<div dir="ltr"><div>To back up a bit, this is a new tomcat server and shibboleth idp 3.4.6. I have copied the data over from an existing (working) shibboleth idp 3.2.1. The data would include idp.property settings, metadata, and credentials. The entire credentials directory. I am concerned copying the cert files over may be the issue, but tomcat and shibboleth are set up properly to use them. My thinking now is that copying over the conf directory metadata is ok with a few minor tweaks, but I need to create a whole suite of new certs for this new server.</div><div><br></div><div> Service 'shibboleth.MetadataResolverService': Initial load failed<br>net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.opensaml.saml.metadata.resolver.filter.impl.SignatureValidationFilter#0': Cannot create inner bean '(inner bean)#3e38a99c' of type [org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine]<br></div><div><br></div><div>The entire error message are in my first post.</div><div><br></div><br clear="all"><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div>Scott Gilbert</div><div>IAM System Admin</div><div>ETS Enterprise Technology Services</div><div>University of California Santa Barbara</div><div><br></div></div></div></div></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Nov 27, 2019 at 10:04 AM Scott Gilbert <<a href="mailto:sgilbert@ucsb.edu">sgilbert@ucsb.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Still getting the same error message. Below is my current incommon config. </div><div><br></div><div> <MetadataProvider id="INCOMMON" xsi:type="FileBackedHTTPMetadataProvider"<br> metadataURL="<a href="http://md.incommon.org/InCommon/InCommon-metadata.xml" target="_blank">http://md.incommon.org/InCommon/InCommon-metadata.xml</a>" backingFile="%{idp.home}/metadata/incommon-metadata.xml"><br> <MetadataFilter xsi:type="SignatureValidation" certificateFile="%{idp.home}/credentials/inc-md-cert.pem" /><br> </MetadataProvider><br></div><div><br></div><div>Do I need to state this?</div><div> <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P30D"/><br></div><div><br></div><div>I have enough memory allocated </div><div>Environment="CATALINA_OPTS=-Xms512M -Xmx2048M -server -XX:+UseG1GC"<br></div><div><br></div><br clear="all"><div><div dir="ltr"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div>Scott Gilbert</div><div>IAM System Admin</div><div>ETS Enterprise Technology Services</div><div>University of California Santa Barbara</div><div><br></div></div></div></div></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Nov 26, 2019 at 3:16 PM Christopher Bongaarts <<a href="mailto:cab@umn.edu" target="_blank">cab@umn.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<p>Within that <MetadataProvider> element you'll find a nested
element like this:</p>
<p> <MetadataFilter xsi:type="SignatureValidation"
requireSignedRoot="true"<br>
certificateFile="%{idp.home}/credentials/incommon.pem" /><br>
</p>
<p>It's having trouble loading that certificateFile.<br>
</p>
<div>On 11/26/2019 5:02 PM, Scott Gilbert
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">Thanks for the reply.
<div><br>
</div>
<div>So this metadata provider statement is not sufficient</div>
<div><br>
</div>
<div> <MetadataProvider id="INCOMMON"
xsi:type="FileBackedHTTPMetadataProvider"<br>
metadataURL="<a href="http://md.incommon.org/InCommon/InCommon-metadata.xml" target="_blank">http://md.incommon.org/InCommon/InCommon-metadata.xml</a>"
backingFile="%{idp.home}/metadata/incommon-metadata.xml"><br>
</div>
<div><br>
</div>
<div>as I recall there is some form of verification, so as not
to spoof, it may be in the incommon docs.</div>
<div><br>
</div>
<div>
<div dir="ltr">
<div dir="ltr">
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div>Scott Gilbert</div>
<div>IAM System Admin</div>
<div>ETS Enterprise Technology Services</div>
<div>University of California Santa Barbara</div>
<div><br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Tue, Nov 26, 2019 at 2:44
PM Christopher Bongaarts <<a href="mailto:cab@umn.edu" target="_blank">cab@umn.edu</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Check
the contents and permissions of your InCommon metadata
validation <br>
certificate...<br>
<br>
On 11/26/2019 4:28 PM, Scott Gilbert wrote:<br>
> Caused by:
org.springframework.beans.factory.BeanCreationException: <br>
> Error creating bean with name '(inner bean)#5ff6431a':
Invocation of <br>
> init method failed; nested exception is <br>
> org.cryptacular.StreamException: IO error<br>
> at <br>
>
org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1631)<br>
> Caused by: org.cryptacular.StreamException: IO error<br>
> at
org.cryptacular.util.CertUtil.readCertificateChain(CertUtil.java:328)<br>
> Caused by: java.io.IOException: Incomplete data<br>
> at
sun.security.provider.X509Factory.readOneBlock(X509Factory.java:612)<br>
> 2019-11-26 14:07:11,867 - - ERROR <br>
>
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:186]
<br>
> - Service 'shibboleth.MetadataResolverService': No
further attempts <br>
> will be made to reload<br>
<br>
-- <br>
%% Christopher A. Bongaarts %% <a href="mailto:cab@umn.edu" target="_blank">cab@umn.edu</a> %%<br>
%% OIT - Identity Management %% <a href="http://umn.edu/~cab" rel="noreferrer" target="_blank">http://umn.edu/~cab</a> %%<br>
%% University of Minnesota %% +1 (612) 625-1809 %%<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></blockquote>
</div>
<br>
<fieldset></fieldset>
</blockquote>
<pre cols="72">--
%% Christopher A. Bongaarts %% <a href="mailto:cab@umn.edu" target="_blank">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a href="http://umn.edu/~cab" target="_blank">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</div>
</blockquote></div>
</blockquote></div>