<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hi everyone,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We are currently utilizing ECP for use with the Office365 SP. It works fine in our v2 production environment with apache and tomcat, and I have successfully configured it to work in v3 running on tomcat with an apache front-end. However,
I would prefer to switch to Jetty when we upgrade our production environment to v3. Aside from being much faster, I prefer the way its encapsulated, so to speak, in its configuration. However, I have run into an issue, hence this email. When I try to get
ECP working on Jetty, the webapp won’t start. I understand that this is not in use much, and have found little help via google. I have used the ShibInstallFest documentation at
<a href="https://spaces.internet2.edu/pages/viewpage.action?pageId=49841792">https://spaces.internet2.edu/pages/viewpage.action?pageId=49841792</a> for configuring the IDP on RHEL 7 with Jetty 9.3 and this works fine until I try to implement ECP. I used the
wiki at <a href="https://wiki.shibboleth.net/confluence/display/IDP30/ECPConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/ECPConfiguration</a> for configuring ECP with Jetty. However, after making these configuration changes the container
fails to start. Specifically, adding <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <Get name="securityHandler"><o:p></o:p></p>
<p class="MsoNormal"> <Set name="realmName">Web Login Service</Set><o:p></o:p></p>
<p class="MsoNormal"> </Get><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">To ${jetty-base}/webapps/idp.xml, and <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <security-constraint><o:p></o:p></p>
<p class="MsoNormal"> <web-resource-collection><o:p></o:p></p>
<p class="MsoNormal"> <url-pattern>/Authn/RemoteUser</url-pattern><o:p></o:p></p>
<p class="MsoNormal"> <url-pattern>/profile/SAML2/SOAP/ECP</url-pattern><o:p></o:p></p>
<p class="MsoNormal"> <http-method>GET</http-method><o:p></o:p></p>
<p class="MsoNormal"> <http-method>POST</http-method><o:p></o:p></p>
<p class="MsoNormal"> </web-resource-collection><o:p></o:p></p>
<p class="MsoNormal"> <auth-constraint><o:p></o:p></p>
<p class="MsoNormal"> <role-name>**</role-name><o:p></o:p></p>
<p class="MsoNormal"> </auth-constraint><o:p></o:p></p>
<p class="MsoNormal"> </security-constraint><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <login-config><o:p></o:p></p>
<p class="MsoNormal"> <auth-method>BASIC</auth-method><o:p></o:p></p>
<p class="MsoNormal"> <realm-name>ShibUserPassAuth</realm-name> <o:p></o:p></p>
<p class="MsoNormal"> </login-config><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">To ${jetty-base}/webapps/idp.d/override-web.xml seem to be the culprits. If I comment out just these two code snippets, everything non-ECP works fine.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">On the failed start, the jetty log shows the following error:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">08:04:49.429 - WARN [org.eclipse.jetty.security.SecurityHandler:806] - ServletContext@o.e.j.w.WebAppContext@6f96c77{/idp,[file:///opt/shibboleth-idp/jetty-base/tmp/jetty-0.0.0.0-8443-idp.war-_idp-any-8439698236024555605.dir/webinf/, jar:file:///opt/shibboleth-idp/war/idp.war!/],STARTING}{/opt/shibboleth-idp/war/idp.war}
has uncovered http methods for path: /profile/SAML2/SOAP/ECP<o:p></o:p></p>
<p class="MsoNormal">08:04:49.429 - WARN [org.eclipse.jetty.security.SecurityHandler:806] - ServletContext@o.e.j.w.WebAppContext@6f96c77{/idp,[file:///opt/shibboleth-idp/jetty-base/tmp/jetty-0.0.0.0-8443-idp.war-_idp-any-8439698236024555605.dir/webinf/, jar:file:///opt/shibboleth-idp/war/idp.war!/],STARTING}{/opt/shibboleth-idp/war/idp.war}
has uncovered http methods for path: /Authn/RemoteUser<o:p></o:p></p>
<p class="MsoNormal">08:04:49.432 - WARN [org.eclipse.jetty.webapp.WebAppContext:526] - Failed startup of context o.e.j.w.WebAppContext@6f96c77{/idp,[file:///opt/shibboleth-idp/jetty-base/tmp/jetty-0.0.0.0-8443-idp.war-_idp-any-8439698236024555605.dir/webinf/,
jar:file:///opt/shibboleth-idp/war/idp.war!/],UNAVAILABLE}{/opt/shibboleth-idp/war/idp.war}<o:p></o:p></p>
<p class="MsoNormal">java.lang.IllegalStateException: No LoginService for org.eclipse.jetty.security.authentication.BasicAuthenticator@2002fc1d in org.eclipse.jetty.security.ConstraintSecurityHandler@69453e37<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.security.authentication.LoginAuthenticator.setConfiguration(LoginAuthenticator.java:76)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.security.SecurityHandler.doStart(SecurityHandler.java:354)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.security.ConstraintSecurityHandler.doStart(ConstraintSecurityHandler.java:448)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:132)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:106)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:61)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.server.handler.ScopedHandler.doStart(ScopedHandler.java:120)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.server.session.SessionHandler.doStart(SessionHandler.java:116)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:132)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:106)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:61)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.server.handler.ScopedHandler.doStart(ScopedHandler.java:120)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.server.handler.ContextHandler.startContext(ContextHandler.java:803)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.servlet.ServletContextHandler.startContext(ServletContextHandler.java:344)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.webapp.WebAppContext.startWebapp(WebAppContext.java:1379)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1341)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.server.handler.ContextHandler.doStart(ContextHandler.java:772)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.servlet.ServletContextHandler.doStart(ServletContextHandler.java:261)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.webapp.WebAppContext.doStart(WebAppContext.java:517)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.deploy.bindings.StandardStarter.processBinding(StandardStarter.java:41)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.deploy.AppLifeCycle.runBindings(AppLifeCycle.java:188)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.deploy.DeploymentManager.requestAppGoal(DeploymentManager.java:499)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.deploy.DeploymentManager.addApp(DeploymentManager.java:147)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.deploy.providers.ScanningAppProvider.fileAdded(ScanningAppProvider.java:180)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.deploy.providers.WebAppProvider.fileAdded(WebAppProvider.java:458)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.deploy.providers.ScanningAppProvider$1.fileAdded(ScanningAppProvider.java:64)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.util.Scanner.reportAddition(Scanner.java:610)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.util.Scanner.reportDifferences(Scanner.java:529)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.util.Scanner.scan(Scanner.java:392)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.util.Scanner.doStart(Scanner.java:313)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.deploy.providers.ScanningAppProvider.doStart(ScanningAppProvider.java:150)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.deploy.DeploymentManager.startAppProvider(DeploymentManager.java:561)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.deploy.DeploymentManager.doStart(DeploymentManager.java:236)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:132)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.server.Server.start(Server.java:405)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:114)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:61)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.server.Server.doStart(Server.java:372)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.xml.XmlConfiguration$1.run(XmlConfiguration.java:1510)<o:p></o:p></p>
<p class="MsoNormal"> at java.security.AccessController.doPrivileged(Native Method)<o:p></o:p></p>
<p class="MsoNormal"> at org.eclipse.jetty.xml.XmlConfiguration.main(XmlConfiguration.java:1435)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ve been working on this for a few days now, but I’ve hit a wall. I’m sure it’s a configuration issue I’m just not recognizing, being new to Shibboleth. Any help or guidance would be greatly appreciated.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">FWIW, I am attending the training in Rochester next week.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">Kyle <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>