<div dir="ltr"><div dir="ltr"><div>Howdy all and Happy Monday!</div><div><br></div><div><br></div><div><div>I had a functioning idp 3.4.1. installation.  I ran the upgrade to 3.4.3  and I now get this error.</div><div><br></div><div>2019-02-15 15:35:24,089 - ERROR [org.springframework.web.context.ContextLoader:350] - Context initialization failed</div><div>org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'proxyHttpSecurity' defined in file [/opt/shibboleth-idp/systecd /cas-protocol-system.xml]: Cannot create inner bean 'org.opensaml.security.trust.impl.ChainingTrustEngine#340da44c' of type [org.opensaml.security.trust.impl.ChainingTrustEngine] while setting bean property 'tLSTrustEngine'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.opensaml.security.trust.impl.ChainingTrustEngine#340da44c' defined in file [/opt/shibboleth-idp/system/conf/cas-protocol-system.xml]: Cannot create inner bean 'shibboleth.StaticPKIXTrustEngine$child#a43ce46' of type [net.shibboleth.idp.profile.spring.factory.StaticPKIXFactoryBean] while setting constructor argument with key [1]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.StaticPKIXTrustEngine$child#a43ce46' defined in file [/opt/shibboleth-idp/system/conf/cas-protocol-system.xml]: Initialization of bean failed; nested exception is org.springframework.beans.TypeMismatchException: Failed to convert property value of type 'java.util.ArrayList' to required type 'java.util.List' for property 'certificates'; nested exception is java.lang.IllegalArgumentException: Cannot convert value of type 'sun.security.x509.X509CertImpl' to required type 'org.springframework.core.io.Resource' for property 'certificates[0]': PropertyEditor [org.springframework.core.io.ResourceEditor] returned inappropriate value of type 'sun.security.x509.X509CertImpl'</div><div><br></div><div><br></div><div>The file referenced in the message "/opt/shibboleth-idp/system/conf/cas-protocol-system.xml"  is changed in the new version 3.4.3 </div><div><br></div><div>Here are the changes:</div><div><br></div><div>3.4.3 version:</div><div><br></div><div>    <bean id="proxyHttpSecurity" class="org.opensaml.security.httpclient.HttpClientSecurityParameters"></div><div>        <property name="tLSTrustEngine"></div><div>            <bean class="org.opensaml.security.trust.impl.ChainingTrustEngine"></div><div>                <constructor-arg name="chain"></div><div>                    <list></div><div>                        <bean class="org.opensaml.security.trust.impl.ExplicitX509CertificateTrustEngine"</div><div>                              c:resolver-ref="shibboleth.MetadataCredentialResolver" /></div><div>                        <bean parent="shibboleth.StaticPKIXTrustEngine"</div><div>                              p:certificates="#{getObject('shibboleth.CASProxyTrustedCertificates') ?: getObject('shibboleth.DefaultCASProxyTrustedCertificates')}"</div><div>                              p:checkNames="true" /></div><div>                    </list></div><div>                </constructor-arg></div><div>            </bean></div><div>        </property></div><div>    </bean></div><div>    </div><div>    </div><div>3.4.1 version (the above section replaced this section below)</div><div><br></div><div>    <bean id="proxyTrustEngine" class="org.opensaml.security.trust.impl.ChainingTrustEngine"></div><div>        <constructor-arg name="chain"></div><div>            <list></div><div>                <bean class="org.opensaml.security.trust.impl.ExplicitX509CertificateTrustEngine"</div><div>                      c:resolver-ref="shibboleth.MetadataCredentialResolver" /></div><div>                <bean class="org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine" c:nameEvaluator="#{null}"></div><div>                    <constructor-arg name="resolver"></div><div>                        <bean class="org.opensaml.security.x509.impl.StaticPKIXValidationInformationResolver" c:names="#{null}"></div><div>                            <constructor-arg name="info"></div><div>                                <bean class="org.opensaml.security.x509.impl.BasicPKIXValidationInformation"</div><div>                                      c:anchors="#{getObject('shibboleth.CASProxyTrustedCertificates') ?: getObject('shibboleth.DefaultCASProxyTrustedCertificates')}"</div><div>                                      c:crls="#{null}"</div><div>                                      c:depth="5" /></div><div>                            </constructor-arg></div><div>                        </bean></div><div>                    </constructor-arg></div><div>                    <constructor-arg name="pkixEvaluator"></div><div>                        <bean class="org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator" /></div><div>                    </constructor-arg></div><div>                </bean></div><div>            </list></div><div>        </constructor-arg></div><div>    </bean></div><div>    </div><div>    </div><div>Where do I start to fix this?    </div><div><br></div><div>Thanks in advance for the help!</div></div><div><br></div><div><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><div></div><div><br></div><div>Brad Mathis</div><div>Principal Systems Analyst</div><div>Pima Community College</div><div>IT - Technical Services</div><div>520.206.4826</div><div><a href="mailto:bmathis@pima.edu" target="_blank">bmathis@pima.edu</a></div></div><div><br></div><div><img src="https://docs.google.com/a/pima.edu/uc?id=0B4QEFWYNTFJATTZySzROc0JISEk&export=download" width="200" height="150"><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div></div></div></div></div></div></div></div></div></div></div>