[Shib-Users] Installation Woes on Mac OS X 10.5.7

[John Paul Hayes]

Hello All,

I am currently trying to install Shibboleth on my "test environment"
which is a macbook running OS X 10.5.7 and I have run into difficulty
installing Xerces-c 3.0.1
So far I have successfully installed the following requirements as far
as I can tell.

libcurl: (not needed on 10.4, or use ./configure --disable-static --
without-ca-bundle --enable-thread --with-ssl --prefix=/opt/shibboleth-sp
log4shib: ./configure --disable-static --disable-doxygen --prefix=/opt/
shibboleth-sp
ICU: ./configure --prefix=/opt/shibboleth-sp

I am working through the list of requirements listed here:
https://spaces.internet2.edu/display/SHIB2/NativeSPMacSourceBuild

Running make give the following output:

make all-recursive
Making all in src
Making all in xercesc/util/MsgLoaders/ICU/resources
/opt/shibboleth-sp/bin/genrb root.txt
dyld: Library not loaded: libicutu.42.dylib
Referenced from: /opt/shibboleth-sp/bin/genrb
Reason: image not found
make[3]: *** [root.res] Trace/BPT trap
make[2]: *** [all-recursive] Error 1
make[1]: *** [all-recursive] Error 1
make: *** [all] Error 2

Has anybody encountered this problem before?

Thanks in advance,
JP

[Alan Brenner]

make  all-recursive
Making all in src
Making all in xercesc/util/MsgLoaders/ICU/resources
/opt/shibboleth-sp/bin/genrb root.txt
dyld: Library not loaded: libicutu.42.dylib
 Referenced from: /opt/shibboleth-sp/bin/genrb
 Reason: image not found
make[3]: *** [root.res] Trace/BPT trap
make[2]: *** [all-recursive] Error 1
make[1]: *** [all-recursive] Error 1
make: *** [all] Error 2

Did you define ICUROOT and DYLD_LIBRARY_PATH prior to running configure and make (possibly ICUROOT=/opt/shibboleth-sp and DYLD_LIBRARY_PATH=/opt/shibboleth-sp/lib)?

[John Paul Hayes]

No I didn't. 

I just defined them in my path and am still receiving the same error as in original post.

[Scott Cantor]

John Paul Hayes wrote on 2009-07-29:
> Has anybody encountered this problem before?

I haven't done a source build since I switched the suggested model to
Macports. I would suggest trying that, and if you're insistent on using a
source build, at least use the macport build of Xerces on verbose to see
what that step looks like. Might give you a clue.

ICUROOT isn't needed, that's fixed in Xerces 3.

-- Scott

[jha...@usc.edu]

Funny, just yesterday I took on building Shib on Mac OS X Server 10.5.7, and I'm running into the exact same problem.

I tried the MacPorts way first, but there's a problem with Xerces-C in that setup. I filed a bug in MacPorts http://trac.macports.org/ticket/20484 but it seems I put it in the wrong place, so it's been apparently refiled against Shibboleth.

Today I tried the source method referenced earlier, and got the same thing when it came to building xercesc:

Making all in xercesc/util/MsgLoaders/ICU/resources
/opt/shibboleth-sp/bin/genrb root.txt
dyld: Library not loaded: libicutu.42.dylib
Referenced from: /opt/shibboleth-sp/bin/genrb
Reason: image not found

Scott, when you write, "ICUROOT isn't needed, that's fixed in Xerces 3" -- does that mean the configure command can be changed from:

./configure --prefix=/opt/shibboleth-sp --disable-static --enable-netaccessor-socket --enable-transcoder-icu --enable-msgloader-icu --with-icu=/opt/shibboleth-sp

to

./configure --prefix=/opt/shibboleth-sp --disable-static --enable-netaccessor-socket

Or does the build of ICU also have to change?

Thanks,
Jeep

[Scott Cantor]

jha...@usc.edu wrote on 2009-07-30:
> Funny, just yesterday I took on building Shib on Mac OS X Server 10.5.7,
and
> I'm running into the exact same problem.

