<div dir="ltr"><div><br></div><div>These messages from earlier this month weren't approved by the list moderator (posted through Nabble.com).</div><div><br></div><div>Original thread here:</div><div><br></div><div><a href="http://shibboleth.1660669.n2.nabble.com/idp-jks-not-created-td7613402.html">http://shibboleth.1660669.n2.nabble.com/idp-jks-not-created-td7613402.html</a><br></div><div><br></div><div>This might catch out other people who install Oracle Java 8 with Shibboleth.</div><div><br></div><div>Cheers,</div><div>Nigel</div><div><br></div><div>---</div><div><br></div><div><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px">I've spent quite a few weeks attempting to get the IdP v2.4.4 and v3.1.1 working - with limited success. On one host it would fail consistently, but on a clean AWS Ubuntu server it would at least get further along. </span><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px">It turns out that using Java 8 changes the default SecureRandom behaviour, resulting in both Tomcat and Jetty hanging on startup if the server's entropy has run out. On Jetty, you won't even get the TCP ports to open (8080 / 8443, or 80 / 443, depending on your configuration). </span><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px">Earlier versions of Java used /dev/urandom by default, which would not hang if entropy ran out. </span><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><a href="http://security.stackexchange.com/questions/40633/java-securerandom-doesnt-block-how" target="_top" rel="nofollow" link="external" style="font-size:13.4399995803833px;color:rgb(85,26,139);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">http://security.stackexchange.com/questions/40633/java-securerandom-doesnt-block-how</a><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px">To confirm this problem, send a kill -3 to your tomcat process and the catalina.out log file will show a deadlock here: </span><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px">"localhost-startStop-1" daemon prio=10 tid=0x00007f4b48002000 nid=0x36aa runnable [0x00007f4b43ffa000] </span><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"> java.lang.Thread.State: RUNNABLE </span><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"> at java.io.FileInputStream.readBytes(Native Method) </span><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"> at java.io.FileInputStream.read(FileInputStream.java:272) </span><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"> at sun.security.provider.SeedGenerator$URLSeedGenerator.getSeedBytes(SeedGenerator.java:551) </span><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"> at sun.security.provider.SeedGenerator.generateSeed(SeedGenerator.java:139) </span><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"> at sun.security.provider.SecureRandom$SeederHolder.<clinit>(SecureRandom.java:197) </span><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"> at sun.security.provider.SecureRandom.engineNextBytes(SecureRandom.java:214) </span><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"> - locked <0x00000000edaff5b0> (a sun.security.provider.SecureRandom) </span><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"> at java.security.SecureRandom.nextBytes(SecureRandom.java:455) </span><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"> - locked <0x00000000edaff8c8> (a java.security.SecureRandom) </span><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"> at org.opensaml.common.impl.SecureRandomIdentifierGenerator.generateIdentifier(SecureRandomIdentifierGenerator.java:62) </span><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"> at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.TransientIdAttributeDefinition.<init>(TransientIdAttributeDefinition.java:78) </span><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px">Cheers, </span><br style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13.4399995803833px">Nigel </span><br></div><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div><br></div><div>---</div></div></div></div></div></div></div></div></div><div class="gmail_quote"><br>
Actually I've looked at this further, and its actually the choice of the 'blocking' random-number generator on Java 8 on Linux. If you switch this to NativePRNGNonBlocking, then the deadlock doesn't occur.
<br><br>In jre/lib/security/java.security:
<br><br>securerandom.strongAlgorithms=NativePRNGBlocking:SUN
<br><br>... can become:
<br><br>securerandom.strongAlgorithms=NativePRNGNonBlocking:SUN
<br><br>Presumably this is a 'secure by default' setting, but a bizarre choice since it basically will bite anyone that installs any Java 8 software on Linux that requires secure random number generation, with no exception or error message presented to the unlucky devops person.
<br><br>Further information here:
<br><br><a href="https://docs.oracle.com/javase/8/docs/technotes/guides/security/enhancements-8.html" rel="nofollow" link="external" target="_blank">https://docs.oracle.com/javase/8/docs/technotes/guides/security/enhancements-8.html</a><br><a href="http://openjdk.java.net/jeps/123" rel="nofollow" link="external" target="_blank">http://openjdk.java.net/jeps/123</a><br><a href="http://stackoverflow.com/questions/23713640/working-only-with-dev-random-in-java" rel="nofollow" link="external" target="_blank">http://stackoverflow.com/questions/23713640/working-only-with-dev-random-in-java</a><br><br>Cheers,
<br>Nigel <br></div><div class="gmail_quote"><br></div><div class="gmail_quote"><br></div></div>