[Shib-Users] Shibboleth SP 1.3 to Shibboleth SP 2.0 how to upgrade.

Richard Genthner

unread,

Dec 4, 2009, 10:35:19 AM12/4/09

to shibboleth-users

we are in the process of upgrading from shibboleth 1.3 to shibboleth
2.0, We have it installed but are trying to figure out how we move the
configurations from shib 1.3 to shib 2.0. Since this isn't documentation
on this subject matter I was hoping that someone out there might have
gone though this process before and might want to share some information
on it. We automatically pull down incommon-meta data for 1.3 so I'm
hoping the process is going to be the same. Any help would be great.

--
Thanks,
Richard Genthner
Systems Administrator
Symplicity
tel. 703-351-0200x8051

Scott Cantor

unread,

Dec 4, 2009, 10:59:15 AM12/4/09

to shibbole...@internet2.edu

Richard Genthner wrote on 2009-12-04:
> we are in the process of upgrading from shibboleth 1.3 to shibboleth
> 2.0, We have it installed but are trying to figure out how we move the
> configurations from shib 1.3 to shib 2.0. Since this isn't documentation
> on this subject matter I was hoping that someone out there might have
> gone though this process before and might want to share some information
> on it.

You may find some useful information in my local documentation:

https://webauth.service.ohio-state.edu/~shibboleth/upgrade.html

There isn't really that much to say about it, really, most of the settings transfer in pretty obvious ways except for more obscure things like cache policies.

> We automatically pull down incommon-meta data for 1.3 so I'm
> hoping the process is going to be the same. Any help would be great.

You don't have to do anything special to refresh the metadata, the software does it for you now. All of that is documented.

-- Scott

Richard Genthner

unread,

Dec 4, 2009, 11:25:26 AM12/4/09

to shibbole...@internet2.edu

Scott,
Whats the best way to convert our AAP.xml to the new layout. I was
looking at it and i'm not 100% sure i understand the
attribute-policy.xml role in this.

Scott Cantor

unread,

Dec 4, 2009, 11:32:22 AM12/4/09

to shibbole...@internet2.edu

Richard Genthner wrote on 2009-12-04:

> Whats the best way to convert our AAP.xml to the new layout. I was
> looking at it and i'm not 100% sure i understand the
> attribute-policy.xml role in this.

The AAP file did two separate, unrelated things, which are now managed by separate files. You have to start by knowing what you have and/or want to do, and then it's just a matter of doing it.

I advise people to avoid filtering. They don't usually seem to have any clear notion of what they're trying to accomplish, so it's best to do nothing. The default policy provides basic syntax and scoped attribute validation and passes everything else through, and that's sufficient for the majority of needs.

The mapping half of the process is much more straightforward and is thoroughly documented.

-- Scott

Richard Genthner

unread,

Dec 4, 2009, 11:41:02 AM12/4/09

to shibbole...@internet2.edu

Scott,
what we are not sure is how to convert Entries like this

from our AAP.xml. From what I'm seeing is that we would just have the
Rule, am I correct on this?

Peter Schober

unread,

Dec 4, 2009, 12:07:56 PM12/4/09

to shibbole...@internet2.edu

* Richard Genthner <rgen...@symplicity.com> [2009-12-04 17:41]:

> <AttributeRule Name="urn:mace:dir:attribute-def:wustlEduId"
> Header="WUSTL_EDUID" Alias="WUSTL_EDUID">
> <AnySite>
> <AnyValue/>
> </AnySite>
> </AttributeRule>
>
> from our AAP.xml. From what I'm seeing is that we would just have the
> Rule, am I correct on this?

Look at any entry in the attribute-map.xml and adjust to taste,
i.e. add a new line somewhere that's not inside an XML comment and
change the attribute and header name to match what you have above.
-peter

Richard Genthner

unread,

Dec 4, 2009, 2:00:19 PM12/4/09

to shibbole...@internet2.edu

Whats the difference between the Alias in sibboleth 1.3 and the ID in
shibboleth 2 are they the same thing?

Scott Cantor

unread,

Dec 4, 2009, 2:16:48 PM12/4/09

to shibbole...@internet2.edu

Richard Genthner wrote on 2009-12-04:

> Whats the difference between the Alias in sibboleth 1.3 and the ID in
> shibboleth 2 are they the same thing?

The Alias feature is described here:
https://spaces.internet2.edu/display/SHIB/AttributeAcceptancePolicy

There is no separation anymore between the internal names that determine environment and header variables, and names used in access control rules, so the old feature doesn't apply.