Well, as of recently, we have a bigger problem, which is that Xerces 3 and
ICU 4.2 don't work together. I don't see a fix for that yet. So all the docs
are essentially out of date (which is why I don't like writing such detailed
docs).

> I tried the MacPorts way first, but there's a problem with Xerces-C in
that
> setup. I filed a bug in MacPorts http://trac.macports.org/ticket/20484 but
> it seems I put it in the wrong place, so it's been apparently refiled
> against Shibboleth.

I created a ticket on that today myself. The ports were put into the main
tree literally *today*, without my knowing about it ahead of time. From your
bug, I see that apparently they got there from your report, so I'm now
retroactively involved and working to clean all this up.

I have no control whatsoever over all these dependent projects, but I'm
doing my best to find solutions.

> Scott, when you write, "ICUROOT isn't needed, that's fixed in Xerces 3" --
> does that mean the configure command can be changed from:

No, I meant that ICUROOT isn't needed, nothing more. All those silly
environment variables from the old Xerces build are unneeded, the configure
script is fixed now.

> Or does the build of ICU also have to change?

If you don't use ICU, OS X spits out horrendously ugly all-caps messages
about forking when Apache runs.

At this point, it's basically "all broken". A source build using an older
ICU should work, and a source build using no ICU will result in Apple's
warnings and may or may not work.

-- Scott

[Jeep Hauser]

Scott Cantor wrote, On 7/30/09 1:05 PM:

> Well, as of recently, we have a bigger problem, which is that Xerces 3 and
> ICU 4.2 don't work together. I don't see a fix for that yet. So all the docs
> are essentially out of date (which is why I don't like writing such detailed
> docs).
>

Yep, the details can be blessing for us, a curse for you... totally
understood.

> I created a ticket on that today myself. The ports were put into the main
> tree literally *today*, without my knowing about it ahead of time. From your
> bug, I see that apparently they got there from your report, so I'm now
> retroactively involved and working to clean all this up.
>
> I have no control whatsoever over all these dependent projects, but I'm
> doing my best to find solutions.
>

Thank you -- apologies if my report threw a wrench into things. I
appreciate the work.

> At this point, it's basically "all broken". A source build using an older
> ICU should work, and a source build using no ICU will result in Apple's
> warnings and may or may not work.
>

I'll keep an eye out for an update, and if I find anything else, will
let you know.

Jeep

[Scott Cantor]

Jeep Hauser wrote on 2009-07-30:
> I'll keep an eye out for an update, and if I find anything else, will
> let you know.

I told the port maintainer out of band that a temp fix was probably to pull
the ICU dependency, so if you want to do a source build that way and test
it, that would help. I have no specific knowledge as to what those Apple
warnings impact in practice.

-- Scott

[Scott Cantor]

Jeep Hauser wrote on 2009-07-30:

> I'll keep an eye out for an update, and if I find anything else, will
> let you know.

There's a possible fix to the xercesc3 port now, it needs to be tested. In
particular to figure out if the Apple warnings still appear when running
Apache or not.

-- Scott

[Jeep Hauser]

Scott Cantor wrote, On 7/31/09 9:11 AM:

There's a possible fix to the xercesc3 port now, it needs to be tested. In
particular to figure out if the Apple warnings still appear when running
Apache or not.

  

I just did a clean build, and while I did get past the xercesc build, when it came to installing Shib, there's a diff missing that it's still looking for.

--->  Fetching shibboleth
--->  Attempting to fetch xercesc-c-nocf.diff from http://distfiles.macports.org/shibboleth
--->  Attempting to fetch xercesc-c-nocf.diff from http://arn.se.distfiles.macports.org/shibboleth
--->  Attempting to fetch xercesc-c-nocf.diff from http://aarnet.au.distfiles.macports.org/pub/macports/mpdistfiles/shibboleth
--->  Attempting to fetch xercesc-c-nocf.diff from http://svn.macports.org/repository/macports/distfiles/shibboleth
--->  Attempting to fetch xercesc-c-nocf.diff from http://svn.macports.org/repository/macports/distfiles/general/
--->  Attempting to fetch xercesc-c-nocf.diff from http://svn.macports.org/repository/macports/downloads/shibboleth
Error: Target org.macports.fetch returned: fetch failed
Error: Status 1 encountered during processing.

