</div>
<div><br>
</div>
<div>but should have had:</div>
<div><br>
</div>
<div>JAVA_OPTS="-noverify -Djava.ext.dirs=$JAVA_HOME/lib/ext
-server "</div>
<div><br>
</div>
<div>Joy</div>
<div><br>
<div>
<div>On Sep 27, 2013, at 3:35 PM, "Cantor, Scott" <<a
moz-do-not-send="true" href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>></div>
<div> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">On 9/27/13 3:24 PM, "Joy Veronneau"
<<a moz-do-not-send="true" href="mailto:jv11@cornell.edu">jv11@cornell.edu</a>>
wrote:<br>
<blockquote type="cite"><br>
It's fixed. There was one java path in the tomcat config
that was wrong.<br>
DOH! I swear I looked at that about 20 times. Just didn't
click.<br>
</blockquote>
<br>
Could you please indicate which one it was for the archives?<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a
moz-do-not-send="true"
href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><br>
<br>
</blockquote>
</div>
<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">--
To unsubscribe from this list send an email to <a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></pre>
</blockquote>
<br>
</body>
</html>