java.lang.SecurityException: sealing violation: package org.privacyidea is sealed

[yveralt]

Hello there,
i installed the plugin on my IdP Shibboleth 4.3.1, using a very basic triggerChallenge configuration. When I try to connect to a service provider that requires two-factor authentication, I get this error:

2023-11-21 10:48:50,230 - 193.206.158.212 - INFO [net.shibboleth.idp.authn.impl.LDAPCredentialValidator:163] - Credential Validator ldap: Login by 'test.user8' succeeded
2023-11-21 10:48:52,201 - 193.206.158.212 - ERROR [net.shibboleth.idp.authn:39] - Uncaught runtime exception
java.lang.SecurityException: sealing violation: package org.privacyidea is sealed
	at java.base/java.net.URLClassLoader.getAndVerifyPackage(URLClassLoader.java:463)
2023-11-21 10:48:52,338 - 193.206.158.212 - WARN [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event occurred while processing the request: RuntimeException

I appreciate any help! Thank you!

[lukasmatusiewicz]

Hi @yveralt ,

It looks like a configuration error. The plugin isn't even started. Have you added the flow to the MFA Module? Have you turned on the MFA Module? (See readme)

Greets!

[lukasmatusiewicz]

Hi @yveralt ,
is your problem solved?
Greets

[yveralt]

Hi @lukasmatusiewicz,
sorry for the late response.

I have done a new installation on a fresh Shibboleth IdP 4.3.1
with Jetty 9.4.43.v20210629 and openjdk 11.0.21 2023-10-17 LTS.

I noticed that, in my case, the installation of the plugin does not enable the idp.authn.privacyIDEA module,
these are some logs obtained with the --verbose command:

2023-12-19 14:04:50,263 - DEBUG [net.shibboleth.idp.installer.plugin.impl.TrustStore:171] - Signature Check Succeeded
2023-12-19 14:04:50,285 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:175] - Plugin org.privacyidea.privacyIDEA loaded
2023-12-19 14:04:50,285 - DEBUG [net.shibboleth.idp.installer.plugin.impl.PluginInstaller:176] - Found Service announcing itself as org.privacyidea.privacyIDEA
2023-12-19 14:04:50,286 - INFO [net.shibboleth.idp.installer.plugin.impl.PluginInstaller:256] - Installing Plugin org.privacyidea.privacyIDEA version 1.0.0
Installing Plugin org.privacyidea.privacyIDEA version 1.0.0
...
2023-12-19 14:04:50,365 - DEBUG [net.shibboleth.idp.installer.plugin.impl.PluginInstaller:181] - Contents file for plugin org.privacyidea.privacyIDEA (/opt/shibboleth-idp/dist/plugin-contents/org.privacyidea.privacyIDEA) does not exist
2023-12-19 14:04:50,372 - DEBUG [net.shibboleth.idp.installer.plugin.impl.PluginInstaller:176] - org.privacyidea.privacyIDEA not installed. files renamed
2023-12-19 14:04:50,372 - DEBUG [net.shibboleth.idp.installer.plugin.impl.PluginInstallerSupport:181] - Walking /tmp/plugin-installer-unpack13642210951929197864/idp-plugin-privacyIDEA-1.0.0/webapp, looking for a name clash in /opt/shibboleth-idp/dist/plugin-webapp
2023-12-19 14:04:50,373 - DEBUG [net.shibboleth.idp.installer.plugin.impl.PluginInstallerSupport:181] - Copying from /tmp/plugin-installer-unpack13642210951929197864/idp-plugin-privacyIDEA-1.0.0/webapp to /opt/shibboleth-idp/dist/plugin-webapp
...
2023-12-19 14:04:50,410 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:212] - Module idp.authn.privacyIDEA loaded
2023-12-19 14:04:50,410 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.authn.privacyIDEA: Resource /org/privacyidea/views/main.vm -> views/privacyIDEA/main.vm (replace)
2023-12-19 14:04:50,410 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.authn.privacyIDEA: Resource /org/privacyidea/edit-webapp/js/pi-webauthn.js -> edit-webapp/js/pi-webauthn.js (replace)
2023-12-19 14:04:50,410 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.authn.privacyIDEA: Resource /org/privacyidea/doc/privacyIDEA-LICENSE.txt -> doc/privacyIDEA-LICENSE.txt (noreplace)
2023-12-19 14:04:50,410 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.authn.privacyIDEA: Resource /org/privacyidea/privacyidea.properties -> conf/authn/privacyidea.properties (noreplace)
2023-12-19 14:04:50,410 - DEBUG [net.shibboleth.idp.installer.plugin.impl.PluginInstaller:176] - Not re-enabling module idp.authn.privacyIDEA, not provided by this plugin

of course i enabled it manually.
I also restarted the idp for each modification i made.
Unfortunately the result it's the same.

Greets

[lukasmatusiewicz]

Have you tried to run the installation process again? This logs looks good. Have you encountered the same error?

[lukasmatusiewicz]

Hi @yveralt , suddenly I've reproduced your this error and could find the issue which causes it probably only with Jetty.
The proper fix will be released in v1.1.0.

[JanOppolzer]

I've just run into the same issue yesterday using Debian 12 (Bookworm), openjdk 17.0.10 and Jetty 11.0.16. I'm looking forward to v1.1.0 and I'm even willing to test any pre-release version if that could help fixing this problem.

[yveralt]

Hi @lukasmatusiewicz, thank you!
I'll wait the new release.
Greets

[lukasmatusiewicz]

Hi,
the new version 1.1.0 compatible with IdP5 is already released!
https://github.com/privacyidea/shibboleth-plugin/releases/tag/v1.1.0
I am open to your impressions, comments, and suggestions!
Greets!

[JanOppolzer]

It works, Lukas, thank you!