-- Scott

Peter Schober

unread,

Dec 4, 2009, 2:18:04 PM12/4/09

to shibbole...@internet2.edu

* Richard Genthner <rgen...@symplicity.com> [2009-12-04 20:01]:

> Whats the difference between the Alias in sibboleth 1.3 and the ID in
> shibboleth 2 are they the same thing?

Linked from
https://spaces.internet2.edu/display/SHIB2/NativeSPConfiguration
you'll find:
https://spaces.internet2.edu/display/SHIB2/NativeSPAddAttribute
"The name property in the rule corresponds to the formal SAML
name the IdP is using for the attribute, generally a URI. The id
property is the shorthand name to use, and determines the environment
variable or header by which the attribute will be made available to
the web application."

cheers,
-peter

Richard Genthner

unread,

Dec 4, 2009, 4:54:49 PM12/4/09

to shibbole...@internet2.edu

Scott,
I'm not getting how to convert my shibboleth.xml to the new
shibboleth2.xml. The layout is totally different. from this one, I have
shortened it up a bunch. I'm not sure how translate this file to
shibboleth2.xml Any help one this.

</Sessions>

<CredentialUse TLS="defcreds" Signing="defcreds">
</CredentialUse>


<AAPProvider type="edu.internet2.middleware.shibboleth.aap.provider.XMLAAP" uri="/etc/shibboleth/AAP.xml"/>

<TrustProvider type="edu.internet2.middleware.shibboleth.common.provider.ShibbolethTrust"/>

<saml:Audience>urn:mace:incommon</saml:Audience>
<Application id="psu" providerId="https://shibboleth.symplicity.com/sso"
homeURL="https://shibboleth.symplicity.com/index.html"
xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">

</Sessions>

<saml:AttributeDesignator AttributeName="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri"/>
<saml:AttributeDesignator AttributeName="urn:mace:dir:attribute-def:eduPersonPrincipalName" AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri"/>
<saml:AttributeDesignator AttributeName="urn:mace:dir:attribute-def:psCampusCode" AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri"/>
</Application>

<md:SingleLogoutService Location="/Logout" ResponseLocation="https://shibboleth-umbc.symplicity.com/sso/logout.php" Binding="urn:mace:shibboleth:sp:1.3:Logout"/>
</Sessions>
<CredentialUse TLS="umbc" Signing="umbc"> </CredentialUse>
<saml:AttributeDesignator AttributeName="urn:mace:dir:attribute-def:eduPersonPrincipalName" AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri"/>
</Application>
<Application id="northwestern" providerId="https://shibboleth-nw.symplicity.com/sso"
homeURL="https://shibboleth-nw.symplicity.com/index.html"
xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">

<md:AssertionConsumerService Location="/SAML/POST" isDefault="true" index="1"
Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"/>
<md:AssertionConsumerService Location="/SAML/Artifact" index="2"
Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"/>

<md:SingleLogoutService Location="/Logout" ResponseLocation="https://shibboleth-nw.symplicity.com/sso/logout.php" Binding="urn:mace:shibboleth:sp:1.3:Logout"/>
</Sessions>
<CredentialUse TLS="northwestern" Signing="northwestern">
</CredentialUse>
</Application>

<md:SingleLogoutService Location="/Logout" ResponseLocation="https://login.carleton.edu/idp/logout.jsp" Binding="urn:mace:shibboleth:sp:1.3:Logout"/>
</Sessions>
<CredentialUse TLS="carleton" Signing="carleton"></CredentialUse>
</Application>

<md:AssertionConsumerService Location="/SAML/POST" isDefault="true" index="1"
Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"/>
<md:AssertionConsumerService Location="/SAML/Artifact" index="2"
Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"/>

<md:SingleLogoutService Location="/Logout" ResponseLocation="https://shibboleth-nyu.symplicity.com/sso/logout.php" Binding="urn:mace:shibboleth:sp:1.3:Logout"/>
</Sessions>
<CredentialUse TLS="nyu" Signing="nyu"></CredentialUse>
</Application>

</Applications>

<CredentialsProvider type="edu.internet2.middleware.shibboleth.common.Credentials">
<Credentials xmlns="urn:mace:shibboleth:credentials:1.0">
<FileResolver Id="defcreds">
<Key>
<Path>/etc/shibboleth/certs/incommon.key</Path>
</Key>
<Certificate>
<Path>/etc/shibboleth/certs/sympincommon.cert</Path>
</Certificate>
</FileResolver>
<FileResolver Id="umbc">
<Key>
<Path>/etc/shibboleth/certs/incommon.key</Path>
</Key>
<Certificate>
<Path>/etc/shibboleth/certs/umbc.cert</Path>
</Certificate>
</FileResolver>
<FileResolver Id="northwestern">
<Key>
<Path>/etc/shibboleth/certs/incommon.key</Path>
</Key>
<Certificate>
<Path>/etc/shibboleth/certs/northwestern.cert</Path>
</Certificate>
</FileResolver>
</CredentialsProvider>

