<html><head></head><body><blockquote type="cite"><div>But our jetty-ssl.xml example doesn't have any of this new material in it. So I don't think it should have failed to work unless people didn't follow it.</div><div><br></div><div>And of course, the title of this specific thread I'm following is itself the point: you CANNOT use our jetty-base, period. That's not what it's for, and it's now hidden inside the directory tree.</div><div><br></div><div>We document how to set up Jetty in the wiki and that's the only example we provide to follow. jetty-base is for the Windows installer, period. If that changes, we'll be clear about it in the documentation.</div><div><br></div><div>So that's what broke here, but it didn't break because it was never intended to work to begin with.</div></blockquote><div><br></div><div>To be clear, I had tried using the included jetty-base in Shibboleth initially, but then had transitioned to using what was on the wiki instead, where I still had the issue. The only solution I had found was using 9.2 instead.</div><div><br></div><div>Also, while it isn't directly related to the Shibboleth project itself, myself and probably others attended the installfest for learning Shibboleth, which primarily used the included template: <a href="https://spaces.internet2.edu/pages/viewpage.action?pageId=49841792#LinuxIdentityProviderIdPv3%28Centos7%29-5.PrepareJetty">https://spaces.internet2.edu/pages/viewpage.action?pageId=49841792#LinuxIdentityProviderIdPv3%28Centos7%29-5.PrepareJetty</a></div><div><br></div><div>There are likely a number of people that learned on that and had it presented as:</div><div><br></div><blockquote type="cite"><div>The Shibboleth project distributes a jetty-base example that will run the IdP fine in most environments. It's used for this class, but it's not officially recommended for use in production.</div></blockquote><div><br></div><div>With things like that there, and it being named what it is, I find it easy to see why people would try working from that; they do it with most other files/folders in the shib archive. </div><div><br></div><div>I think we'd be best served by removing it from the tar archive entirely if it's indeed only used for Windows, to avoid the confusion at all.</div><div><br></div><div>Brandon</div><div><br></div><div>On Wed, 2015-07-22 at 16:55 +0000, Cantor, Scott wrote:</div><blockquote type="cite"><pre>On 7/22/15, 12:11 PM, "Cantor, Scott" <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:
<blockquote type="cite">
If I change the Jetty9 page, I can either document the new property names when it mentions modifying ssl.mod, and break Jetty 9.2, or I can do what I think the right answer is, stop documenting use of properties and just show example XML that confgures things correctly.
</blockquote>
Actually, our page is basically correct. The problem, I guess, is that people aren't following it. We include an explicit jetty-ssl.xml file example in the page that has to be used and that supports the properties we describe being set in ssl.mod.
There's actually a bug in 9.3, sort of. They have a feature that lets them change a property name while deprecating the original:
<Configure id="sslContextFactory" class="org.eclipse.jetty.util.ssl.SslContextFactory">
<Set name="KeyStorePath">
<Property name="jetty.base" default="." />/<Property name="jetty.sslContext.keyStorePath"
deprecated="jetty.keystore" default="etc/keystore"/>
</Set>
<Set name="KeyStorePassword">
<Property name="jetty.sslContext.keyStorePassword" deprecated="jetty.keystore.password"/>
</Set>
<Set name="KeyStoreType"><Property name="jetty.sslContext.keyStoreType" default="JKS"/></Set>
As you can see, they deprecated path and password, but ignored type. Thus, it breaks. They really shouldn't do that, it's sloppy, and I think I'll file a bug.
But our jetty-ssl.xml example doesn't have any of this new material in it. So I don't think it should have failed to work unless people didn't follow it.
And of course, the title of this specific thread I'm following is itself the point: you CANNOT use our jetty-base, period. That's not what it's for, and it's now hidden inside the directory tree.
We document how to set up Jetty in the wiki and that's the only example we provide to follow. jetty-base is for the Windows installer, period. If that changes, we'll be clear about it in the documentation.
So that's what broke here, but it didn't break because it was never intended to work to begin with.
-- Scott
</pre></blockquote></body></html>