Thanks!

Jeep

--

Jeep Hauser
Director, IT & Communications

University of Southern California
Career Planning & Placement Center
jha...@usc.edu
http://careers.usc.edu

[Scott Cantor]

> I just did a clean build, and while I did get past the xercesc build, when
> it came to installing Shib, there's a diff missing that it's still looking
> for.

That patch isn't even for Shibboleth, it was some obsolete fix to get an old
version of the parser to build differently. I don't know why that's in their
portfile, it certainly wasn't in my version. I filed a defect.

-- Scott

[Scott Cantor]

Scott Cantor wrote on 2009-08-03:
> That patch isn't even for Shibboleth, it was some obsolete fix to get an
old
> version of the parser to build differently. I don't know why that's in
their
> portfile, it certainly wasn't in my version. I filed a defect.

The port's been fixed, I believe, so you can try it again.

I have a request in to get commit access so I can fix them myself if they
break again.

-- Scott

[Jeep Hauser]

Scott Cantor wrote, On 8/3/09 6:21 PM:

The port's been fixed, I believe, so you can try it again.

I have a request in to get commit access so I can fix them myself if they
break again.


  

Hi Scott,

Well, it builds!

However, when configured and ran, I get this:

Cannot load /opt/local/lib/shibboleth/mod_shib_22.so into server: dlopen(/opt/local/lib/shibboleth/mod_shib_22.so, 10): no suitable image found.  Did find:\n\t/opt/local/lib/shibboleth/mod_shib_22.so: mach-o, but wrong architecture

Is that the error you were mentioning earlier that Mac OS X complains about (and should be ignored)? When I enable shib, apache stops responding to web requests, so I have to either find where I went wrong in the config xml files, or find out if the above error is a real one.

The shibd.log looks like normal operations, no errors being reported there. The above error is from the OS system.log.

Thanks for the help,

[Scott Cantor]

Jeep Hauser wrote on 2009-08-04:
> Is that the error you were mentioning earlier that Mac OS X complains
about
> (and should be ignored)? When I enable shib, apache stops responding to
web
> requests, so I have to either find where I went wrong in the config xml
> files, or find out if the above error is a real one.

No, that's the error I said I instructed people how to fix but can't find
anybody to properly investigate the merits of said fix.

https://spaces.internet2.edu/display/SHIB2/NativeSPMacApache32

People claim it's breaking their system irreversibly when there is simply no
physical way I can see for that to be true.

The fix aside, Apple has no business shipping a 64-bit web server on a
platform whose default build settings are 32-bit. That's just stupid.

-- Scott

[Jeep Hauser]

Scott Cantor wrote, On 8/4/09 2:17 PM:

No, that's the error I said I instructed people how to fix but can't find
anybody to properly investigate the merits of said fix.

https://spaces.internet2.edu/display/SHIB2/NativeSPMacApache32

People claim it's breaking their system irreversibly when there is simply no
physical way I can see for that to be true.
  

Looks like that fixed everything, and shib seems to be working quite well. I don't understand that other user's comment, they're text files... just edit them back to the original...

The fix aside, Apple has no business shipping a 64-bit web server on a
platform whose default build settings are 32-bit. That's just stupid.

  

So many choice words could be used to describe this 32/64 bit Leopard mess...

[Scott Cantor]

Jeep Hauser wrote on 2009-08-04:

> Looks like that fixed everything, and shib seems to be working quite well.
I
> don't understand that other user's comment, they're text files... just
edit
> them back to the original...

Ok, that's something, anyway. First I needed confirmation that it worked,
and that I wasn't confused about why it breaking things made no sense. I'll
leave solving whatever's going wrong for another tester, I guess.

Thanks for your help...
-- Scott