<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi all!</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I am currently investigating in issue in the Shibboleth installation I am having.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I have a script that installs shibboleth into a directory and runs it on top of a WildFly (likely not related) and a JBoss 8.0.0 server.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
That works but the sealer has some issue I cannot find the reason for. So this is the end of the long stack trace:</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
=</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.DataSealer' defined in class path resource [net/shibboleth/idp/conf/sealer.xml]: Cannot resolve reference to bean '#{ 'shibbol<br>
eth.DataSealerKeyStrategy'.trim() }' while setting bean property 'keyStrategy' <br>
at deployment.idp.war//org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:377)
<br>
at deployment.idp.war//org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveValueIfNecessary(BeanDefinitionValueResolver.java:135)
<br>
at deployment.idp.war//org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.applyPropertyValues(AbstractAutowireCapableBeanFactory.java:1705)
<br>
at deployment.idp.war//org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1454)
<br>
at deployment.idp.war//org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:599)
<br>
at deployment.idp.war//org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:522)
<br>
at deployment.idp.war//org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:337)
<br>
at deployment.idp.war//org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234)
<br>
at deployment.idp.war//org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:335)
<br>
at deployment.idp.war//org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:200)
<br>
at deployment.idp.war//org.springframework.beans.factory.config.BeanExpressionContext.getObject(BeanExpressionContext.java:60)
<br>
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
<br>
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
<br>
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
<br>
at java.base/java.lang.reflect.Method.invoke(Method.java:569) <br>
at deployment.idp.war//org.springframework.expression.spel.support.ReflectiveMethodExecutor.execute(ReflectiveMethodExecutor.java:142)
<br>
at deployment.idp.war//org.springframework.expression.spel.ast.MethodReference.getValueInternal(MethodReference.java:152)
<br>
at deployment.idp.war//org.springframework.expression.spel.ast.MethodReference.getValueInternal(MethodReference.java:108)
<br>
at deployment.idp.war//org.springframework.expression.spel.ast.Ternary.getValueInternal(Ternary.java:59)
<br>
at deployment.idp.war//org.springframework.expression.spel.ast.SpelNodeImpl.getValue(SpelNodeImpl.java:114)
<br>
at deployment.idp.war//org.springframework.expression.spel.standard.SpelExpression.getValue(SpelExpression.java:273)
<br>
at deployment.idp.war//org.springframework.context.expression.StandardBeanExpressionResolver.evaluate(StandardBeanExpressionResolver.java:183)
<br>
... 76 more <br>
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.DataSealerKeyStrategy' defined in class path resource [net/shibboleth/idp/conf/sealer.xml]: Exception loading the default key
<br>
at deployment.idp.war//org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1806)
<br>
at deployment.idp.war//org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:600)
<br>
at deployment.idp.war//org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:522)
<br>
at deployment.idp.war//org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:337)
<br>
at deployment.idp.war//org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234)
<br>
at deployment.idp.war//org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:335)
<br>
at deployment.idp.war//org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:200)
<br>
at deployment.idp.war//org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:365)
<br>
... 97 more <br>
Caused by: net.shibboleth.shared.component.ComponentInitializationException: Exception loading the default key
<br>
at deployment.idp.war//net.shibboleth.shared.security.impl.BasicKeystoreKeyStrategy.doInitialize(BasicKeystoreKeyStrategy.java:250)
<br>
at deployment.idp.war//net.shibboleth.shared.component.AbstractInitializableComponent.initialize(AbstractInitializableComponent.java:62)
<br>
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
<br>
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
<br>
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
<br>
at java.base/java.lang.reflect.Method.invoke(Method.java:569) <br>
at deployment.idp.war//org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeCustomInitMethod(AbstractAutowireCapableBeanFactory.java:1910)
<br>
at deployment.idp.war//org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1863)
<br>
at deployment.idp.war//org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1802)
<br>
... 104 more <br>
Caused by: java.security.KeyException: java.io.IOException: Keystore was tampered with, or password was incorrect
<br>
at deployment.idp.war//net.shibboleth.shared.security.impl.BasicKeystoreKeyStrategy.getKey(BasicKeystoreKeyStrategy.java:337)
<br>
at deployment.idp.war//net.shibboleth.shared.security.impl.BasicKeystoreKeyStrategy.updateDefaultKey(BasicKeystoreKeyStrategy.java:388)
<br>
at deployment.idp.war//net.shibboleth.shared.security.impl.BasicKeystoreKeyStrategy.doInitialize(BasicKeystoreKeyStrategy.java:246)
<br>
... 112 more <br>
Caused by: java.io.IOException: Keystore was tampered with, or password was incorrect
<br>
at java.base/com.sun.crypto.provider.JceKeyStore.engineLoad(JceKeyStore.java:882)
<br>
at java.base/java.security.KeyStore.load(KeyStore.java:1473) <br>
at deployment.idp.war//net.shibboleth.shared.security.impl.BasicKeystoreKeyStrategy.getKey(BasicKeystoreKeyStrategy.java:322)