</SPConfig>

Scott Cantor

unread,

Dec 4, 2009, 5:59:40 PM12/4/09

to shibbole...@internet2.edu

> I'm not getting how to convert my shibboleth.xml to the new
> shibboleth2.xml. The layout is totally different.

No, it's almost exactly the same in most significant respects. The areas that differ that aren't just reordered or slightly renamed are typically low level settings that are the least changed or used.

The primary exception to that is where new features change the nature of the settings you use, which is most particularly true of the SessionInitiator feature.

> from this one, I have
> shortened it up a bunch. I'm not sure how translate this file to
> shibboleth2.xml Any help one this.

The most I'm prepared to do is provide a few bullet points about the old material where the translation isn't pretty obvious, and say that what you need to do is start with the 2.x defaults and apply the *changes* to those defaults that correspond to the old settings.

> <Extensions>
> <Library path="/usr/libexec/xmlproviders.so" fatal="true"/>
> </Extensions>

Irrelevant, that library no longer exists.

> <Global logger="/etc/shibboleth/shibd.logger">

Loosely maps to the OutOfProcess settings, mostly either obvious or too low level to worry about.

> <Local logger="/etc/shibboleth/native.logger" localRelayState="true">

Loosely maps to InProcess settings, mostly copyable in a straightforward way.

> <RequestMap applicationId="default">

Copyable totally or almost literally in most cases, by design.

> <SessionInitiator isDefault="true"
> id="https://shibboleth.symplicity.com/sso"
> Location="/WAYF/as1.fim.psu.edu"

Probably the only complex piece to translate and may not be needed now. A single global SessionInitiator inherited from the default application can point to any IdP by simply passing it an entityID parameter if you're using lazy session redirects, or (more likely) by adding an entityID property naming the IdP to use in the RequestMap under the appropriate content.

The key is that a hardwired initiator (avoiding discovery) needs an entityID property naming the IdP to use in the RequestMap or in the SessionInitiator element directly. By putting it in the map, you can reuse one common initiator and change the behavior dynamically from the content side.

In any case, you will never have references to IdP endpoints in your config any more, and those locations are replaced with the IdP's entityID instead. In general, the handler Location should be "/Login" in all cases to ensure consistency in building initiation URLs.

The examples in the file are designed to illustrate common use cases.

You should look at https://spaces.internet2.edu/display/SHIB2/NativeSPSessionInitiator carefully.

> <MetadataProvider
> type="edu.internet2.middleware.shibboleth.metadata.provider.XMLMetadata"
> uri="/etc/shibboleth/InCommon-metadata.xml"/>

The InCommon technical guide page has the exact configuration used for InCommon metadata loading.

https://spaces.internet2.edu/display/InCCollaborate/Technical+Guide

> <saml:Audience>urn:mace:incommon</saml:Audience>

Unneeded.

> <Application id="psu"
> providerId="https://shibboleth.symplicity.com/sso"
> homeURL="https://shibboleth.symplicity.com/index.html"
> xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
> xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">

These just become ApplicationOverride tags, different name, same thing.

The hassle of redefining all those embedded Sessions and handler elements should be gone, that's why the main task is to redesign how the SessionInitiator setup works and utilize the new features there.

-- Scott

Peter Schober

unread,

Dec 4, 2009, 8:58:16 PM12/4/09

to shibbole...@internet2.edu

* Scott Cantor <cant...@osu.edu> [2009-12-05 00:00]:

> > <Application id="psu"
> > providerId="https://shibboleth.symplicity.com/sso"
> > homeURL="https://shibboleth.symplicity.com/index.html"
> > xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
> > xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
>

> These just become ApplicationOverride tags, different name, same
> thing.

From a quick glance it seemed to me all those Applications (and
contained Sessions and SessionInitiators) could be remove completely,
since they all have their own vhost anyway.
(Don't know about the use of application- or IdP-specific credentials
though, since the OP seems to be using different credentials for each
application for whatever reason?)

Richard: have a look at this page, maybe this will help clearing this up:
https://spaces.internet2.edu/display/SHIB2/NativeSPApplicationModel

Instead of carrying over all the bits and pieces (which certainly is
possible) I'd rather do a clean reimplementation on another box.

