<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 1/12/15 2:55 PM, Hong Ye wrote:<br>
</div>
<blockquote
cite="mid:5816C609-5732-4548-9600-CA13DFBA2313@cornell.edu"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"><br>
<div style="margin: 0px;">Tomcat is running under Java 8</div>
<div style="margin: 0px;">
<div style="margin: 0px;">-bash-4.1$ ps -ef | grep java</div>
<div style="margin: 0px;">root 25992 1 1 14:37 pts/0
00:00:14 /app/shibboleth/environment/jdk/bin/java
-Djava.util.logging.config.file=/app/shibboleth/environment/tomcat/conf/logging.properties
-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager
-noverify
-Djava.ext.dirs=/app/shibboleth/environment/jdk/lib/ext
-server -verbose:gc
-Xloggc:/app/log/shibboleth/tomcat/gc.log -Xms2G -Xmx2G
-XX:PermSize=1024M -XX:MaxPermSize=1024M
-Djava.awt.headless=true -XX:+DisableExplicitGC
-XX:+UseParallelOldGC
-Didp.home=/app/shibboleth/shibboleth-idp
-Djava.endorsed.dirs=/app/shibboleth/environment/tomcat/endorsed
-classpath
/app/shibboleth/environment/tomcat/bin/bootstrap.jar:/app/shibboleth/environment/tomcat/bin/tomcat-juli.jar
-Dcatalina.base=/app/shibboleth/environment/tomcat
-Dcatalina.home=/app/shibboleth/environment/tomcat
-Djava.io.tmpdir=/app/shibboleth/environment/tomcat/temp
org.apache.catalina.startup.Bootstrap start</div>
<br>
</div>
</div>
</blockquote>
<br>
Actually, I think I see the problem. Didn't spot it before. The
above indicates that the JVM is being launched with:<br>
<br>
-Djava.ext.dirs=/app/shibboleth/environment/jdk/lib/ext<br>
<br>
That's not where those provider jars are (I presume, you can
confirm). They should actually be in something like (as you already
investigated):<br>
<br>
/app/shibboleth/environment/jdk/jre/lib/ext<br>
<br>
Note the "jre" in there. At least in my JDK, there isn't a
jdk/lib/ext. <br>
<br>
I don't know why it's being launched like that - is that something
related to what you did, how you set up Tomcat, etc? Or perhaps
that's a default Tomcat 8 thing?<br>
<br>
In any case, I'm 99.9% sure that's the problem, assuming you confirm
the non-existence or emptiness of jdk/lib/ext.<br>
<br>
The AlgorithmRegistry DEBUG log should show under the current
configuration, NONE of the algorithms are supported. You've
literally got no Security providers loaded.<br>
<br>
Now that we've found that, I think we had someone else awhile back
who managed to do the same thing with IdP v2 under some container,
maybe Tomcat. Don't remember how though.<br>
<br>
--Brent<br>
<br>
<br>
<br>
</body>
</html>