>IdP は同一の サーバーネーム ですが、実ホストは異なってはいないでしょうか。
テストFed時はOSインストール時の自己証明書、運用Fedでは正規の証明書を使用して
いることによる違いです。
サーバー自体はテストFed時も運用Fed時の同一のサーバーを使用しています。
その後、jettyの再起動時に以下のログが記録されていることに気づきました。
2023-02-16 13:02:05,838 - - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:232] - Service 'shibboleth.AttributeResolverService': Reload for shibboleth.AttributeResolverService failed
net.shibboleth.utilities.java.support.service.ServiceException: Failed to load [file [/opt/shibboleth-idp/conf/attribute-resolver.xml], class path resource [net/shibboleth/idp/conf/attribute-resolver-system.xml]]
at net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:387)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'myLDAP': Cannot create inner bean '(inner bean)#5e57d581' of type [org.ldaptive.pool.PooledConnectionFactory] while setting bean property 'connectionFactory'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#5e57d581': Cannot create inner bean '(inner bean)#546a82c5' of type [org.ldaptive.pool.BlockingConnectionPool] while setting constructor argument; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#546a82c5': Invocation of init method failed; nested exception is java.lang.IllegalStateException: Could not initialize pool size
at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBean(BeanDefinitionValueResolver.java:389)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#5e57d581': Cannot create inner bean '(inner bean)#546a82c5' of type [org.ldaptive.pool.BlockingConnectionPool] while setting constructor argument; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#546a82c5': Invocation of init method failed; nested exception is java.lang.IllegalStateException: Could not initialize pool size
at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBean(BeanDefinitionValueResolver.java:389)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#546a82c5': Invocation of init method failed; nested exception is java.lang.IllegalStateException: Could not initialize pool size
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1804)
Caused by: java.lang.IllegalStateException: Could not initialize pool size
at org.ldaptive.pool.AbstractConnectionPool.initialize(AbstractConnectionPool.java:261)
Caused by: org.ldaptive.LdapException: LDAPException(resultCode=49 (invalid credentials), errorMessage='invalid credentials', ldapSDKVersion=4.0.14, revision=c0fb784eebf9d36a67c736d0428fb3577f2e25bb)
at org.ldaptive.provider.ProviderUtils.throwOperationException(ProviderUtils.java:55)
Caused by: com.unboundid.ldap.sdk.LDAPBindException: invalid credentials
at com.unboundid.ldap.sdk.LDAPConnection.bind(LDAPConnection.java:2304)
気になるのは
Failed to load [file [/opt/shibboleth-idp/conf/attribute-resolver.xml]
と
Caused by: com.unboundid.ldap.sdk.LDAPBindException: invalid credentials
ですが、「IdPv4セッティング - ldap.properties ファイルの変更」の記載から
idp.authn.LDAP.bindDNCredential を追加したところ、jetty再起動時のログから
invalid credentialsは消え、以下のログとなっています。
2023-02-16 13:47:38,547 - - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:182] - Service 'shibboleth.AttributeResolverService': Initial load failed
net.shibboleth.utilities.java.support.service.ServiceException: Failed to load [file [/opt/shibboleth-idp/conf/attribute-resolver.xml], class path resource [net/shibboleth/idp/conf/attribute-resolver-system.xml]]
at net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:387)
Caused by: net.shibboleth.utilities.java.support.service.ServiceException: Unable to initialize attribute resolver for ApplicationContext:shibboleth.AttributeResolverService
at net.shibboleth.idp.attribute.resolver.spring.impl.AttributeResolverServiceStrategy.apply(AttributeResolverServiceStrategy.java:112)
Caused by: net.shibboleth.utilities.java.support.component.ComponentInitializationException: Attribute Resolver 'ShibbolethAttributeResolver': Plugin 'eduPersonScopedAffiliation' has a dependency on attribute definition 'eduPersonAffiliation' which doesn't exist
at net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl.checkPlugInDependencies(AttributeResolverImpl.java:732)
attribute定義が不足しているとのログが増えましたが、そもそも
Failed to load [file [/opt/shibboleth-idp/conf/attribute-resolver.xml の読み込みに失敗しており
こちらを解決すべきかと考えています。
このファイルのオーナーはrootで744のパーミッションですので、アクセス権の問題ではないと判断しています。
ただ以下のメッセージから何を確認すべきかができず苦慮しております。
file [/opt/shibboleth-idp/conf/attribute-resolver.xml], class path resource [net/shibboleth/idp/conf/attribute-resolver-system.xml]]