Your config file (as sent to the list) is not well-formed, you're
missing the closing </Credentials> tag, xmlwf(1) will tell you the
exact location.
Anyway, posting a complete 200+ lines config file and expecting others
to convert it to transfer the relevant settings to another version for
you is /not/ how things work. Not on a community supported mailing list.

Note that there is an XSLT script (called 'upgrade.xsl') distributed
with the Shib 2.x SP that /will/ try a conversion from the old format
to the new (could be out of date, though, I never used it):

$ cd /etc/shibboleth
$ xsltproc upgrade.xsl shibboleth.xml > shibboleth2.xml

In case you don't have xsltproc (eponymous Debian package, on RHEL
it's libxslt) you can also use Saxon ('HE' is still open source and in
Java, so "runs anywhere"). Download, unzip, run on a machine with a
JRE (also from within /etc/shibboleth):

$ java -jar /path/to/saxon9he.jar -s:shibboleth.xml -xsl:upgrade.xsl -o:shibboleth2.xml

Both processors produce idential output from your config file, which,
as it stands, will not load with shibd (see
https://spaces.internet2.edu/display/SHIB2/NativeSPshibd how to check
that on your platform). But it might help get you started.
-peter

Scott Cantor

unread,

Dec 4, 2009, 10:15:58 PM12/4/09

to shibbole...@internet2.edu

Peter Schober wrote on 2009-12-04:
> From a quick glance it seemed to me all those Applications (and
> contained Sessions and SessionInitiators) could be remove completely,
> since they all have their own vhost anyway.

Well, the main use seems to be to override the entityID, which I'm slightly
aware of from conversations regarding Symplicity on the InCommon TAC calls.
That's fine, though it creates more work to setup, but in general you want
to if possible limit what you need to something simple like:

Where possible everything else should default in and/or be set in the
RequestMap using content settings. Or in fact in the Apache vhost using
ShibRequestSetting, with no RequestMap at all. All of that is documented in
the NativeSPApacheConfig topic.

Things like the IdP entityID, custom error templates, etc. can all be
defined now without using an ApplicationOverride. If I know what's supposed
to be distinct in the vhosts, I can identify what actually requires an
override.

> (Don't know about the use of application- or IdP-specific credentials
> though, since the OP seems to be using different credentials for each
> application for whatever reason?)

I didn't catch that. That is indeed a bad idea and serves no good purpose,
but that would still have to go inside the Overrides using RelyingParty
elements (that's the equivalent of the old CredentialUse feature), and I
documented that in some detail this week in the MultipleCredentials topic.
But yes, this is a bad idea and is best avoided. It's one physical install,
just use one key.

> Note that there is an XSLT script (called 'upgrade.xsl') distributed
> with the Shib 2.x SP that /will/ try a conversion from the old format
> to the new (could be out of date, though, I never used it):

It is out of date, but anything it generates that's not broken would still
be compatible. It most certainly can't handle anything this complex though,
which is why I didn't mention it.

-- Scott

Peter Schober

unread,

Dec 5, 2009, 8:24:31 AM12/5/09

to shibbole...@internet2.edu

* Scott Cantor <cant...@osu.edu> [2009-12-05 04:17]:

> > Note that there is an XSLT script (called 'upgrade.xsl')
> > distributed with the Shib 2.x SP that /will/ try a conversion from
> > the old format to the new (could be out of date, though, I never
> > used it):
>
> It is out of date, but anything it generates that's not broken would
> still be compatible. It most certainly can't handle anything this
> complex though, which is why I didn't mention it.

Actually didn't look too bad (not that I can make sense of why the v1
config file looks like it does), with this small patch to upgrade.xslt:

--- configs/upgrade.xsl (revision 3205)
+++ configs/upgrade.xsl (working copy)
@@ -223,8 +223,7 @@

<xsl:for-each select="oldconf:Application">
<xsl:text>
 </xsl:text>
- <ApplicationOverride>
- <xsl:apply-templates select="@*"/>
+ <ApplicationOverride id="{@id}" entityID="{@providerId}">
<xsl:apply-templates select="oldconf:Sessions"/>
<xsl:apply-templates select="oldconf:Errors"/>
<xsl:apply-templates select="oldconf:CredentialUse"/>

At least with that applied (and the referenced external credential and
metadata files in place) `shibd -t` only outputs the expected
deprecation WARNings for PolicyRules and defaultACSIndex (which of
course also could be fixed in the XSLT, but doesn't add anything
relevant to this thread).
-peter

Richard Genthner

unread,

Dec 5, 2009, 8:32:33 AM12/5/09

to shibbole...@internet2.edu

Peter,
I wasn't hoping for people to do it for me but pick up pieces and
explain the difference like scott did, but I'll try the xsltproc method
first. Thanks for the information.

