<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
Brent,
<div><br>
</div>
<div>You are right. That piece of configuration was inherited from my old Java environment. I should have verified it before I used it.
<div><br>
</div>
<div>Thanks a lot.</div>
<div><br>
</div>
<div>Hong</div>
<div><br>
<div>
<div>On Jan 12, 2015, at 4:40 PM, Brent Putman <<a href="mailto:putmanb@georgetown.edu">putmanb@georgetown.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div bgcolor="#FFFFFF" text="#000000"><br>
<div class="moz-cite-prefix">On 1/12/15 2:55 PM, Hong Ye wrote:<br>
</div>
<blockquote cite="mid:5816C609-5732-4548-9600-CA13DFBA2313@cornell.edu" type="cite">
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"><br>
<div style="margin: 0px;">Tomcat is running under Java 8</div>
<div style="margin: 0px;">
<div style="margin: 0px;">-bash-4.1$ ps -ef | grep java</div>
<div style="margin: 0px;">root 25992 1 1 14:37 pts/0 00:00:14 /app/shibboleth/environment/jdk/bin/java -Djava.util.logging.config.file=/app/shibboleth/environment/tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager
-noverify -Djava.ext.dirs=/app/shibboleth/environment/jdk/lib/ext -server -verbose:gc -Xloggc:/app/log/shibboleth/tomcat/gc.log -Xms2G -Xmx2G -XX:PermSize=1024M -XX:MaxPermSize=1024M -Djava.awt.headless=true -XX:+DisableExplicitGC -XX:+UseParallelOldGC -Didp.home=/app/shibboleth/shibboleth-idp
-Djava.endorsed.dirs=/app/shibboleth/environment/tomcat/endorsed -classpath /app/shibboleth/environment/tomcat/bin/bootstrap.jar:/app/shibboleth/environment/tomcat/bin/tomcat-juli.jar -Dcatalina.base=/app/shibboleth/environment/tomcat -Dcatalina.home=/app/shibboleth/environment/tomcat
-Djava.io.tmpdir=/app/shibboleth/environment/tomcat/temp org.apache.catalina.startup.Bootstrap start</div>
<br>
</div>
</div>
</blockquote>
<br>
Actually, I think I see the problem. Didn't spot it before. The above indicates that the JVM is being launched with:<br>
<br>
-Djava.ext.dirs=/app/shibboleth/environment/jdk/lib/ext<br>
<br>
That's not where those provider jars are (I presume, you can confirm). They should actually be in something like (as you already investigated):<br>
<br>
/app/shibboleth/environment/jdk/jre/lib/ext<br>
<br>
Note the "jre" in there. At least in my JDK, there isn't a jdk/lib/ext. <br>
<br>
I don't know why it's being launched like that - is that something related to what you did, how you set up Tomcat, etc? Or perhaps that's a default Tomcat 8 thing?<br>
<br>
In any case, I'm 99.9% sure that's the problem, assuming you confirm the non-existence or emptiness of jdk/lib/ext.<br>
<br>
The AlgorithmRegistry DEBUG log should show under the current configuration, NONE of the algorithms are supported. You've literally got no Security providers loaded.<br>
<br>
Now that we've found that, I think we had someone else awhile back who managed to do the same thing with IdP v2 under some container, maybe Tomcat. Don't remember how though.<br>
<br>
--Brent<br>
<br>
<br>
<br>
</div>
-- <br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></blockquote>
</div>
<br>
</div>
</div>
</body>
</html>