<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">I am trying to add SAML support to our product. In order to do that I need a working SP/IdP running locally that I can use when developing. The plan is to install Shibboleth SP v3 with Apache 2.4 and Shibboleth IdP v4 on my Windows 10 machine.
The IdP would then use either ApacheDS or our live AD for authentication. I have everything installed, but not configured correctly.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I access my ‘secure’ test page and am redirected to the IdP which displays the error text:
<o:p></o:p></p>
<p class="MsoNormal">Web Login Service - Error<o:p></o:p></p>
<p class="MsoNormal">An error occurred: FlowExecutionException<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The idp-process and idp-warn logs show this error message:<o:p></o:p></p>
<p class="MsoNormal">----------------------------------------------------------------------------------------<o:p></o:p></p>
<p class="MsoNormal">2020-11-25 09:28:36,263 - fe80:0:0:0:b44a:cf04:d3df:4917%9 - ERROR [org.springframework.webflow.execution.FlowExecutionException:74] -
<o:p></o:p></p>
<p class="MsoNormal">org.springframework.webflow.execution.FlowExecutionException: Exception thrown in state 'CallAuthenticationFlow' of flow 'authn'<o:p></o:p></p>
<p class="MsoNormal"> at org.springframework.webflow.engine.impl.FlowExecutionImpl.wrap(FlowExecutionImpl.java:573)<o:p></o:p></p>
<p class="MsoNormal">Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.authn.Password.Validators': Cannot resolve reference to bean 'shibboleth.LDAPValidator' while setting bean property 'sourceList'
with key [0]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'ValidateUsernamePasswordAgainstLDAP' defined in file [C:\Program Files (x86)\Shibboleth\IdP\system\flows\authn\password-authn-beans.xml]:
Cannot resolve reference to bean 'shibboleth.authn.LDAP.authenticator' while setting bean property 'authenticator'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.authn.LDAP.authenticator'
defined in file [C:\Program Files (x86)\Shibboleth\IdP\conf\authn\ldap-authn-config.xml]: Invocation of init method failed; nested exception is java.lang.IllegalArgumentException: java.security.GeneralSecurityException: java.io.FileNotFoundException: ServletContext
resource [/C:/Program Files (x86)/Shibboleth/IdP/credentials/ldap-server.crt] cannot be resolved to absolute file path - web application archive not expanded?<o:p></o:p></p>
<p class="MsoNormal"> at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:342)<o:p></o:p></p>
<p class="MsoNormal">Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'ValidateUsernamePasswordAgainstLDAP' defined in file [C:\Program Files (x86)\Shibboleth\IdP\system\flows\authn\password-authn-beans.xml]:
Cannot resolve reference to bean 'shibboleth.authn.LDAP.authenticator' while setting bean property 'authenticator'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.authn.LDAP.authenticator'
defined in file [C:\Program Files (x86)\Shibboleth\IdP\conf\authn\ldap-authn-config.xml]: Invocation of init method failed; nested exception is java.lang.IllegalArgumentException: java.security.GeneralSecurityException: java.io.FileNotFoundException: ServletContext
resource [/C:/Program Files (x86)/Shibboleth/IdP/credentials/ldap-server.crt] cannot be resolved to absolute file path - web application archive not expanded?<o:p></o:p></p>
<p class="MsoNormal"> at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:342)<o:p></o:p></p>
<p class="MsoNormal">Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.authn.LDAP.authenticator' defined in file [C:\Program Files (x86)\Shibboleth\IdP\conf\authn\ldap-authn-config.xml]: Invocation
of init method failed; nested exception is java.lang.IllegalArgumentException: java.security.GeneralSecurityException: java.io.FileNotFoundException: ServletContext resource [/C:/Program Files (x86)/Shibboleth/IdP/credentials/ldap-server.crt] cannot be resolved
to absolute file path - web application archive not expanded?<o:p></o:p></p>
<p class="MsoNormal"> at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1796)<o:p></o:p></p>
<p class="MsoNormal">Caused by: java.lang.IllegalArgumentException: java.security.GeneralSecurityException: java.io.FileNotFoundException: ServletContext resource [/C:/Program Files (x86)/Shibboleth/IdP/credentials/ldap-server.crt] cannot be resolved to absolute
file path - web application archive not expanded?<o:p></o:p></p>
<p class="MsoNormal"> at org.ldaptive.provider.unboundid.UnboundIDProvider.getConnectionFactory(UnboundIDProvider.java:51)<o:p></o:p></p>
<p class="MsoNormal">Caused by: java.security.GeneralSecurityException: java.io.FileNotFoundException: ServletContext resource [/C:/Program Files (x86)/Shibboleth/IdP/credentials/ldap-server.crt] cannot be resolved to absolute file path - web application archive
not expanded?<o:p></o:p></p>
<p class="MsoNormal"> at net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig.createSSLContextInitializer(X509ResourceCredentialConfig.java:107)<o:p></o:p></p>
<p class="MsoNormal">Caused by: java.io.FileNotFoundException: ServletContext resource [/C:/Program Files (x86)/Shibboleth/IdP/credentials/ldap-server.crt] cannot be resolved to absolute file path - web application archive not expanded?<o:p></o:p></p>
<p class="MsoNormal"> at org.springframework.web.util.WebUtils.getRealPath(WebUtils.java:344)<o:p></o:p></p>
<p class="MsoNormal">----------------------------------------------------------------------------------------<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The gist of which seems to be that it can’t find “/C:/Program Files (x86)/Shibboleth/IdP/credentials/ldap-server.crt”. Which is fair enough since it doesn’t exist.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Is it possible to use LDAP without a certificate?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This chunk of IdP/conf/ldap.properties looks like this:<o:p></o:p></p>
<p class="MsoNormal">----------------------------------------------------------------------------------------<o:p></o:p></p>
<p class="MsoNormal">## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust<o:p></o:p></p>
<p class="MsoNormal">#idp.authn.LDAP.sslConfig = certificateTrust<o:p></o:p></p>
<p class="MsoNormal">## If using certificateTrust above, set to the trusted certificate's path<o:p></o:p></p>
<p class="MsoNormal">idp.authn.LDAP.trustCertificates=%{idp.home}/credentials/ldap-server.crt<o:p></o:p></p>
<p class="MsoNormal">## If using keyStoreTrust above, set to the truststore path<o:p></o:p></p>
<p class="MsoNormal">idp.authn.LDAP.trustStore=%{idp.home}/credentials/ldap-server.truststore<o:p></o:p></p>
<p class="MsoNormal">----------------------------------------------------------------------------------------<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">If I comment out the .trustCertificates and .trustStore I get the same error, but the path it can’t find is [/undefined].<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">My ldap connection string starts with ldap:// and not ldaps://.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have the same issue whether I’m setup for AD or for generic LDAP.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Any ideas or other info I can send?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">Joshua<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>