Peter Schober

unread,

Dec 5, 2009, 8:40:55 AM12/5/09

to shibbole...@internet2.edu

* Richard Genthner <rgen...@symplicity.com> [2009-12-05 14:33]:

> I wasn't hoping for people to do it for me but pick up pieces and
> explain the difference like scott did

Well, "here's some 233 lines of config, please explain any differences
to the new format" is still asking a but much in my book.
But what do I know.

> but I'll try the xsltproc method first

Be sure to apply the patch to upgrade.xslt first (see my previous
mail) or alternatively s/providerId/entityID/ after the transformation
for the five ApplicationOverride elements).

Also note that I seemed to have missed the redirect of STDOUT to a
file in my xsltproc command line example before (" > shibboleth2.xml").
-peter

Richard Genthner

unread,

Dec 5, 2009, 8:42:29 AM12/5/09

to shibbole...@internet2.edu

Peter and Scott,
When I tried to use the upgrade.xsl with peters patch I get his
[root@gp5a:/etc/shibboleth] xsltproc
upgrade.xsl /etc/shibboleth1.3/shibboleth.xml > shibboleth2-upgrade.xml
compilation error: file upgrade.xsl line 8 element stylesheet
xsl:version: only 1.0 features are supported

Peter Schober

unread,

Dec 5, 2009, 8:47:16 AM12/5/09

to shibbole...@internet2.edu

* Richard Genthner <rgen...@symplicity.com> [2009-12-05 14:43]:

> When I tried to use the upgrade.xsl with peters patch I get his
> [root@gp5a:/etc/shibboleth] xsltproc
> upgrade.xsl /etc/shibboleth1.3/shibboleth.xml > shibboleth2-upgrade.xml
> compilation error: file upgrade.xsl line 8 element stylesheet
> xsl:version: only 1.0 features are supported

Yes. And the file still has been created successfully. You did check
that, did you? At least it did so on my box.
If you're worried try Saxon, where I also gave a complete instruction,
-peter

Richard Genthner

unread,

Dec 5, 2009, 8:51:08 AM12/5/09

to shibbole...@internet2.edu

Pete works perfectly. Need to fire the shibd daemon and test it out.
Thanks for the help everyone.

Richard Genthner

unread,

Dec 5, 2009, 8:53:48 AM12/5/09

to shibbole...@internet2.edu

pete,
OOps something blew up
[root@gp5a:/etc/shibboleth] shibd -t
2009-12-05 08:52:21 WARN Shibboleth.Config : detected legacy Policy
configuration, please convert to new PolicyRule syntax
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 ERROR OpenSAML.Metadata.Chaining : error building
MetadataProvider: Unable to access local file
(/etc/shibboleth/InCommon-metadata.xml)
2009-12-05 08:52:21 ERROR XMLTooling.ParserPool : fatal error on line
77, column 17, message: '--' sequence is illegal in comment
2009-12-05 08:52:21 ERROR Shibboleth.AttributeExtractor.XML : error
while loading configuration from (/etc/shibboleth/attribute-map.xml):
XML error(s) during parsing, check log for specifics
2009-12-05 08:52:21 CRIT Shibboleth.Application : error building
AttributeExtractor: XML error(s) during parsing, check log for specifics
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 ERROR OpenSSL : error code: 33558530 in bss_file.c,
line 352
2009-12-05 08:52:21 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/certs/incommon.key','r')
2009-12-05 08:52:21 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 354
2009-12-05 08:52:21 ERROR XMLTooling.CredentialResolver.Chaining :
caught exception processing embedded CredentialResolver element: Unable
to load private key from file (/etc/shibboleth/certs/incommon.key).
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
2009-12-05 08:52:21 WARN Shibboleth.PropertySet : deprecation -
remapping property (defaultACSIndex) to (acsIndex)
overall configuration is loadable, check console for non-fatal problems

Richard Genthner

unread,

Dec 5, 2009, 8:57:52 AM12/5/09

to shibbole...@internet2.edu

I got it down to these errors

[root@gp5a:/etc/shibboleth] shibd -t
2009-12-05 08:57:29 WARN Shibboleth.Config : detected legacy Policy

configuration, please convert to new PolicyRule syntax