<div dir="ltr"><div>Re. 1) (The loading speed) - Thanks for the information.</div><div><br></div><div>Re. 3) (the error and plugins) - Yes I did read that exact page but I missed the links. I read a LOT of stuff/pages ("drinking from a water hose" :)! ) , and I do remember seeing mention of Javascript and Nashorn earlier, but I kind of forgot about that :(. <br></div><div><br></div><div>FYI, I was now able to install the Nashorn plugin and the login is working now with no error. FYI, on my system, I have Tomcat deployed under a "/apps" directory (it is kind of our standard) and I originally put the Shibolleth stuff under "/apps" when I ran the "install.sh" but I quickly decided that it was not going to be good like that, so I had deleted the "/apps/shibboleth" and re-ran the "install.sh" and took the defaults, so Shibboleth is now in "/opt/shibboleth-idp" and Tomcat is in "/apps/apache-tomcat". So after I installed Nashorn, I noted that that built a new "idp.war" so I had to copy the new "idp.war" over to "/apps/apache-tomcat/webapps". I'll have to re-evaluate later.</div><div><br></div><div><br></div><div>Re. 2) I will review what you said in a bit because I think I still have some questions.</div><div><br></div><div>Thanks for your help - your responses got me past the main place where I was stuck (the uncaught exception)!</div><div><br></div><div><br></div><div><br></div><div>You had mentioned that I hadn't described what I was trying to do.... Actually, earlier on, I started writing about the background of what I was doing, but decided it was "too much"... Basically, we have been working for a long time (as you all may have guessed), with IAM stuff and with several COTS products, and I've been kind of tasked to take a current re-look at open-source, especially for the federation area, and that is why I've been working with Shibboleth most recently. Basically, I am trying to see how far we can reproduce the functionality that we have implemented with those COTs products.</div><div><br></div><div>Thanks again!</div><div><br></div><div>Jim</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Mar 26, 2025 at 9:53 PM Steven Premeau via users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><br></div><div dir="ltr">Jim -<div><br></div><div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Question 1: It is taking a long time for the log in page/form to appear. What might be the problem?</blockquote><div><br></div><div>If this is the first request to the application, this is likely normal. Java server applications are "lazy loaded".</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Question 2: How can the policy specify more than 1 username? Can I use a wildcard and/or regex?</blockquote><div><br></div><div>Larger groups of users are typically managed via attributes.</div><div><br></div><div>An example of how to configure multiple STATIC usernames can be found at:</div><div><a href="https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199509553/SubjectNamePredicate" target="_blank">https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199509553/SubjectNamePredicate</a></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Question 3: Can someone explain what I need to do to get past the above?</blockquote><div><br></div><div>You have not indicated whether you have read the documentation wiki page on HelloWorld:</div><div><a href="https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510241/HelloWorldConfiguration" target="_blank">https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510241/HelloWorldConfiguration</a></div></div><div><br></div><div>"... use of this module relies on the use of Javascript, so you will have to select and install one of our scripting plugins for that purpose due to Java’s removal of Javascript support."</div><div><br></div><div>Although there are a fair number of helpful individuals, it is difficult for this list to provide step-by-step assistance.</div><div><br></div><div>(Looking at your past messages) It does not seem that you have mentioned what organization you are with and what your larger goal(s) are for your Shibboleth IDP installation. If you are able to provide more context, it may be possible to point you to additional (and more relevant) resources.</div><div><br></div><div>As a last resort, there are some commercial (paid) resources that could provide training or implementation assistance. One place to look would be the "Commercial Support" options listed 1/2 down the page at <a href="https://www.shibboleth.net/support/" target="_blank">https://www.shibboleth.net/support/</a></div><div><br></div><div>Steve.</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Mar 26, 2025 at 7:28 PM o haya via users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Hi,</div><div><br></div><div>So I am trying to get the Hello World test of the IdP working. </div><div><br></div><div>Per my previous email thread I am now able to get the log in page, and, also, from the logging, I am able to get past the authentication (user=test1).</div><div><br></div><div><br></div><div>Question 1: It is taking a long time for the log in page/form to appear. What might be the problem?</div><div><br></div><div><br></div><div>However, after the authentication, it got a denied, so I checked the log and it mentioned it couldn't find a policy for AccessByAdminUser.</div><div><br></div><div>So I checked the access-control.xml and the AccessByAdminUser section was commented out.</div><div><br></div><div>So I uncommented it and change the user to 'test1':</div><div><br></div><div> <entry key="AccessByAdminUser"><br> <bean parent="shibboleth.PredicateAccessControl"><br> <constructor-arg><br> <bean parent="shibboleth.Conditions.SubjectName" c:collection="#{'test1'}" /><br> </constructor-arg><br> </bean><br> </entry><br></div><div><br></div><div>Question 2: How can the policy specify more than 1 username? Can I used a wildcard and/or regex?</div><div><br></div><div><br></div><div><br></div><div>After I changed the access-control.xml, I am still getting a denied, and when I look at the log I get a response page:</div><div><br></div><div>