<br>
... 114 more <br>
Caused by: java.security.UnrecoverableKeyException: Password verification failed <br>
... 117 more <br>
<br>
07:24:40,899 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("deploy") failed - address: ([("deployment" => "idp.war")]) - failure description: {"WFLYCTL0080: Failed services" => {"o<br>
rg.wildfly.undertow.deployment.default-server.default-host./se-idp" => "java.lang.RuntimeException: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.AuthenticationFlow$child#0' defined i<br>
n class path resource [net/shibboleth/idp/conf/authn-system.xml]: Cannot resolve reference to bean 'shibboleth.PrincipalServiceManager' while setting bean property 'principalServiceManager'
<br>
Caused by: java.lang.RuntimeException: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.AuthenticationFlow$child#0' defined in class path resource [net/shibboleth/idp/conf/authn-syst<br>
em.xml]: Cannot resolve reference to bean 'shibboleth.PrincipalServiceManager' while setting bean property 'principalServiceManager'
<br>
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.AuthenticationFlow$child#0' defined in class path resource [net/shibboleth/idp/conf/authn-system.xml]: Cannot resolve refe<br>
rence to bean 'shibboleth.PrincipalServiceManager' while setting bean property 'principalServiceManager'
<br>
Caused by: org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'shibboleth.PrincipalServiceManager' defined in class path resource [net/shibboleth/idp/conf/authn-system.xml]: Unsatisfied d<br>
ependency expressed through constructor parameter 0: Error creating bean with name 'net.shibboleth.idp.authn.principal.GenericPrincipalService#5' defined in class path resource [net/shibboleth/idp/conf/authn-system.xml]: Cannot create i<br>
nner bean 'net.shibboleth.idp.authn.principal.SealedPrincipalSerializer#7e618ee7' of type [net.shibboleth.idp.authn.principal.SealedPrincipalSerializer] while setting constructor argument
<br>
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'net.shibboleth.idp.authn.principal.GenericPrincipalService#5' defined in class path resource [net/shibboleth/idp/conf/authn-system.xm<br>
l]: Cannot create inner bean 'net.shibboleth.idp.authn.principal.SealedPrincipalSerializer#7e618ee7' of type [net.shibboleth.idp.authn.principal.SealedPrincipalSerializer] while setting constructor argument
<br>
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'net.shibboleth.idp.authn.principal.SealedPrincipalSerializer#7e618ee7' defined in class path resource [net/shibboleth/idp/conf/authn-<br>
system.xml]: Expression parsing failed <br>
Caused by: org.springframework.beans.factory.BeanExpressionException: Expression parsing failed
<br>
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.DataSealer' defined in class path resource [net/shibboleth/idp/conf/sealer.xml]: Cannot resolve reference to bean '#{ 'shi<br>
bboleth.DataSealerKeyStrategy'.trim() }' while setting bean property 'keyStrategy'
<br>
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.DataSealerKeyStrategy' defined in class path resource [net/shibboleth/idp/conf/sealer.xml]: Exception loading the default<br>
key <br>
Caused by: net.shibboleth.shared.component.ComponentInitializationException: Exception loading the default key
<br>
Caused by: java.security.KeyException: java.io.IOException: Keystore was tampered with, or password was incorrect
<br>
<span style="color: rgb(237, 92, 87);"> Caused by: java.io.IOException: Keystore was tampered with, or password was incorrect
<br>
Caused by: java.security.UnrecoverableKeyException: Password verification failed"}}</span><br>
=</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Shibboleth tries to open the sealer file with the configured password, but the generated store (created during the install script of shibboleth) seems to fail as the password of the store seems to be not correct.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I use this properties for the installation:</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
idp.target.dir=/opt/idp</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
idp.entityID=redacted</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
idp.host.name=redacted</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
idp.scope=redacted</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
idp.keysize=4096</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
idp.keystore.password=redacted</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
idp.sealer.password=redacted</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
idp.conf.credentials.filemode=600</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I tried to open the keytore in KSE (Keystore Explorer; <a href="https://keystore-explorer.org/" id="LPlnk960596">
https://keystore-explorer.org/</a>) and it seems to run into the same issue.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Version:</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
/usr/lib/jvm/java-17-openjdk/bin/java --version <br>
openjdk 17.0.12 2024-07-16 LTS <br>
OpenJDK Runtime Environment (Red_Hat-17.0.12.0.7-2.0.1) (build 17.0.12+7-LTS) <br>
OpenJDK 64-Bit Server VM (Red_Hat-17.0.12.0.7-2.0.1) (build 17.0.12+7-LTS, mixed mode, sharing)</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
IDP Version:</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
5.1.3</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Any idea, what causes that the password is not properly set on the keystore. I can confirm with the debugger, that the password from the config is passed down, which is the one that was created in the installation properties. Is there some workaround to manually
created that keystore?</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Kind Regards</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Fabian Franz BSc.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Alpega TMS Austria SaaS GmbH.</div>
</body>
</html>