Support for Shibboleth IDP v5

[lollo1964]

Hello.

Fantastic that you have made a plugin in Shibboleth IDP for PrivacyIdea. We have used PrivacyIdea together with Shibboleth for many years and are very satisfied.
I wonder if your plugin works with Shibboleth IPD v5?

I tried, but it didn't work. I get the following message when I log in:
2023-12-21 13:16:05,527 - 193.11.72.251 - INFO [org.privacyidea.action.InitializePIContext:71] - Profile Action InitializePIContext: Create PIServerConfigContext org.privacyidea.context.PIServerConfigContext@50a77be8
2023-12-21 13:16:05,528 - 193.11.72.251 - ERROR [jakarta.servlet.ServletException:88] -
jakarta.servlet.ServletException: Handler dispatch failed: java.lang.NoClassDefFoundError: net/shibboleth/utilities/java/support/logic/Constraint
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1096)
Caused by: java.lang.NoClassDefFoundError: net/shibboleth/utilities/java/support/logic/Constraint
at org.privacyidea.context.PIContext.(PIContext.java:30)
Caused by: java.lang.ClassNotFoundException: net.shibboleth.utilities.java.support.logic.Constraint
at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:641)

Information about my system:
SUSE Linux Enterprise Server 15 SP4
Shibboleth IDP 5.0.0
Jetty 11.0.18
Java openjdk 17.0.9 2023-10-17

Thanks for your work with this plugin :-)

Best Regards,
Per-Olof

Per-Olof Axelsson | System technician
IT-Department | University of Borås
hb.se

[lukasmatusiewicz]

Hi @lollo1964 ,
thank you for the kind words:)

Which plugin version have you installed?

Greets

[lesydimitri]

Seeing as it was complaining about missing classes, I tried to do the most logical thing to me: Figure out what's missing and add it to my installation.

I added java-support-8.4.0.jar to my Tomcat lib directory and restarted the environment.

The error above now no longer occurs, but unfortunately the next one appears.

shib-idp;idp-warn.log;dev;nothing;Caused by: java.lang.NoClassDefFoundError: javax/servlet/http/HttpServletRequest
shib-idp;idp-warn.log;dev;nothing;	at java.base/java.lang.Class.getDeclaredMethods0(Native Method)
shib-idp;idp-warn.log;dev;nothing;	at java.base/java.lang.Class.privateGetDeclaredMethods(Class.java:3402)
shib-idp;idp-warn.log;dev;nothing;	at java.base/java.lang.Class.getDeclaredMethods(Class.java:2504)
shib-idp;idp-warn.log;dev;nothing;	at org.springframework.util.ReflectionUtils.getDeclaredMethods(ReflectionUtils.java:465)
shib-idp;idp-warn.log;dev;nothing;	... 205 common frames omitted
shib-idp;idp-warn.log;dev;nothing;Caused by: java.lang.ClassNotFoundException: javax.servlet.http.HttpServletRequest

Seems like here the code is using the old javax instead of the jakarta namespace. Fair enough, added a javax servlet API JAR to Tomcat and restarted again.

After that, I am greeted with the following error when trying to login through the "Hello World" IDP test login:

What I see here, is that classes are referenced that have been renamed in V5 (https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199500367/ReleaseNotes):

@lukasmatusiewicz I assume it is safe to say that current pre-made releases are not compatible with Shibboleth IdP V5?

Kind regards,
Dimitri Lesy

[lukasmatusiewicz]

Yes, you're right. Thank you for the hint. We already noticed this change, but have to adjust some other things as well and make sure to have also the backward compatibility.
The next version 1.1.0 will be compatible with the idp5.0 and should be released soon.

[icb-]

Do you have a timeline for when you expect to release 1.1.0?

[lukasmatusiewicz]

up to 2 weeks

[lukasmatusiewicz]

Hi,
the new version 1.1.0 compatible with IdP5 is already released!
https://github.com/privacyidea/shibboleth-plugin/releases/tag/v1.1.0
I am open to your impressions, comments, and suggestions!
Greets!