<h1 style="margin:0px 0px 1em;padding:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-variant-alternates:inherit;font-weight:700;font-stretch:inherit;font-size:1.5rem;line-height:1.75rem;font-family:"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";font-size-adjust:inherit;font-kerning:inherit;font-feature-settings:inherit;vertical-align:baseline;box-sizing:border-box;background:rgb(255,255,255) no-repeat;border:0px;outline:0px;color:rgb(50,66,74);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;word-spacing:0px;white-space:normal;text-decoration-style:initial;text-decoration-color:initial">Web Login Service - Uncaught Exception</h1><p style="margin:0px 0px 1em;padding:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-variant-alternates:inherit;font-weight:400;font-stretch:inherit;font-size:16px;line-height:inherit;font-family:"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";font-size-adjust:inherit;font-kerning:inherit;font-feature-settings:inherit;vertical-align:baseline;box-sizing:border-box;background:rgb(255,255,255) no-repeat;border:0px;outline:0px;color:rgb(50,66,74);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;word-spacing:0px;white-space:normal;text-decoration-style:initial;text-decoration-color:initial"></p><p style="margin:0px 0px 1em;padding:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-variant-alternates:inherit;font-weight:400;font-stretch:inherit;font-size:16px;line-height:inherit;font-family:"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";font-size-adjust:inherit;font-kerning:inherit;font-feature-settings:inherit;vertical-align:baseline;box-sizing:border-box;background:rgb(255,255,255) no-repeat;border:0px;outline:0px;color:rgb(50,66,74);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;word-spacing:0px;white-space:normal;text-decoration-style:initial;text-decoration-color:initial">A software error was encountered that prevents normal operation:</p><br style="margin:0px;padding:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-variant-alternates:inherit;font-weight:400;font-stretch:inherit;font-size:16px;line-height:inherit;font-family:"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";font-size-adjust:inherit;font-kerning:inherit;font-feature-settings:inherit;vertical-align:baseline;box-sizing:border-box;background:rgb(255,255,255) no-repeat;border:0px;outline:0px;color:rgb(50,66,74);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;word-spacing:0px;white-space:normal;text-decoration-style:initial;text-decoration-color:initial"><p style="margin:0px 0px 1em;padding:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-variant-alternates:inherit;font-weight:400;font-stretch:inherit;font-size:16px;line-height:inherit;font-family:"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";font-size-adjust:inherit;font-kerning:inherit;font-feature-settings:inherit;vertical-align:baseline;box-sizing:border-box;background:rgb(255,255,255) no-repeat;border:0px;outline:0px;color:rgb(50,66,74);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;word-spacing:0px;white-space:normal;text-decoration-style:initial;text-decoration-color:initial"><strong style="margin:0px;padding:0px;font-style:inherit;font-variant:inherit;font-weight:700;font-stretch:inherit;font-size:inherit;line-height:inherit;font-family:inherit;font-size-adjust:inherit;font-kerning:inherit;font-feature-settings:inherit;vertical-align:baseline;box-sizing:border-box;background:no-repeat;border:0px;outline:0px">org.springframework.binding.expression.EvaluationException: An ELException occurred getting the value for expression 'ScriptedAction' on context [class org.springframework.webflow.engine.impl.RequestControlContextImpl]</strong></p>
</div><div><br></div><div><br></div><div>Question 3: Can someone explain what I need to do to get past the above?</div><div><br></div><div>Thanks,</div><div>Jim</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div><div id="m_-587882999081130249m_2498833267142409339m_589462555171446816DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2"><br><table style="border-top:1px solid rgb(211,212,222)"><tbody><tr><td style="width:55px;padding-top:13px"><a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" target="_blank"><img alt="" width="46" height="29" style="width: 46px; height: 29px;"></a></td><td style="width:470px;padding-top:12px;color:rgb(65,66,78);font-size:13px;font-family:Arial,Helvetica,sans-serif;line-height:18px">Virus-free.<a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" style="color:rgb(68,83,234)" target="_blank">www.avast.com</a></td></tr></tbody></table><a href="#m_-587882999081130249_m_2498833267142409339_m_589462555171446816_DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" width="1" height="1"></a></div>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div></div>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>